joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100202f0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c8188
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x100ebb10]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x100d4d60]
xor esi, esi
mov dword [ebp - 0x10], eax
mov edi, dword [ebp + 8]
mov dword [ebp - 4], esi
cmp edi, esi
je 0x1002033f
lea ecx, [ebp - 0x10]
push ecx
push edi
call fcn.1001fd20
add esp, 8
test eax, eax
je 0x1002033f
mov esi, 1
cmp dword [0x101005c0], 0
je 0x10020366
mov edx, dword [ebp - 0x10]
push edx
push esi
push str.COverlongPathApi::CreateDirectoryW_bChangeToLongPath__d__wstrLongPath__s_
push str.COverlongPathApi
push 0xffffffffffffffff
push 0x100ffd2c
call fcn.10065110
add esp, 0x18
test esi, esi
jne 0x10020371
mov eax, dword [ebp + 0xc]
push eax
push edi
jmp 0x10020379
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0x10]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea ecx, [ebp - 0x10]
mov esi, eax
mov dword [ebp - 4], 0xffffffff
call fcn.10052400
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x100203b0
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c81b8
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x100ebb10]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x100d4d60]
mov dword [ebp - 0x10], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 0
test esi, esi
je 0x100203fb
lea ecx, [ebp - 0x10]
push ecx
push esi
call fcn.1001fd20
add esp, 8
test eax, eax
jne 0x100203fe
push esi
jmp 0x10020402
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea ecx, [ebp - 0x10]
mov esi, eax
mov dword [ebp - 4], 0xffffffff
call fcn.10052400
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10020430
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c81e8
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x100ebb10]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x100d4d60]
mov dword [ebp - 0x10], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 0
test esi, esi
je 0x1002047b
lea ecx, [ebp - 0x10]
push ecx
push esi
call fcn.1001fd20
add esp, 8
test eax, eax
jne 0x1002047e
push esi
jmp 0x10020482
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x10]
mov esi, eax
mov dword [ebp - 4], 0xffffffff
call fcn.10052400
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10020c80
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 8], 0x105
push edi
jg 0x10020c9d
push 0x105
mov ecx, esi
call fcn.100011c0
mov eax, dword [esi]
push 0x105
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov edi, dword [esi]
xor ecx, ecx
cmp word [edi], cx
je 0x10020cc0
mov edx, edi
add edx, 2
inc ecx
cmp word [edx], 0
jne 0x10020cb6
xor edx, edx
mov word [edi + ecx*2], dx
mov dword [esi + 4], ecx
dec eax
mov ecx, 0x103
cmp ecx, eax
sbb eax, eax
pop edi
inc eax
pop esi
pop ebp
ret

Function at 0x10020e20
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c82f8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x100ebb10]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
push ebx
call edi
test eax, eax
je 0x10020e70
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
push 3
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
call fcn.100011c0
lea eax, [ebp - 0x18]
push eax
push ebx
mov dword [ebp - 4], 0
call fcn.10022fa0
add esp, 8
test al, al
je 0x10020ec9
mov ecx, dword [ebp - 0x18]
push esi
push ecx
call edi
mov edx, dword [ebp - 0x18]
push edx
mov esi, eax
call fcn.10024970
add esp, 4
test esi, esi
setne al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x18]
push eax
call fcn.10024970
add esp, 4
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10020ef0
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c8328
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x100ebb10]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov edi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push esi
call edi
test eax, eax
je 0x10020f3c
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor ebx, ebx
push 3
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
call fcn.100011c0
lea eax, [ebp - 0x18]
push eax
push esi
mov dword [ebp - 4], ebx
call fcn.10022fa0
add esp, 8
test al, al
je 0x10020f90
mov ecx, dword [ebp - 0x18]
push ecx
call edi
mov edx, dword [ebp - 0x18]
push edx
mov esi, eax
call fcn.10024970
add esp, 4
cmp esi, ebx
setne al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x18]
push eax
call fcn.10024970
add esp, 4
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10021020
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c8360
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x100ebb10]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x1002106e
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor esi, esi
push 3
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
call fcn.100011c0
push 3
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], esi
call fcn.100011c0
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x24]
push ecx
push edi
push ebx
mov byte [ebp - 4], 1
call fcn.10020fb0
add esp, 0x10
test al, al
je 0x100210ef
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov ecx, dword [ebp - 0x18]
push ecx
mov edi, eax
call fcn.10024970
mov edx, dword [ebp - 0x24]
push edx
call fcn.10024970
add esp, 8
cmp edi, esi
setne al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x18]
push eax
call fcn.10024970
mov ecx, dword [ebp - 0x24]
push ecx
call fcn.10024970
add esp, 8
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10021120
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c8388
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x100ebb10]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
xor ebx, ebx
push ebx
push esi
call edi
test eax, eax
je 0x1002116f
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x100211db
push 3
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
call fcn.100011c0
lea eax, [ebp - 0x18]
push eax
push esi
mov dword [ebp - 4], ebx
call fcn.10022fa0
add esp, 8
test al, al
je 0x100211cf
mov ecx, dword [ebp - 0x18]
push ebx
push ecx
call edi
mov edx, dword [ebp - 0x18]
push edx
mov esi, eax
call fcn.10024970
add esp, 4
cmp esi, ebx
setne al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x18]
push eax
call fcn.10024970
add esp, 4
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100211f0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c83b8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x100ebb10]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor ebx, ebx
push ebx
push esi
call fcn.10020e20
add esp, 8
test al, al
je 0x100212aa
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push esi
call edi
test eax, eax
je 0x1002124c
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 3
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
call fcn.100011c0
lea eax, [ebp - 0x18]
push eax
push esi
mov dword [ebp - 4], ebx
call fcn.10022fa0
add esp, 8
test al, al
je 0x1002129e
mov ecx, dword [ebp - 0x18]
push ecx
call edi
mov edx, dword [ebp - 0x18]
push edx
mov esi, eax
call fcn.10024970
add esp, 4
cmp esi, ebx
setne al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x18]
push eax
call fcn.10024970
add esp, 4
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100216e0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 8], 0x105
push edi
jg 0x100216fd
push 0x105
mov ecx, esi
call fcn.100011c0
mov eax, dword [esi]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov edi, dword [esi]
xor ecx, ecx
cmp word [edi], cx
je 0x10021720
mov edx, edi
add edx, 2
inc ecx
cmp word [edx], 0
jne 0x10021716
xor edx, edx
mov word [edi + ecx*2], dx
mov dword [esi + 4], ecx
dec eax
mov ecx, 0x103
cmp ecx, eax
sbb eax, eax
pop edi
inc eax
pop esi
pop ebp
ret

Function at 0x10021740
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x10]
cmp dword [esi + 8], 0x105
push edi
jg 0x1002175d
push 0x105
mov ecx, esi
call fcn.100011c0
mov eax, dword [esi]
mov ecx, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push 0
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov edi, dword [esi]
xor ecx, ecx
cmp word [edi], cx
je 0x1002178a
mov edx, edi
jmp 0x10021780
add edx, 2
inc ecx
cmp word [edx], 0
jne 0x10021780
xor edx, edx
mov word [edi + ecx*2], dx
pop edi
mov dword [esi + 4], ecx
pop esi
pop ebp
ret

Function at 0x100229e0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ecx]
push esi
lea eax, [ebp - 4]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x10022a0c
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x10022a0c
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
xor eax, eax
xor edx, edx
add edx, esi
adc ecx, eax
mov eax, dword [ebp + 8]
mov dword [eax], edx
mov dword [eax + 4], ecx
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x10022df0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c87a0
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push ebx
push esi
push edi
mov eax, dword [0x100ebb10]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
xor ecx, ecx
mov dword [eax + 4], ecx
mov eax, dword [eax]
xor edx, edx
mov word [eax], dx
movzx eax, word [edi]
xor esi, esi
cmp ax, cx
je 0x10022e3b
inc esi
cmp word [edi + esi*2], cx
jne 0x10022e34
mov ebx, eax
cmp esi, 1
jl 0x10022f6c
cmp ebx, 0x5c
je 0x10022f6c
cmp ebx, 0x2e
jne 0x10022e6c
cmp esi, 1
je 0x10022f6c
cmp esi, 2
jne 0x10022e6c
cmp word [edi + 2], ax
je 0x10022f6c
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], ecx
push 3
lea ecx, [ebp - 0x18]
call fcn.100011c0
mov dword [ebp - 4], 0
cmp esi, 3
jle 0x10022eac
cmp word [edi + 2], 0x3a
jne 0x10022eac
cmp word [edi + 4], 0x5c
jne 0x10022eac
cmp ebx, 0x61
jb 0x10022ea3
cmp ebx, 0x7a
jbe 0x10022f07
add ebx, 0xffffffbf
cmp bx, 0x19
jbe 0x10022f07
cmp dword [ebp - 0x10], 0x105
jg 0x10022ec2
push 0x105
lea ecx, [ebp - 0x18]
call fcn.100011c0
mov eax, dword [ebp - 0x18]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea ecx, [ebp - 0x18]
mov esi, eax
call fcn.10002610
test esi, esi
je 0x10022f80
cmp esi, 0x104
ja 0x10022f80
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
cmp word [edx + ecx*2 - 2], 0x5c
je 0x10022f07
push 0x5c
lea ecx, [ebp - 0x18]
call fcn.10001420
push 0x100d1150
lea ecx, [ebp - 0x3c]
call fcn.10008470
lea ecx, [ebp - 0x18]
push ecx
push eax
lea edx, [ebp - 0x30]
push edx
mov byte [ebp - 4], 1
call fcn.10005ad0
push edi
push eax
lea eax, [ebp - 0x24]
push eax
mov byte [ebp - 4], 2
call fcn.10005c30
add esp, 0x18
mov ecx, dword [ebp + 0xc]
push eax
mov byte [ebp - 4], 3
call fcn.100013d0
mov ecx, dword [ebp - 0x24]
push ecx
call fcn.10024970
mov edx, dword [ebp - 0x30]
push edx
call fcn.10024970
mov eax, dword [ebp - 0x3c]
push eax
call fcn.10024970
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.10024970
add esp, 0x10
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x18]
push eax
call fcn.10024970
add esp, 4
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10026bc0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x14]
test esi, esi
je 0x10026bd1
mov dword [esi], 0
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x10026c0a
mov eax, 0x8000
cmp ecx, eax
jae 0x10026be3
mov eax, ecx
mov edx, dword [ebp + 0xc]
push 0
lea ecx, [ebp + 0x14]
push ecx
push eax
push edx
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test esi, esi
je 0x10026c06
mov ecx, dword [ebp + 0x14]
add dword [esi], ecx
test eax, eax
je 0x10026c11
xor eax, eax
pop esi
pop ebp
ret 0x10
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x10026c25
mov eax, 0x80004005
pop esi
pop ebp
ret 0x10
jle 0x10026c31
and eax, 0xffff
or eax, 0x80070000
pop esi
pop ebp
ret 0x10

Function at 0x10027ff0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c9184
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x100ebb10]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xor edi, edi
mov ebx, 4
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], ebx
mov dword [esi], vtable.CObjectVector_class_CStringBase_unsigned_short_int__.0
mov eax, vtable.CRecordVector_int_.0
mov dword [ebp - 4], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], ebx
mov dword [esi + 0x14], eax
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], ebx
mov dword [esi + 0x28], eax
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x3c], vtable.CObjectVector_struct_CDirItem_.0
lea ecx, [esi + 0x50]
push 3
mov byte [ebp - 4], 3
mov dword [ecx], edi
mov dword [ecx + 4], edi
mov dword [ecx + 8], edi
call fcn.100011c0
lea ecx, [esi + 0x60]
push 3
mov byte [ebp - 4], bl
mov dword [ecx], edi
mov dword [ecx + 4], edi
mov dword [ecx + 8], edi
call fcn.100011c0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1002c64e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100ebb10]
jne 0x1002c658
repz ret
jmp fcn.1002fe0c
Function at 0x1003703b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x100ebb10]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.1002f7fc
and dword [ebp - 0x14], 0
cmp dword [0x100ff968], 0
mov dword [ebp - 0x18], eax
jne 0x100370ee
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x10037196
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x100d3140
push ebx
call edi
test eax, eax
je 0x10037196
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x100ff968], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x100ff96c], eax
call edi
push eax
call esi
push 0x100d3100
push ebx
mov dword [0x100ff970], eax
call edi
push eax
call esi
mov dword [0x100ff978], eax
test eax, eax
je 0x100370ee
push 0x100d30e8
push ebx
call edi
push eax
call esi
mov dword [0x100ff974], eax
mov eax, dword [0x100ff974]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x10037147
cmp dword [0x100ff978], ecx
je 0x10037147
push eax
call esi
push dword [0x100ff978]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x10037147
test ebx, ebx
je 0x10037147
call edi
test eax, eax
je 0x1003713e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x1003713e
test byte [ebp - 8], 1
jne 0x10037147
or dword [ebp + 0x10], 0x200000
jmp 0x1003717a
mov eax, dword [0x100ff96c]
cmp eax, dword [ebp - 0x18]
je 0x1003717a
push eax
call esi
test eax, eax
je 0x1003717a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x1003717a
mov eax, dword [0x100ff970]
cmp eax, dword [ebp - 0x18]
je 0x1003717a
push eax
call esi
test eax, eax
je 0x1003717a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x100ff968]
call esi
test eax, eax
je 0x10037196
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x10037198
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1002c64e
leave
ret
Function at 0x10050ad0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push esi
mov esi, eax
shr eax, 4
and esi, 0xf
inc eax
push edi
mov edi, dword [esp + 0xc]
and eax, 0xffff
push ecx
push eax
push 6
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
test eax, eax
je 0x10050b1e
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x10050b1e
xor edx, edx
xor ecx, ecx
mov cx, word [eax]
add eax, 2
cmp esi, edx
je 0x10050b23
inc edx
lea eax, [eax + ecx*2]
cmp edx, 0x10
jl 0x10050b09
pop edi
xor eax, eax
pop esi
ret
mov edi, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
test edi, edi
jne 0x10050b33
test esi, esi
jne 0x10050b51
push 0
push 0
push edi
push esi
push 0xffffffffffffffff
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jle 0x10050b4f
mov byte [eax + esi - 1], 0
jne 0x10050b58
mov byte [esi + edi - 1], 0
mov eax, edi
pop edi
dec eax
pop esi
ret

Function at 0x10056240
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push esi
push edi
mov esi, dword [esp + 0xc]
mov edi, eax
shr eax, 4
and edi, 0xf
inc eax
and eax, 0xffff
push ecx
push eax
push 6
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
test eax, eax
je 0x10056290
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x10056290
xor ecx, ecx
xor eax, eax
mov ax, word [esi]
add esi, 2
cmp edi, ecx
je 0x10056295
inc ecx
lea esi, [esi + eax*2]
cmp ecx, 0x10
jl 0x1005627b
pop edi
xor eax, eax
pop esi
ret
mov edx, dword [esp + 0x1c]
lea ecx, [edx - 1]
cmp eax, ecx
jle 0x100562a2
mov eax, ecx
lea edx, [eax + eax]
push ebx
mov ebx, dword [esp + 0x1c]
mov ecx, edx
push ebp
mov ebp, ecx
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
pop ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov word [edx + ebx], 0
pop ebx
pop edi
pop esi
ret
Function at 0x100603c0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
mov eax, dword [ecx + 4]
push ebx
push ebp
push esi
push edi
mov edi, dword [ecx]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x10], 0
test ecx, ecx
je 0x10060401
lea edx, [esp + 0x14]
or eax, 0x20019
push edx
push eax
push 0
push ecx
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
mov eax, dword [esp + 0x14]
neg esi
sbb esi, esi
not esi
and esi, eax
jmp 0x10060403
mov esi, edi
test esi, esi
je 0x10060478
mov ebx, dword [esp + 0x20]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x20]
push eax
push 0
push ecx
push 0
push ebx
push esi
call ebp
test eax, eax
jne 0x1006046d
mov ecx, dword [esp + 0x20]
mov eax, 4
cmp ecx, eax
jne 0x1006046d
cmp dword [esp + 0x1c], eax
jbe 0x1006043e
mov dword [esp + 0x1c], eax
lea edx, [esp + 0x1c]
lea eax, [esp + 0x10]
push edx
push eax
push 0
push 0
push ebx
push esi
call ebp
test eax, eax
jne 0x1006046d
cmp esi, edi
je 0x1006045f
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
cmp esi, edi
je 0x10060478
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc

Function at 0x100605d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push esi
mov esi, dword [ecx]
push edi
test esi, esi
je 0x1006062f
mov edi, dword [esp + 0x14]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [esp + 0x14]
lea ecx, [esp + 0xc]
push eax
push 0
push ecx
push 0
push edi
push esi
call ebx
test eax, eax
jne 0x1006062f
cmp dword [esp + 0xc], 3
jne 0x1006062f
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
cmp edx, eax
jb 0x1006062f
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x14]
push eax
push ecx
push 0
push 0
push edi
push esi
call ebx
test eax, eax
jne 0x1006062f
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret 0xc

Function at 0x10060710
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [ecx]
test esi, esi
push edi
je 0x10060784
mov ebx, dword [esp + 0x18]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [esp + 0x18]
lea ecx, [esp + 0x10]
push eax
push 0
push ecx
push 0
push ebx
push esi
call ebp
test eax, eax
jne 0x10060784
cmp dword [esp + 0x10], 3
jne 0x10060784
mov edx, dword [esp + 0x18]
push edx
call fcn.10024940
mov edi, eax
add esp, 4
test edi, edi
je 0x10060784
lea eax, [esp + 0x18]
push eax
push edi
push 0
push 0
push ebx
push esi
call ebp
test eax, eax
jne 0x1006077b
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
mov eax, edi
pop edi
pop esi
pop ebp
mov dword [ecx], edx
pop ebx
pop ecx
ret 8
push edi
call fcn.10024970
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 8