joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403853
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push esi
push edi
push 0x4073d8
push 0x407154
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, 0x407570
mov edi, eax
push esi
call fcn.00402ee5
test eax, eax
pop ecx
je 0x4038a7
and dword [ebp - 8], 0
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], esi
push eax
mov dword [ebp - 0xc], 0x4035da
call edi
pop edi
xor eax, eax
pop esi
leave
ret 0x10
and byte [ebp - 0x114], 0
push reloc.msvcrt.dll_rand
pop ecx
xor eax, eax
lea edi, [ebp - 0x113]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x114]
push eax
call fcn.00402bc0
lea eax, [ebp - 0x114]
push 1
push eax
push 0x407670
push 0x4075f0
push esi
call fcn.00403044
add esp, 0x18
call fcn.00402130
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x403b60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x134
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
push 0x407814
push 0x407888
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
push 0x407828
push 0x407888
mov ebx, eax
call esi
push eax
call edi
push 0x407834
push 0x407888
mov ebp, eax
call esi
push eax
call edi
mov esi, eax
lea eax, [esp + 0x40]
push 0x104
push eax
call ebx
mov al, 0x65
mov dl, 0x74
mov byte [esp + 0x1c], al
mov byte [esp + 0x21], dl
mov byte [esp + 0x22], al
mov byte [esp + 0x25], al
mov byte [esp + 0x26], dl
mov byte [esp + 0x2e], al
mov byte [esp + 0x32], al
mov byte [esp + 0x38], al
mov byte [esp + 0x3a], al
mov byte [esp + 0x3c], al
mov cl, 0x72
mov bl, 0x6c
mov dl, 0x78
xor al, al
mov byte [esp + 0x10], 0x5c
mov byte [esp + 0x11], 0x50
mov byte [esp + 0x12], cl
mov byte [esp + 0x13], 0x6f
mov byte [esp + 0x14], 0x67
mov byte [esp + 0x15], cl
mov byte [esp + 0x16], 0x61
mov byte [esp + 0x17], 0x6d
mov byte [esp + 0x18], 0x20
mov byte [esp + 0x19], 0x46
mov byte [esp + 0x1a], 0x69
mov byte [esp + 0x1b], bl
mov byte [esp + 0x1d], 0x73
mov byte [esp + 0x1e], 0x5c
mov byte [esp + 0x1f], 0x49
mov byte [esp + 0x20], 0x6e
mov byte [esp + 0x23], cl
mov byte [esp + 0x24], 0x6e
mov byte [esp + 0x27], 0x20
mov byte [esp + 0x28], 0x45
mov byte [esp + 0x29], dl
mov byte [esp + 0x2a], 0x70
mov byte [esp + 0x2b], bl
mov byte [esp + 0x2c], 0x6f
mov byte [esp + 0x2d], cl
mov byte [esp + 0x2f], cl
mov byte [esp + 0x30], 0x5c
mov byte [esp + 0x31], 0x69
mov byte [esp + 0x33], dl
mov byte [esp + 0x34], 0x70
mov byte [esp + 0x35], bl
mov byte [esp + 0x36], 0x6f
mov byte [esp + 0x37], cl
mov byte [esp + 0x39], 0x2e
mov byte [esp + 0x3b], dl
mov byte [esp + 0x3d], al
mov byte [esp + 0x42], al
lea ecx, [esp + 0x10]
lea edx, [esp + 0x40]
push ecx
push edx
call ebp
mov ecx, dword [esp + 0x148]
lea eax, [esp + 0x40]
push eax
push ecx
call esi
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x134
ret
Function at 0x10007f60
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
ret

Function at 0x10007f90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x38
mov eax, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
add eax, dword [ecx + 0x3c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
add eax, dword [ecx + 0x78]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x10]
add eax, dword [ecx + 0x20]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x10]
add eax, dword [ecx + 0x1c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x10]
add eax, dword [ecx + 0x24]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x2c], 0xde9c75d
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
sub eax, 0x940fad02
je 0x1000812c
jmp 0x10008034
mov eax, dword [ebp - 0x34]
sub eax, 0x9b1d9619
je 0x10008151
jmp 0x10008047
mov eax, dword [ebp - 0x34]
sub eax, 0xae67f1e3
je 0x10008108
jmp 0x1000805a
mov eax, dword [ebp - 0x34]
sub eax, 0xefa6372e
je 0x1000813a
jmp 0x1000806d
mov eax, dword [ebp - 0x34]
sub eax, 0xde9c75d
je 0x100080ab
jmp 0x10008080
mov eax, dword [ebp - 0x34]
sub eax, 0x3587bc67
je 0x10008166
jmp 0x10008093
mov eax, dword [ebp - 0x34]
sub eax, 0x4844f31a
je 0x100080cb
jmp 0x100080a6
jmp 0x1000816f
mov edx, dword [ebp - 0x28]
mov esi, dword [ebp - 0x10]
mov ecx, 0x9b1d9619
mov eax, 0x4844f31a
cmp edx, dword [esi + 0x18]
cmovb ecx, eax
mov eax, dword [ebp - 0x30]
mov dword [eax], ecx
jmp 0x1000816f
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x28]
add eax, dword [ecx + edx*4]
mov dword [ebp - 0x24], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x24]
mov eax, esp
mov dword [eax + 4], edx
mov dword [eax], ecx
call fcn.1016af40
mov edx, eax
mov ecx, 0x940fad02
mov eax, 0xae67f1e3
cmp edx, 0
cmove ecx, eax
mov eax, dword [ebp - 0x30]
mov dword [eax], ecx
jmp 0x1000816f
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x28]
movzx edx, word [edx + esi*2]
add eax, dword [ecx + edx*4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x30]
mov dword [eax], 0x3587bc67
jmp 0x1000816f
mov eax, dword [ebp - 0x30]
mov dword [eax], 0xefa6372e
jmp 0x1000816f
mov eax, dword [ebp - 0x28]
add eax, 1
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x30]
mov dword [eax], 0xde9c75d
jmp 0x1000816f
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0x30]
mov dword [eax], 0x3587bc67
jmp 0x1000816f
mov eax, dword [ebp - 8]
add esp, 0x38
pop esi
pop ebp
ret
jmp 0x1000801e
Function at 0x10008a80
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
mov dword [ebp - 8], ecx
mov dword [esp], 0x1571
mov dword [esp + 4], 0xffffffff
mov dword [esp + 8], 0x6c078965
call fcn.100147e0
sub esp, 0xc
mov eax, dword [ebp - 8]
add esp, 0x14
pop ebp
ret

Function at 0x10008b00
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov dword [esp + 4], 0x6c078965
call fcn.10014820
add esp, 4
pop ebp
ret 4
Function at 0x10014e60
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x1c
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], 0x18d4c050
lea eax, [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
sub eax, 0xc0c6d7de
je 0x10014f1d
jmp 0x10014e9b
mov eax, dword [ebp - 0x20]
sub eax, 0xd78b7de0
je 0x10014f54
jmp 0x10014eae
mov eax, dword [ebp - 0x20]
sub eax, 0xe1b5c02a
je 0x10014f6a
jmp 0x10014ec1
mov eax, dword [ebp - 0x20]
sub eax, 0x18d4c050
je 0x10014eff
jmp 0x10014ed4
mov eax, dword [ebp - 0x20]
sub eax, 0x1b762d38
je 0x10014f78
jmp 0x10014ee7
mov eax, dword [ebp - 0x20]
sub eax, 0x585956da
je 0x10014f33
jmp 0x10014efa
jmp 0x10014fe0
mov ecx, 0x585956da
mov eax, 0xc0c6d7de
cmp dword [ebp - 0x14], 0x270
cmove ecx, eax
mov eax, dword [ebp - 0x1c]
mov dword [eax], ecx
jmp 0x10014fe0
mov ecx, dword [ebp - 0x10]
call fcn.10014ff0
mov eax, dword [ebp - 0x1c]
mov dword [eax], 0x1b762d38
jmp 0x10014fe0
mov esi, dword [ebp - 0x10]
mov edx, 0x4e0
mov ecx, 0xe1b5c02a
mov eax, 0xd78b7de0
cmp edx, dword [esi]
cmovbe ecx, eax
mov eax, dword [ebp - 0x1c]
mov dword [eax], ecx
jmp 0x10014fe0
mov ecx, dword [ebp - 0x10]
call fcn.10015120
mov eax, dword [ebp - 0x1c]
mov dword [eax], 0xe1b5c02a
jmp 0x10014fe0
mov eax, dword [ebp - 0x1c]
mov dword [eax], 0x1b762d38
jmp 0x10014fe0
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x10]
mov ecx, dword [edx]
mov esi, ecx
add esi, 1
mov dword [edx], esi
mov eax, dword [eax + ecx*4 + 4]
and eax, 0xffffffff
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
shr eax, 0xb
mov ecx, dword [ebp - 0x10]
and eax, dword [ecx + 0x1384]
xor eax, dword [ebp - 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
shl eax, 7
and eax, 0x9d2c5680
xor eax, dword [ebp - 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
shl eax, 0xf
and eax, 0xefc60000
xor eax, dword [ebp - 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
and eax, 0xffffffff
shr eax, 0x12
xor eax, dword [ebp - 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
add esp, 0x1c
pop esi
pop ebp
ret
jmp 0x10014e85
Function at 0x10014ff0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x1c
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], 0x270
mov dword [ebp - 0x18], 0x13c009d6
lea eax, [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
sub eax, 0xbc4d437d
je 0x10015086
jmp 0x1001502a
mov eax, dword [ebp - 0x20]
sub eax, 0xa8d4acf
je 0x100150fb
jmp 0x1001503d
mov eax, dword [ebp - 0x20]
sub eax, 0x13c009d6
je 0x10015068
jmp 0x10015050
mov eax, dword [ebp - 0x20]
sub eax, 0x42fc744b
je 0x10015112
jmp 0x10015063
jmp 0x10015118
mov ecx, 0x42fc744b
mov eax, 0xbc4d437d
cmp dword [ebp - 0xc], 0x4e0
cmovb ecx, eax
mov eax, dword [ebp - 0x1c]
mov dword [eax], ecx
jmp 0x10015118
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
sub ecx, 0x270
mov eax, dword [eax + ecx*4 + 4]
and eax, 0x80000000
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0xc]
sub edx, 0x270
mov ecx, dword [ecx + edx*4 + 8]
and ecx, 0x7fffffff
or eax, ecx
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
shr edx, 1
mov esi, dword [ebp - 0x10]
and esi, 1
xor eax, eax
mov ecx, 0x9908b0df
cmp esi, 0
cmovne eax, ecx
xor edx, eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
sub ecx, 0x270
xor edx, dword [eax + ecx*4 + 0x638]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword [eax + ecx*4 + 4], edx
mov eax, dword [ebp - 0x1c]
mov dword [eax], 0xa8d4acf
jmp 0x10015118
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x1c]
mov dword [eax], 0x13c009d6
jmp 0x10015118
add esp, 0x1c
pop esi
pop ebp
ret
jmp 0x10015014
Function at 0x1001d6c6
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, ecx
call fcn.1001f223
push 5
push dword [ebp + 8]
mov esi, dword [eax + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x1001d706
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x1001d706
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push dword [ebp + 0xc]
mov ecx, edi
push eax
call fcn.1001d70e
jmp 0x1001d708
xor eax, eax
pop edi
pop esi
pop ebp
ret 8

Function at 0x1001d9e6
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
mov dword [esi + 0x84], edi
test edi, 0xffff0000
jne 0x1001da11
cmp dword [esi + 0x80], 0
jne 0x1001da11
movzx eax, di
mov dword [esi + 0x80], eax
call fcn.1001f223
push 5
push edi
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x1001da41
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x1001da41
push ebx
push dword [ebp + 0xc]
mov ecx, esi
push eax
call fcn.1001e04e
jmp 0x1001da43
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x1001dac9
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x24
mov eax, 0x1017f528
call fcn.10038f26
mov edi, ecx
mov dword [ebp - 0x24], edi
mov ebx, dword [edi + 0x8c]
mov esi, dword [edi + 0x88]
mov dword [ebp - 0x18], ebx
call fcn.1001f223
cmp dword [edi + 0x84], 0
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x20], eax
je 0x1001db28
call fcn.1001f223
push 5
push dword [edi + 0x84]
mov ebx, dword [eax + 0xc]
push ebx
mov dword [ebp - 0x20], ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x1001db3c
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, dword [ebp - 0x18]
mov esi, eax
test esi, esi
je 0x1001db38
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov dword [ebp - 0x18], eax
test ebx, ebx
jne 0x1001db44
or eax, 0xffffffff
jmp 0x1001dc96
mov ecx, edi
call fcn.1001dfc6
mov ebx, eax
mov dword [ebp - 0x2c], ebx
call fcn.10025af0
xor esi, esi
and dword [ebp - 0x1c], esi
and dword [ebp - 0x28], esi
mov dword [ebp - 0x14], esi
test ebx, ebx
je 0x1001dbd0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp ebx, eax
je 0x1001dbd0
push ebx
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x1001dbd0
push esi
push ebx
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [ebp - 0x14], 1
call fcn.10019bd6
mov esi, eax
mov dword [ebp - 0x1c], esi
test esi, esi
je 0x1001dbcd
mov ecx, dword [esi]
mov esi, dword [ecx + 0x150]
mov ecx, esi
call dword [section..00cfg]
mov ecx, dword [ebp - 0x1c]
call esi
test eax, eax
je 0x1001dbcd
mov esi, dword [ebp - 0x1c]
mov ecx, esi
call fcn.1002b3a7
test eax, eax
je 0x1001dbcd
push 0
mov ecx, esi
call fcn.1002b3d2
mov dword [ebp - 0x28], 1
mov esi, dword [ebp - 0x14]
and dword [ebp - 4], 0
push edi
call fcn.10025a97
push ebx
call fcn.10020d0d
push dword [ebp - 0x20]
mov ecx, edi
push eax
push dword [ebp - 0x18]
call fcn.1001d929
test eax, eax
jne 0x1001dc19
cmp dword [edi + 0x9c], eax
jne 0x1001dc19
call fcn.1001f223
push ebx
mov eax, dword [eax + 8]
mov dword [ebp - 0x20], eax
call fcn.10020d0d
push dword [ebp - 0x20]
mov ecx, edi
push eax
push dword [ebp - 0x18]
call fcn.1001d929
and dword [edi + 0x9c], 0
jmp 0x1001dc44
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x28], 0
je 0x1001dc58
mov ecx, dword [ebp - 0x1c]
push 1
call fcn.1002b3d2
test esi, esi
je 0x1001dc65
push 1
push ebx
call dword [sym.imp.USER32.dll_EnableWindow]
test ebx, ebx
je 0x1001dc7b
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [edi + 0x20]
jne 0x1001dc7b
push ebx
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [edi]
mov esi, dword [eax + 0x60]
mov ecx, esi
call dword [section..00cfg]
mov ecx, edi
call esi
mov ecx, edi
call fcn.1001e005
mov eax, dword [edi + 0x68]
call fcn.10038fcb
ret
Function at 0x1001df16
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x84], 0
mov esi, dword [ebx + 0x8c]
mov edi, dword [ebx + 0x88]
je 0x1001df5e
call fcn.1001f223
push 5
push dword [ebx + 0x84]
mov eax, dword [eax + 0xc]
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x1001df5e
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x1001df6b
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
xor eax, eax
inc eax
test esi, esi
je 0x1001dfa7
mov edx, 0xffff
lea ecx, [esi + 0xc]
cmp word [esi + 2], dx
jne 0x1001df8a
movzx edi, word [esi + 0x12]
movzx edx, word [esi + 0x14]
jmp 0x1001df93
movzx edx, word [ecx]
mov ecx, esi
movzx edi, word [esi + 0xa]
test dword [ecx], 0x1801
jne 0x1001dfa5
test di, di
jne 0x1001dfa5
test dx, dx
je 0x1001dfa7
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10020ecd
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
xor esi, esi
mov ebx, ecx
push edi
cmp dword [ebp + 8], esi
je 0x10020f0c
call fcn.1001f223
push 0xf0
push dword [ebp + 8]
mov edi, dword [eax + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x10020f0c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x10020f14
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
push esi
mov ecx, ebx
call fcn.1003eaef
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x10024a35
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
je 0x10024ac1
cmp dword [esi + 0x20], 0
je 0x10024ac1
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x10024ac1
cmp dword [ebp + 8], 0
je 0x10024ac1
xor edi, edi
mov ebx, edi
call fcn.1001f223
push str.AFX_DIALOG_LAYOUT
push dword [ebp + 8]
mov eax, dword [eax + 0xc]
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 8], eax
test eax, eax
je 0x10024aa5
mov ebx, dword [ebp - 4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp - 8]
mov edi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x10024ac1
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
push edi
push ebx
push esi
call fcn.1005834f
mov edi, eax
add esp, 0xc
test edi, edi
je 0x10024abd
mov ecx, esi
call fcn.100248fc
mov eax, edi
jmp 0x10024ac3
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x1002a3e5
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
push edi
cmp dword [ecx + 0x58], esi
je 0x1002a438
push esi
push dword [ebp + 8]
call fcn.1002a9b4
mov edi, eax
test edi, edi
je 0x1002a433
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp + 0xc]
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x1002a433
mov eax, dword [ebp - 8]
jmp 0x1002a44a
mov eax, dword [ebp + 0x10]
jmp 0x1002a44a
push dword [ecx + 0x6c]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
pop edi
pop esi
leave
ret 0xc
Function at 0x1002a4d9
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1017fce7
mov eax, dword fs:[0]
push eax
mov eax, 0x201c
call fcn.10019750
mov eax, dword [0x101e5ee0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xor ebx, ebx
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x14]
mov dword [ebp - 0x201c], edi
mov dword [ebp - 0x2024], eax
cmp dword [ecx + 0x58], ebx
je 0x1002a60a
push ebx
push edx
call fcn.1002a9b4
mov ebx, eax
test ebx, ebx
jne 0x1002a541
push esi
jmp 0x1002a632
lea ecx, [ebp - 0x2014]
call fcn.10004450
xor ecx, ecx
lea eax, [ebp - 0x2018]
push eax
push ecx
lea eax, [ebp - 0x2020]
mov dword [ebp - 4], ecx
push eax
push ecx
push dword [ebp - 0x2024]
mov dword [ebp - 0x2020], ecx
push ebx
mov dword [ebp - 0x2018], ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x201c], eax
test eax, eax
jne 0x1002a5c9
mov eax, dword [ebp - 0x2018]
lea ecx, [ebp - 0x2014]
shr eax, 1
push eax
call fcn.100063b0
lea ecx, [ebp - 0x2018]
push ecx
push eax
lea eax, [ebp - 0x2020]
push eax
push 0
push dword [ebp - 0x2024]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x2014]
mov dword [ebp - 0x201c], eax
call fcn.1001ed97
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x201c], 0
jne 0x1002a5f7
mov esi, dword [ebp - 0x2014]
add esi, 0xfffffff0
push esi
call fcn.1001c30e
pop ecx
add eax, 0x10
mov ecx, esi
mov dword [edi], eax
call fcn.10006090
jmp 0x1002a639
push esi
mov ecx, edi
call fcn.10019a98
mov ecx, dword [ebp - 0x2014]
lea ecx, [ecx - 0x10]
jmp 0x1002a5f0
test esi, esi
jne 0x1002a613
mov esi, 0x101cd330
push dword [ecx + 0x6c]
lea ecx, [ebp - 0x2010]
push 0x1000
push ecx
push esi
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x2010]
push eax
mov ecx, edi
call fcn.10019a98
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10038ee5
leave
ret 0x10
Function at 0x1002a6f4
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x18
mov eax, 0x1017fcba
call fcn.10038ef3
mov eax, ecx
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp + 0x10]
xor edi, edi
mov esi, dword [ebp + 0x14]
push edi
mov dword [ebx], edi
mov dword [esi], edi
cmp dword [eax + 0x58], edi
je 0x1002a79c
push dword [ebp + 8]
call fcn.1002a9b4
mov dword [ebp - 0x10], eax
test eax, eax
je 0x1002a82e
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], edi
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], edi
push ecx
push edi
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], edi
push ecx
push edi
push dword [ebp + 0xc]
mov dword [ebp - 0x14], edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp - 0x14]
mov dword [esi], ecx
test eax, eax
jne 0x1002a785
push ecx
call fcn.10019552
pop ecx
lea ecx, [ebp - 0x14]
mov dword [ebx], eax
push ecx
push eax
lea eax, [ebp - 0x18]
push eax
push edi
push dword [ebp + 0xc]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1002a785
xor edi, edi
inc edi
jmp 0x1002a78f
push dword [ebx]
call fcn.1001955b
pop ecx
mov dword [ebx], edi
lea ecx, [ebp - 0x24]
call fcn.1002a397
jmp 0x1002a82c
mov eax, dword [eax]
push dword [ebp + 0xc]
push dword [ebp + 8]
mov esi, dword [eax + 0x84]
lea eax, [ebp - 0x10]
push eax
mov ecx, esi
call dword [section..00cfg]
mov ecx, dword [ebp - 0x18]
call esi
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], 1
mov ecx, dword [eax - 0xc]
test ecx, ecx
je 0x1002a824
mov esi, dword [ebp + 0x14]
shr ecx, 1
push ecx
mov dword [esi], ecx
call fcn.10019552
mov dword [ebx], eax
pop ecx
cmp dword [esi], edi
jbe 0x1002a81e
mov esi, dword [ebp + 0x10]
xor ecx, ecx
inc ecx
mov dword [ebp - 0x18], ecx
push ecx
lea ecx, [ebp - 0x10]
call fcn.100274d0
lea ecx, [edi + edi]
mov bl, al
push ecx
lea ecx, [ebp - 0x10]
call fcn.100274d0
mov ecx, dword [esi]
shl bl, 4
sub bl, 0x51
add al, bl
mov byte [edi + ecx], al
inc edi
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 0x18]
add ecx, 2
mov dword [ebp - 0x18], ecx
cmp edi, dword [eax]
jb 0x1002a7e9
mov eax, dword [ebp - 0x10]
xor edi, edi
inc edi
lea ecx, [eax - 0x10]
call fcn.10006090
mov eax, edi
call fcn.10038fcb
ret 0x10

Function at 0x1002b23f
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x1017f47d
call fcn.10038ef3
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x74], ebx
jne 0x1002b265
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x1002b2bf
lea ecx, [ebp - 0x10]
call fcn.10004450
mov edi, dword [edi + 0x74]
lea ecx, [ebp - 0x10]
push ecx
mov dword [ebp - 4], ebx
mov eax, dword [edi]
mov esi, dword [eax + 0x8c]
mov ecx, esi
call dword [section..00cfg]
mov ecx, edi
call esi
mov esi, dword [ebp + 8]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push esi
call fcn.1016baed
push eax
call fcn.10005890
add esp, 0x14
test esi, esi
je 0x1002b2b2
push esi
call fcn.1016b7db
pop ecx
mov ebx, eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.10006090
mov eax, ebx
call fcn.10038fcb
ret 8