joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1008cc20
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
cmp dword [ebp + 8], 0
je 0x1008ccac
call fcn.100eb402
mov dword [ebp - 0x10], eax
push 0xf0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x1008ccac
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1008cc7f
xor eax, eax
jmp 0x1008ccdd
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1008cca6
push 0xcc5
push str.wincore.cpp
call fcn.100e20d0
test eax, eax
je 0x1008cca6
int3
xor edx, edx
test edx, edx
jne 0x1008cc8c
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0x18]
call fcn.1008cce6
mov dword [ebp - 0xc], eax
cmp dword [ebp - 4], 0
je 0x1008ccda
cmp dword [ebp - 8], 0
je 0x1008ccda
mov ecx, dword [ebp - 8]
push ecx
call fcn.1000b320
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10093325
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
cmp dword [eax + 4], 0x100
jne 0x10093390
mov ecx, dword [ebp + 8]
cmp dword [ecx + 8], 0x70
jne 0x10093390
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xc]
shr eax, 0x10
and eax, 0xffff
and eax, 0xffff
and eax, 0x4000
test eax, eax
jne 0x10093390
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
movsx ecx, ax
test ecx, ecx
jl 0x10093390
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
movsx edx, ax
test edx, edx
jl 0x10093390
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
movsx eax, ax
test eax, eax
jl 0x10093390
mov dword [ebp - 4], 1
jmp 0x10093397
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4
Function at 0x10097a87
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
push 0xed
push str.filecore.cpp
mov eax, dword [ebp - 8]
push eax
call fcn.10093a30
mov ecx, dword [ebp - 8]
cmp dword [ecx + 4], 0xffffffff
jne 0x10097ac3
push 0xee
push str.filecore.cpp
call fcn.100e20d0
test eax, eax
je 0x10097ac3
int3
xor edx, edx
test edx, edx
jne 0x10097aa6
cmp dword [ebp + 0xc], 0
jne 0x10097ad4
jmp 0x10097b75
cmp dword [ebp + 8], 0
jne 0x10097aee
push 0xf3
push str.filecore.cpp
call fcn.100e20d0
test eax, eax
je 0x10097aee
int3
xor eax, eax
test eax, eax
jne 0x10097ad4
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.1005cdc6
test eax, eax
jne 0x10097b1b
push 0xf4
push str.filecore.cpp
call fcn.100e20d0
test eax, eax
je 0x10097b1b
int3
xor eax, eax
test eax, eax
jne 0x10097af4
push 0
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x10097b58
mov ecx, dword [ebp - 8]
add ecx, 0xc
call fcn.100de6fa
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.10095970
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0xc]
je 0x10097b75
mov ecx, dword [ebp - 8]
add ecx, 0xc
call fcn.100de6fa
push eax
push 0xffffffffffffffff
push 0xd
call fcn.10095b50
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x100982bc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
lea eax, [ebp - 8]
push eax
push 0x101f2200
push OleUIInsertObjectA
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x10098392
mov dword [ebp - 0xc], 0
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x10098388
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x10]
push ecx
push str.InProcServer32
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x1009837e
push 0x104
mov ecx, dword [ebp + 0xc]
call fcn.10091078
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x20], 0x104
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
lea edx, [ebp - 0x1c]
push edx
push 0
push 0x10200c34
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x18], eax
push 0xffffffffffffffff
mov ecx, dword [ebp + 0xc]
call fcn.100911b3
xor ecx, ecx
cmp dword [ebp - 0x18], 0
sete cl
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8
Function at 0x1009839b
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x184
mov dword [ebp - 0x17c], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x178], 0
mov eax, dword [ebp + 0x10]
mov byte [eax], 0
push 0x800
push 0x160
lea ecx, [ebp - 0x174]
push ecx
push 0
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
test eax, eax
je 0x100983fc
mov eax, dword [ebp - 0x16c]
and eax, 0x10000
test eax, eax
jne 0x10098403
xor eax, eax
jmp 0x10098533
lea ecx, [ebp - 0x14]
push ecx
push 0x101cf528
push 0
push 0x101cf538
lea ecx, [ebp - 4]
call fcn.10098037
test eax, eax
jge 0x10098426
xor eax, eax
jmp 0x10098533
lea edx, [ebp - 0x10]
push edx
push 0x101d6700
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x14]
push edx
call dword [ecx]
test eax, eax
jl 0x10098525
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 0
jne 0x10098460
mov dword [ebp - 0x180], 0
jmp 0x100984ae
mov ecx, dword [ebp - 0x178]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
mov dword [ebp - 0x17c], eax
mov eax, dword [ebp - 0x17c]
shl eax, 1
add eax, 3
and al, 0xfc
call fcn.1002b9b0
mov dword [ebp - 0x184], esp
mov edx, dword [ebp - 0x17c]
push edx
mov eax, dword [ebp - 0x178]
push eax
mov ecx, dword [ebp - 0x184]
push ecx
call fcn.1000f360
mov dword [ebp - 0x180], eax
push 0
mov edx, dword [ebp - 0x180]
push edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x10]
push edx
call dword [ecx + 0x14]
test eax, eax
jl 0x10098519
push 2
mov ecx, dword [ebp + 8]
call fcn.100e4efc
push eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x14]
push edx
call dword [ecx + 0x4c]
test eax, eax
jl 0x10098519
push 0
push 0
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x14]
push ecx
call dword [eax + 0xc]
mov edx, dword [ebp - 0x10]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x10]
push ecx
call dword [eax + 8]
mov edx, dword [ebp - 0x14]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x14]
push ecx
call dword [eax + 8]
mov eax, 1
jmp 0x10098533
mov edx, dword [ebp - 0x10]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x10]
push ecx
call dword [eax + 8]
mov edx, dword [ebp - 0x14]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x14]
push ecx
call dword [eax + 8]
xor eax, eax
lea esp, [ebp - 0x184]
mov esp, ebp
pop ebp
ret 0x10
Function at 0x1009853f
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101469dd
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x15c
push ebx
push esi
push edi
push 1
push 0x104
mov eax, dword [ebp + 8]
push eax
call fcn.1005cdc6
test eax, eax
jne 0x10098588
push 0x216
push str.filecore.cpp
call fcn.100e20d0
test eax, eax
je 0x10098588
int3
xor ecx, ecx
test ecx, ecx
jne 0x10098560
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ebp + 8]
push eax
push 0x104
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
test eax, eax
jne 0x100985de
mov edx, dword [ebp + 0xc]
movsx eax, byte [edx]
test eax, eax
je 0x100985c4
mov ecx, dword [ebp + 0xc]
push ecx
push str.Warning:_could_not_parse_the_path__s._n
call fcn.1005c7b5
add esp, 8
push 0x104
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
xor eax, eax
jmp 0x100986d1
lea ecx, [ebp - 0x1c]
call fcn.100de657
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.100986e4
push 0
push 0
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x10]
push ecx
push 0
push 0
push 0
lea ecx, [ebp - 0x1c]
call fcn.100de6fa
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
jne 0x10098656
lea ecx, [ebp - 0x1c]
call fcn.100de6fa
push eax
push str.Warning:_could_not_get_volume_information__s._n
call fcn.1005c7b5
add esp, 8
mov dword [ebp - 0x164], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.100908cc
mov eax, dword [ebp - 0x164]
jmp 0x100986d1
mov edx, dword [ebp - 0x18]
and edx, 2
test edx, edx
jne 0x1009866a
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_CharUpperA]
mov ecx, dword [ebp - 0x18]
and ecx, 4
test ecx, ecx
jne 0x100986b2
lea edx, [ebp - 0x15c]
push edx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 0xffffffff
je 0x100986b2
mov ecx, dword [ebp - 0x160]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
lea edx, [ebp - 0x130]
push edx
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp - 0x168], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.100908cc
mov eax, dword [ebp - 0x168]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100aa2b0
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
add ecx, 0x20
call fcn.100de6fa
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
and eax, 1
test eax, eax
je 0x100aa306
push 1
push 0
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov ecx, dword [ebp - 8]
call dword [edx + 0xa0]
test eax, eax
jne 0x100aa304
push str.Warning:_File_save_with_new_name_failed._n
push 0x101f2544
call fcn.1005c7b5
add esp, 8
xor eax, eax
jmp 0x100aa341
jmp 0x100aa33c
push 1
mov ecx, dword [ebp - 8]
add ecx, 0x20
call fcn.100de6fa
push eax
mov eax, dword [ebp - 8]
mov edx, dword [eax]
mov ecx, dword [ebp - 8]
call dword [edx + 0xa0]
test eax, eax
jne 0x100aa33c
push str.Warning:_File_save_failed._n
push 0x101f2564
call fcn.1005c7b5
add esp, 8
xor eax, eax
jmp 0x100aa341
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x100aaa70
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10146d35
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x110
mov dword [ebp - 0x11c], 0
lea ecx, [ebp - 0x10]
call fcn.100de657
mov dword [ebp - 4], 1
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0x114]
push ecx
push 0x104
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
mov eax, dword [ebp - 0x118]
mov byte [eax], 0
push 0x105
lea ecx, [ebp - 0x10]
call fcn.10091078
push eax
push 0
push 0x101f25f0
lea ecx, [ebp - 0x114]
push ecx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.100911b3
cmp dword [ebp + 0x10], 0
jne 0x100aab0d
lea ecx, [ebp - 0x10]
call fcn.100de6fa
push eax
call fcn.10098014
lea edx, [ebp - 0x10]
push edx
mov ecx, dword [ebp + 8]
call fcn.100904fa
mov eax, dword [ebp - 0x11c]
or al, 1
mov dword [ebp - 0x11c], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.100908cc
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x100b05a6
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
lea eax, [ebp + 0x18]
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp + 8]
call fcn.100b01d0
mov dword [ebp - 0x28], eax
mov edx, dword [ebp + 8]
cmp dword [edx], 0
je 0x100b0605
push 0x20
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x24]
push ecx
call fcn.100b0364
test eax, eax
jne 0x100b0603
push 0xffffffffffffffff
push 0
mov edx, dword [ebp + 0x14]
push edx
call fcn.100b46a9
mov ecx, dword [ebp + 8]
call fcn.100b02ef
jmp 0x100b0624
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
lea edx, [ebp - 0x24]
push edx
call dword [sym.imp.USER32.dll_wvsprintfA]
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
call fcn.100a3223
mov dword [ebp - 4], 0
mov esp, ebp
pop ebp
ret

Function at 0x100b0c94
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
call fcn.100b021e
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
cmp dword [ecx], 0
je 0x100b0d0d
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jle 0x100b0ce4
mov eax, dword [ebp - 8]
add eax, 1
push eax
mov ecx, dword [ebp - 8]
push ecx
mov ecx, dword [ebp + 0x10]
call fcn.10091227
push eax
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x100b0d01
push pe_nt_image_headers32
push 0xff
mov ecx, dword [ebp + 0x10]
call fcn.10091078
push eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0xffffffffffffffff
mov ecx, dword [ebp + 0x10]
call fcn.100911b3
jmp 0x100b0d3e
mov ecx, dword [ebp + 0x10]
call fcn.100de6fa
push eax
push 0xffffffffffffffff
push 0x14d
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 0xffffffff
jne 0x100b0d3e
mov ecx, dword [ebp + 0x10]
call fcn.100de6fa
push eax
mov edx, dword [ebp - 4]
push edx
call fcn.100a3223
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100bd7f5
Capabilities:
Delete registry key
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 0x14], ecx
cmp dword [ebp + 8], 0
jne 0x100bd81b
push 0x110
push str.appui3.cpp
call fcn.100e20d0
test eax, eax
je 0x100bd81b
int3
xor eax, eax
test eax, eax
jne 0x100bd801
mov ecx, dword [ebp - 0x14]
cmp dword [ecx + 0x80], 0
je 0x100bd906
cmp dword [ebp + 0xc], 0
jne 0x100bd86f
mov ecx, dword [ebp - 0x14]
call fcn.100fd1cc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x100bd84f
xor eax, eax
jmp 0x100bd979
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x100bd8fb
cmp dword [ebp + 0x10], 0
jne 0x100bd8ae
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x14]
call fcn.100fd2d2
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x100bd891
xor eax, eax
jmp 0x100bd979
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x100bd8fb
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x14]
call fcn.100fd2d2
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x100bd8ca
xor eax, eax
jmp 0x100bd979
mov ecx, dword [ebp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
push eax
mov edx, dword [ebp + 0x10]
push edx
push 1
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp dword [ebp - 4], 0
sete al
jmp 0x100bd979
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x94], 0
jne 0x100bd926
push 0x132
push str.appui3.cpp
call fcn.100e20d0
test eax, eax
je 0x100bd926
int3
xor ecx, ecx
test ecx, ecx
jne 0x100bd906
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x94]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 0xfff
jl 0x100bd957
push 0x133
push str.appui3.cpp
call fcn.100e20d0
test eax, eax
je 0x100bd957
int3
xor ecx, ecx
test ecx, ecx
jne 0x100bd92c
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x94]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100ce0fe
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
and ecx, 1
test ecx, ecx
je 0x100ce122
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xc]
mov dword [ebp - 4], eax
jmp 0x100ce15c
push 5
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x100ce176
push 0xc9
push str.dlgprop.cpp
call fcn.100e20d0
test eax, eax
je 0x100ce176
int3
xor eax, eax
test eax, eax
jne 0x100ce15c
mov ecx, dword [ebp - 4]
xor edx, edx
mov dx, word [ecx + 2]
cmp edx, 0xffff
jne 0x100ce251
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
and eax, 0x80000000
test eax, eax
je 0x100ce221
push 0x101efdec
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x100ce1ce
push 0xe1
push str.dlgprop.cpp
call fcn.100e20d0
test eax, eax
je 0x100ce1ce
int3
xor ecx, ecx
test ecx, ecx
jne 0x100ce1b4
cmp dword [ebp - 0x18], 0
je 0x100ce21f
push str.DllGetVersion
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x100ce215
mov eax, 1
test eax, eax
je 0x100ce20f
push 0xe6
push str.dlgprop.cpp
call fcn.100e20d0
test eax, eax
je 0x100ce20f
int3
xor ecx, ecx
test ecx, ecx
jne 0x100ce1f2
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x100ce251
mov eax, dword [ebp - 0x14]
and eax, 0xff
cmp eax, 3
jne 0x100ce251
mov ecx, 1
test ecx, ecx
je 0x100ce24b
push 0xed
push str.dlgprop.cpp
call fcn.100e20d0
test eax, eax
je 0x100ce24b
int3
xor edx, edx
test edx, edx
jne 0x100ce22e
call fcn.100fa423
cmp dword [eax + 0x1038], 0
je 0x100ce26e
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0x20]
call fcn.100ce0b3
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.100cdf75
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x20]
cmp dword [eax + 0x44], 0
je 0x100ce29e
mov ecx, dword [ebp - 0x20]
mov edx, dword [ecx + 0x44]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x44], 0
cmp dword [ebp - 8], 0
je 0x100ce2b3
mov ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 8]
mov dword [edx + 0x44], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 4]
mov dword [ecx + 0xc], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
or ecx, 1
mov edx, dword [ebp + 8]
mov dword [edx + 4], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100d37b8
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
push 5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindow]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x100d38a7
mov eax, dword [ebp - 4]
push eax
call fcn.10087c18
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x100d3893
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x1c]
cmp edx, dword [ebp - 4]
je 0x100d3893
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x1c]
push edx
call fcn.100d33d0
test eax, eax
je 0x100d3893
push 0xfffffffffffffff0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov dword [ebp - 0xc], eax
cmp dword [ebp + 8], 0
jne 0x100d3859
mov ecx, dword [ebp - 0xc]
and ecx, 0x18000000
cmp ecx, 0x10000000
jne 0x100d3859
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x24]
or ecx, 2
mov edx, dword [ebp - 8]
mov dword [edx + 0x24], ecx
jmp 0x100d3893
cmp dword [ebp + 8], 0
je 0x100d3893
mov eax, dword [ebp - 0xc]
and eax, 0x18000000
test eax, eax
jne 0x100d3893
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x24]
and edx, 2
test edx, edx
je 0x100d3893
push 4
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x24]
and edx, 0xfffffffd
mov eax, dword [ebp - 8]
mov dword [eax + 0x24], edx
push 2
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_GetWindow]
mov dword [ebp - 4], eax
jmp 0x100d37d3
mov esp, ebp
pop ebp
ret 4
Function at 0x100fbc3c
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
mov dword [ebp - 0x1c], ecx
cmp dword [ebp + 8], 0
jne 0x100fbc62
push 0x146
push str.afxtls.cpp
call fcn.100e20d0
test eax, eax
je 0x100fbc62
int3
xor eax, eax
test eax, eax
jne 0x100fbc48
mov dword [ebp - 4], 1
mov dword [ebp - 8], 1
jmp 0x100fbc81
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 8]
cmp eax, dword [edx + 8]
jge 0x100fbd04
cmp dword [ebp + 0xc], 0
je 0x100fbca4
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx + 0x10]
mov eax, dword [ebp - 8]
mov ecx, dword [edx + eax*8 + 4]
cmp ecx, dword [ebp + 0xc]
jne 0x100fbce9
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xc]
mov ecx, dword [ebp - 8]
mov edx, dword [eax + ecx*4]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x100fbcd0
push 1
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xc]
call dword [edx]
mov dword [ebp - 0x20], eax
jmp 0x100fbcd7
mov dword [ebp - 0x20], 0
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 8]
mov dword [ecx + edx*4], 0
jmp 0x100fbcff
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 8]
cmp dword [ecx + edx*4], 0
je 0x100fbcff
mov dword [ebp - 4], 0
jmp 0x100fbc78
cmp dword [ebp - 4], 0
je 0x100fbd78
mov eax, dword [ebp - 0x1c]
add eax, 0x1c
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x1c]
add ecx, 0x14
call fcn.100fc300
mov edx, dword [ebp - 0x1c]
add edx, 0x1c
push edx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov edx, dword [ebp + 8]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x100fbd63
push 1
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x14]
call dword [edx]
mov dword [ebp - 0x24], eax
jmp 0x100fbd6a
mov dword [ebp - 0x24], 0
push 0
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8