joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10003170
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x101effd8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x14], 0x4e52454b
mov dword [ebp - 0x10], 0x32334c45
mov dword [ebp - 0xc], 0x6c6c642e
mov byte [ebp - 8], 0
mov eax, dword [edi]
mov dword [ebp - 0x3c], edi
movzx esi, word [eax + 0x14]
add esi, eax
mov dword [ebp - 0x20], 0x74726956
lea eax, [ebp - 0x20]
mov dword [ebp - 0x1c], 0x466c6175
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x18], 0x656572
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, dword [edi]
xor ecx, ecx
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x38], 0
cmp cx, word [edi + 6]
jae 0x100032b6
add esi, 0x28
push ebx
nop
mov edx, dword [esi + 0x14]
test edx, 0x2000000
je 0x1000320c
push 0x4000
push dword [esi]
push dword [esi - 8]
call eax
jmp 0x10003297
mov ecx, edx
mov eax, edx
shr eax, 0x1e
shr ecx, 0x1d
and eax, 1
and ecx, 1
lea ecx, [eax + ecx*2]
mov eax, edx
shr eax, 0x1f
lea eax, [eax + ecx*2]
mov ebx, dword [eax*4 + 0x101d0cf4]
test edx, 0x4000000
je 0x1000323c
or ebx, 0x200
mov eax, dword [esi]
test eax, eax
jne 0x10003257
test dl, 0x40
je 0x1000324c
mov eax, dword [edi + 0x20]
jmp 0x10003253
test dl, dl
jns 0x10003297
mov eax, dword [edi + 0x24]
test eax, eax
je 0x10003297
lea eax, [ebp - 0x30]
mov dword [ebp - 0x30], 0x74726956
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x2c], 0x506c6175
push eax
mov dword [ebp - 0x28], 0x65746f72
mov word [ebp - 0x24], 0x7463
mov byte [ebp - 0x22], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [ebp - 0x34]
push ecx
push ebx
push dword [esi]
push dword [esi - 8]
call eax
mov eax, dword [ebp - 0x3c]
add esi, 0x28
mov ecx, dword [ebp - 0x38]
inc ecx
mov dword [ebp - 0x38], ecx
mov edi, dword [eax]
movzx eax, word [edi + 6]
cmp ecx, eax
mov eax, dword [ebp - 0x40]
jl 0x100031f0
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1014306d
mov esp, ebp
pop ebp
ret
Function at 0x10003850
Capabilities:
Contain obfuscated stackstrings
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
mov eax, dword [0x101effd8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
test ebx, ebx
je 0x10003a21
cmp dword [ebx + 0x10], 0
lea eax, [ebx + 4]
mov dword [ebp - 0x78], eax
je 0x10003890
mov ecx, dword [eax]
mov eax, dword [ebx]
push 0
push 0
push ecx
mov eax, dword [eax + 0x28]
add eax, ecx
call eax
mov dword [ebx + 0x10], 0
jmp 0x10003893
mov dword [ebp - 0x78], eax
cmp dword [ebx + 8], 0
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x14], 0x4e52454b
mov dword [ebp - 0x10], 0x32334c45
mov dword [ebp - 0xc], 0x6c6c642e
mov byte [ebp - 8], 0
je 0x10003991
lea eax, [ebp - 0x48]
mov dword [ebp - 0x48], 0x65657246
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x44], 0x7262694c
push eax
mov dword [ebp - 0x40], 0x797261
call esi
push eax
call edi
xor esi, esi
mov edi, eax
cmp dword [ebx + 0xc], esi
jle 0x10003904
nop
mov ecx, dword [ebx + 8]
mov eax, dword [ecx + esi*4]
cmp eax, 0xffffffff
je 0x100038fe
push eax
call edi
inc esi
cmp esi, dword [ebx + 0xc]
jl 0x100038f0
mov edi, dword [ebx + 8]
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 0x4e52454b
push eax
mov dword [ebp - 0x20], 0x32334c45
mov dword [ebp - 0x1c], 0x6c6c642e
mov byte [ebp - 0x18], 0
mov dword [ebp - 0x30], 0x70616548
mov dword [ebp - 0x2c], 0x65657246
mov byte [ebp - 0x28], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov dword [ebp - 0x64], 0x50746547
lea eax, [ebp - 0x64]
mov dword [ebp - 0x60], 0x65636f72
push eax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x5c], 0x65487373
push eax
mov word [ebp - 0x58], 0x7061
mov byte [ebp - 0x56], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push edi
push 0
call eax
push eax
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea eax, [ebp - 0x54]
mov dword [ebp - 0x54], 0x74726956
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x50], 0x466c6175
push eax
mov dword [ebp - 0x4c], 0x656572
call esi
push eax
call edi
mov ecx, dword [ebp - 0x78]
mov ecx, dword [ecx]
test ecx, ecx
je 0x100039c6
push 0x8000
push 0
push ecx
call eax
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x3c], 0x70616548
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x38], 0x65657246
push eax
mov byte [ebp - 0x34], 0
call esi
push eax
call edi
mov esi, eax
mov dword [ebp - 0x74], 0x50746547
lea eax, [ebp - 0x74]
mov dword [ebp - 0x70], 0x65636f72
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x6c], 0x65487373
push eax
mov word [ebp - 0x68], 0x7061
mov byte [ebp - 0x66], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call edi
push ebx
push 0
call eax
push eax
call esi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.1014306d
mov esp, ebp
pop ebp
ret
Function at 0x10005200
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [esp + 0xc], edi
test eax, eax
jg 0x10005232
jl 0x10005225
test ecx, ecx
jne 0x10005232
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x100052f2
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], eax
mov ecx, ebx
call fcn.10006b20
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x1000529e
jg 0x1000525d
test esi, esi
je 0x1000529e
mov ecx, dword [esp + 0xc]
cmp ecx, eax
jg 0x10005275
mov eax, dword [esp + 0x10]
jl 0x1000526f
cmp eax, esi
jae 0x10005275
mov esi, eax
mov dword [esp + 0x14], ecx
mov eax, dword [ebx + 0x1c]
push esi
push dword [eax]
push edi
call fcn.1015bf40
mov eax, dword [ebx + 0x2c]
add esp, 0xc
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
sub ecx, esi
sbb edx, dword [esp + 0x14]
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
jmp 0x100052bf
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c]
mov edx, dword [esp + 0xc]
cmp eax, 0xffffffff
je 0x100052db
mov ecx, dword [esp + 0x10]
mov esi, 1
add ecx, 0xffffffff
mov byte [edi], al
adc edx, 0xffffffff
add edi, esi
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ecx
test edx, edx
jg 0x10005244
jl 0x100052db
test ecx, ecx
jne 0x10005244
mov eax, dword [ebp + 0xc]
sub eax, dword [esp + 0x10]
mov ecx, dword [ebp + 0x10]
sbb ecx, edx
mov edx, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
lea esi, [ebx + 0x2c]
mov edi, ecx
mov edx, dword [eax]
test edx, edx
je 0x10005336
mov eax, dword [esi]
mov eax, dword [eax]
test eax, eax
je 0x10005336
mov edi, dword [esp + 0xc]
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push edx
push edi
call fcn.1015bf40
mov eax, dword [ebx + 0x2c]
add edi, esi
mov dword [esp + 0x18], edi
add esp, 0xc
mov edi, dword [ebp + 0xc]
sub edi, esi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
lea esi, [ebx + 0x2c]
cmp dword [ebx + 0x4c], 0
je 0x100053a7
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x1000535c
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi]
mov dword [eax], edx
mov esi, dword [esp + 0xc]
cmp edi, 0xfff
jbe 0x10005392
nop dword [eax + eax]
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call fcn.101608d6
add esp, 0x10
add esi, eax
sub edi, eax
cmp eax, 0xfff
jne 0x100053a7
cmp edi, eax
ja 0x10005370
test edi, edi
je 0x100053a7
push dword [ebx + 0x4c]
push edi
push 1
push esi
call fcn.101608d6
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10006f50
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10186f10
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x101effd8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], eax
push 8
mov dword [ebp - 0x18], eax
mov dword [eax], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.1000c403
mov esi, eax
add esp, 4
test esi, esi
je 0x10006fb6
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.101481f9
add esp, 4
mov dword [esi + 4], eax
jmp 0x10006fb8
xor esi, esi
mov eax, dword [ebp - 0x10]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
lea edi, [eax + 0x14]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov ebx, dword [ebp - 0x10]
mov dword [edi], 0
mov dword [edx], 0
mov dword [eax + 0x20], ecx
mov dword [ebx], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov byte [ebx + 0x48], 0
mov byte [ebx + 0x3d], 0
mov ebx, dword [ebp - 0x14]
mov dword [eax + 0xc], ebx
mov ebx, dword [ebp - 0x10]
mov dword [eax + 0x2c], edx
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov eax, dword [ebp - 0x18]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov ecx, dword [0x101f99e8]
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov edx, dword [0x101f99ec]
mov dword [eax + 0x4c], 0
mov dword [eax + 0x40], ecx
mov dword [eax + 0x44], edx
mov dword [eax + 0x38], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000a9c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x1000aa19
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x1000aa19
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, dword [ebp + 0x10]
lea ecx, [esi + eax]
and edx, 0xf
jbe 0x1000aa0a
cmp esi, ecx
jae 0x1000aa19
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edx, 1
jne 0x1000a9f8
cmp esi, ecx
jae 0x1000aa19
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
jmp 0x1000aa1b
xor eax, eax
pop esi
pop ebp
ret
Function at 0x1000b1f2
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x18
mov eax, 0x1018733e
call fcn.10143820
mov eax, ecx
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp + 0x10]
xor edi, edi
mov esi, dword [ebp + 0x14]
push edi
mov dword [ebx], edi
mov dword [esi], edi
cmp dword [eax + 0x58], edi
je 0x1000b29a
push dword [ebp + 8]
call fcn.1000b51d
mov dword [ebp - 0x10], eax
test eax, eax
je 0x1000b32c
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], edi
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], edi
push ecx
push edi
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], edi
push ecx
push edi
push dword [ebp + 0xc]
mov dword [ebp - 0x14], edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp - 0x14]
mov dword [esi], ecx
test eax, eax
jne 0x1000b283
push ecx
call fcn.1001c6ab
pop ecx
lea ecx, [ebp - 0x14]
mov dword [ebx], eax
push ecx
push eax
lea eax, [ebp - 0x18]
push eax
push edi
push dword [ebp + 0xc]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1000b283
xor edi, edi
inc edi
jmp 0x1000b28d
push dword [ebx]
call fcn.10008559
pop ecx
mov dword [ebx], edi
lea ecx, [ebp - 0x24]
call fcn.1000b0b9
jmp 0x1000b32a
mov eax, dword [eax]
push dword [ebp + 0xc]
push dword [ebp + 8]
mov esi, dword [eax + 0x84]
lea eax, [ebp - 0x10]
push eax
mov ecx, esi
call dword [0x10197958]
mov ecx, dword [ebp - 0x18]
call esi
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], 1
mov ecx, dword [eax - 0xc]
test ecx, ecx
je 0x1000b322
mov esi, dword [ebp + 0x14]
shr ecx, 1
push ecx
mov dword [esi], ecx
call fcn.1001c6ab
mov dword [ebx], eax
pop ecx
cmp dword [esi], edi
jbe 0x1000b31c
mov esi, dword [ebp + 0x10]
xor ecx, ecx
inc ecx
mov dword [ebp - 0x18], ecx
push ecx
lea ecx, [ebp - 0x10]
call fcn.1000b095
lea ecx, [edi + edi]
mov bl, al
push ecx
lea ecx, [ebp - 0x10]
call fcn.1000b095
mov ecx, dword [esi]
shl bl, 4
sub bl, 0x51
add al, bl
mov byte [edi + ecx], al
inc edi
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 0x18]
add ecx, 2
mov dword [ebp - 0x18], ecx
cmp edi, dword [eax]
jb 0x1000b2e7
mov eax, dword [ebp - 0x10]
xor edi, edi
inc edi
lea ecx, [eax - 0x10]
call fcn.1000a578
mov eax, edi
call fcn.101437ee
ret 0x10

Function at 0x1000b334
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
push edi
cmp dword [ecx + 0x58], esi
je 0x1000b387
push esi
push dword [ebp + 8]
call fcn.1000b51d
mov edi, eax
test edi, edi
je 0x1000b382
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp + 0xc]
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x1000b382
mov eax, dword [ebp - 8]
jmp 0x1000b399
mov eax, dword [ebp + 0x10]
jmp 0x1000b399
push dword [ecx + 0x6c]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
pop edi
pop esi
leave
ret 0xc
Function at 0x1000b39f
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1018736b
mov eax, dword fs:[0]
push eax
mov eax, 0x201c
call fcn.101439a0
mov eax, dword [0x101effd8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xor ebx, ebx
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x14]
mov dword [ebp - 0x201c], edi
mov dword [ebp - 0x2024], eax
cmp dword [ecx + 0x58], ebx
je 0x1000b4d0
push ebx
push edx
call fcn.1000b51d
mov ebx, eax
test ebx, ebx
jne 0x1000b407
push esi
jmp 0x1000b4f8
lea ecx, [ebp - 0x2014]
call fcn.1000902c
xor ecx, ecx
lea eax, [ebp - 0x2018]
push eax
push ecx
lea eax, [ebp - 0x2020]
mov dword [ebp - 4], ecx
push eax
push ecx
push dword [ebp - 0x2024]
mov dword [ebp - 0x2020], ecx
push ebx
mov dword [ebp - 0x2018], ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x201c], eax
test eax, eax
jne 0x1000b48f
mov eax, dword [ebp - 0x2018]
lea ecx, [ebp - 0x2014]
shr eax, 1
push eax
call fcn.1000a1b4
lea ecx, [ebp - 0x2018]
push ecx
push eax
lea eax, [ebp - 0x2020]
push eax
push 0
push dword [ebp - 0x2024]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x2014]
mov dword [ebp - 0x201c], eax
call fcn.1000b659
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x201c], 0
jne 0x1000b4bd
mov esi, dword [ebp - 0x2014]
add esi, 0xfffffff0
push esi
call fcn.1000987e
pop ecx
add eax, 0x10
mov ecx, esi
mov dword [edi], eax
call fcn.1000a578
jmp 0x1000b4ff
push esi
mov ecx, edi
call fcn.10008f82
mov ecx, dword [ebp - 0x2014]
lea ecx, [ecx - 0x10]
jmp 0x1000b4b6
test esi, esi
jne 0x1000b4d9
mov esi, 0x10197c84
push dword [ecx + 0x6c]
lea ecx, [ebp - 0x2010]
push 0x1000
push ecx
push esi
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x2010]
push eax
mov ecx, edi
call fcn.10008f82
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1014306d
leave
ret 0x10
Function at 0x1000dc3f
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
xor eax, eax
mov dword [ebp - 8], ecx
inc eax
inc ebx
mov dword [ebp - 4], eax
cmp dword [edi + 8], ebx
jle 0x1000dcb6
mov edx, dword [ebp + 0xc]
test edx, edx
je 0x1000dc7c
mov eax, dword [ecx + 0x10]
cmp dword [eax + ebx*8 + 4], edx
je 0x1000dc7c
mov eax, dword [edi + 0xc]
cmp dword [eax + ebx*4], 0
je 0x1000dca9
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x1000dcac
mov eax, dword [edi + 0xc]
mov eax, dword [eax + ebx*4]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x1000dca2
mov eax, dword [eax]
push 1
mov esi, dword [eax]
mov ecx, esi
call dword [0x10197958]
mov ecx, dword [ebp - 0xc]
call esi
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 0xc]
mov eax, dword [edi + 0xc]
and dword [eax + ebx*4], 0
mov eax, dword [ebp - 4]
inc ebx
cmp ebx, dword [edi + 8]
jl 0x1000dc5f
test eax, eax
je 0x1000dcfd
lea esi, [ecx + 0x1c]
mov ebx, edi
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [ebp - 8]
push edi
add ecx, 0x14
call fcn.1000df2e
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push dword [ebx + 0xc]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [edi]
push 1
mov esi, dword [eax]
mov ecx, esi
call dword [0x10197958]
mov ecx, edi
call esi
mov eax, dword [ebp - 8]
push 0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x1000df81
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push 0x10
mov eax, 0x10187568
call fcn.10143889
mov ebx, ecx
mov dword [ebp - 0x18], ebx
lea eax, [ebx + 0x1c]
push eax
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [ebp + 8]
test edi, edi
jle 0x1000e078
cmp edi, dword [ebx + 0xc]
jge 0x1000e078
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
je 0x1000dfd8
cmp edi, dword [esi + 8]
jl 0x1000e066
cmp dword [ebp + 0xc], 0
je 0x1000e066
xor edi, edi
jmp 0x1000e00a
xor edi, edi
push 0x10
mov dword [ebp - 4], edi
call fcn.1000d9dd
mov esi, eax
test esi, esi
je 0x1000dff2
mov dword [esi], vtable.CThreadData.0
jmp 0x1000dff4
mov esi, edi
or dword [ebp - 4], 0xffffffff
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0x14]
mov dword [esi + eax], ecx
mov dword [ebx + 0x14], esi
push 4
push dword [ebx + 0xc]
call fcn.1000d89c
cmp dword [esi + 0xc], 0
pop ecx
pop ecx
jne 0x1000e026
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
jmp 0x1000e032
push 2
push eax
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
mov edx, eax
test edx, edx
je 0x1000e09f
mov ecx, dword [esi + 8]
mov dword [esi + 0xc], edx
mov eax, dword [ebx + 0xc]
sub eax, ecx
shl eax, 2
push eax
lea eax, [edx + ecx*4]
push edi
push eax
call fcn.1015bde0
mov eax, dword [ebx + 0xc]
add esp, 0xc
mov dword [esi + 8], eax
push esi
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov edi, dword [ebp + 8]
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x1000e078
cmp edi, dword [esi + 8]
jge 0x1000e078
mov eax, dword [ebp + 0xc]
mov dword [ecx + edi*4], eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.101437ee
ret 8
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.1000cd8d
int3

Function at 0x100110de
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
xor esi, esi
mov ebx, ecx
push edi
cmp dword [ebp + 8], esi
je 0x1001111d
call fcn.1000e466
push 0xf0
push dword [ebp + 8]
mov edi, dword [eax + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x1001111d
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x10011125
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
push esi
mov ecx, ebx
call fcn.1001ec75
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x10011b6a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
je 0x10011bf6
cmp dword [esi + 0x20], 0
je 0x10011bf6
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x10011bf6
cmp dword [ebp + 8], 0
je 0x10011bf6
xor edi, edi
mov ebx, edi
call fcn.1000e466
push str.AFX_DIALOG_LAYOUT
push dword [ebp + 8]
mov eax, dword [eax + 0xc]
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 8], eax
test eax, eax
je 0x10011bda
mov ebx, dword [ebp - 4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp - 8]
mov edi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x10011bf6
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
push edi
push ebx
push esi
call fcn.1001f7d6
mov edi, eax
add esp, 0xc
test edi, edi
je 0x10011bf2
mov ecx, esi
call fcn.10011908
mov eax, edi
jmp 0x10011bf8
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x1001613e
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x1018724b
call fcn.10143820
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x74], ebx
jne 0x10016164
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x100161be
lea ecx, [ebp - 0x10]
call fcn.1000902c
mov edi, dword [edi + 0x74]
lea ecx, [ebp - 0x10]
push ecx
mov dword [ebp - 4], ebx
mov eax, dword [edi]
mov esi, dword [eax + 0x8c]
mov ecx, esi
call dword [0x10197958]
mov ecx, edi
call esi
mov esi, dword [ebp + 8]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push esi
call fcn.10165ac7
push eax
call fcn.100095c5
add esp, 0x14
test esi, esi
je 0x100161b1
push esi
call fcn.10161424
pop ecx
mov ebx, eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.1000a578
mov eax, ebx
call fcn.101437ee
ret 8