joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10182dd0
Capabilities:
Check os version

Disassembly:
push 0xffffffffffffffff
push 0x101b55b5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x91c
push esi
push edi
mov esi, dword [esp + 0x938]
mov ecx, 0x1ff
xor eax, eax
lea edi, [esp + 0x126]
mov word [esp + 0x124], 0
mov dword [esp + 0xc], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [0x102b5a88]
test esi, esi
je 0x10182ebc
test eax, eax
jne 0x10182e7b
mov ecx, 0x44
xor eax, eax
lea edi, [esp + 0x14]
mov dword [0x102b5a88], 1
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x114
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0x20], 2
jne 0x10182e6f
cmp dword [esp + 0x14], 5
jb 0x10182e6f
mov ecx, dword [str.GlobalOCULAR_]
mov dword [0x102b5a8c], ecx
jmp 0x10182e7b
mov edx, dword [0x1022a1e0]
mov dword [0x102b5a8c], edx
mov eax, dword [esp + 0x93c]
test eax, eax
mov eax, dword [0x1022a1e0]
jne 0x10182e90
mov eax, dword [0x102b5a8c]
mov ecx, dword [esp + 0x944]
mov edx, dword [esp + 0x940]
push ecx
push edx
push esi
push eax
lea eax, [esp + 0x134]
push str._s__s__08x__08x
push eax
call fcn.100e9daa
add esp, 0x18
jmp 0x10182f4b
test eax, eax
jne 0x10182f10
mov ecx, 0x44
xor eax, eax
lea edi, [esp + 0x14]
mov dword [0x102b5a88], 1
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], 0x114
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0x20], 2
jne 0x10182f06
cmp dword [esp + 0x14], 5
jb 0x10182f06
mov edx, dword [str.GlobalOCULAR_]
mov dword [0x102b5a8c], edx
jmp 0x10182f10
mov eax, dword [0x1022a1e0]
mov dword [0x102b5a8c], eax
mov eax, dword [esp + 0x93c]
test eax, eax
mov eax, dword [0x1022a1e0]
jne 0x10182f25
mov eax, dword [0x102b5a8c]
mov ecx, dword [esp + 0x944]
mov edx, dword [esp + 0x940]
push ecx
push edx
push eax
lea eax, [esp + 0x130]
push str._s___08x__08x
push eax
call fcn.100e9daa
add esp, 0x14
lea ecx, [esp + 0x124]
push ecx
lea ecx, [esp + 0xc]
call fcn.1012c130
mov esi, dword [esp + 0x934]
lea edx, [esp + 8]
push edx
mov ecx, esi
mov dword [esp + 0x930], 1
call fcn.1012bed0
mov dword [esp + 0xc], 1
lea ecx, [esp + 8]
mov byte [esp + 0x92c], 0
call fcn.1012c8d0
mov ecx, dword [esp + 0x924]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x928
ret
Function at 0x101856f0
Capabilities:
Set socket configuration

Disassembly:
sub esp, 8
push ebx
push esi
mov esi, ecx
cmp dword [esi + 0xc], 0xffffffff
je 0x10185778
mov eax, dword [esi + 0x14]
xor ebx, ebx
cmp eax, ebx
je 0x10185752
mov ecx, dword [esi + 0x18]
xor eax, eax
mov dword [esp + 9], eax
push edi
mov edi, dword [sym.imp.WS2_32.dll_htonl]
mov word [esp + 0x11], ax
push ecx
mov byte [esp + 0x10], bl
mov byte [esp + 0x17], al
call edi
push ebx
mov dword [esp + 0x10], eax
call edi
lea edx, [esp + 0xc]
push 8
mov dword [esp + 0x14], eax
mov eax, dword [esi + 0xc]
push edx
push 0xd
push ebx
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
pop edi
jge 0x10185752
pop esi
xor eax, eax
pop ebx
add esp, 8
ret
mov ecx, dword [esi + 0xc]
push 1
push ecx
call dword [sym.imp.WS2_32.dll_shutdown]
mov edx, dword [esi + 0xc]
push edx
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [esi + 0xc], 0xffffffff
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
pop esi
mov eax, 1
pop ebx
add esp, 8
ret
Function at 0x10188db0
Capabilities:
Create thread
Resume thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 8]
test eax, eax
jne 0x10188e45
push ebx
push edi
mov edi, dword [esi + 0x20]
mov ebx, 4
test edi, edi
je 0x10188dff
call fcn.10115060
test eax, eax
je 0x10188dff
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x10188dec
mov ecx, dword [eax + 0x3c]
add ecx, eax
je 0x10188dec
mov ebx, dword [ecx + 0x64]
lea eax, [edi - 0x2000]
cmp ebx, eax
jbe 0x10188df8
add edi, ebx
mov ebx, 0x10004
jmp 0x10188e01
xor edi, edi
lea ecx, [esi + 4]
push ecx
push ebx
push esi
push 0x10189000
push edi
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
mov dword [esi + 8], eax
test eax, eax
pop ebx
je 0x10188e45
mov ecx, dword [esi + 0x24]
mov dword [esi + 0xc], 1
test ecx, ecx
je 0x10188e34
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov edx, dword [esi + 8]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, 1
pop esi
ret
xor eax, eax
pop esi
ret

Function at 0x10188e70
Capabilities:
Terminate thread

Disassembly:
sub esp, 8
push esi
mov esi, ecx
mov eax, dword [esi + 8]
test eax, eax
jne 0x10188e84
xor eax, eax
pop esi
add esp, 8
ret
mov eax, dword [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [esi + 0x14]
mov eax, dword [esi + 0x18]
mov edx, dword [esi + 8]
mov dword [esp + 4], ecx
push eax
lea ecx, [esp + 8]
push 0
push ecx
push 2
mov dword [esp + 0x18], edx
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov edx, dword [esi + 0x1c]
mov eax, dword [esi + 8]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x10188ed0
mov ecx, dword [esi + 8]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov edx, dword [esi + 0x10]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ResetEvent]
push edx
call edi
mov eax, dword [esi + 0x14]
push eax
call edi
mov dword [esi + 0xc], 0
pop edi
mov eax, 1
pop esi
add esp, 8
ret
Function at 0x1018cb40
Capabilities:
Get user security identifier

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [esp + 0x14]
lea eax, [esp + 0x18]
push edi
mov edi, dword [esp + 0x1c]
lea ecx, [esp + 0xc]
xor ebx, ebx
push eax
push ecx
lea edx, [esp + 0x18]
push ebx
push edx
push ebx
push ebp
push ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], ebx
mov dword [edi], ebx
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x1018cb8b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x1018cb8b
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
mov eax, dword [esp + 0x10]
push esi
push eax
call fcn.101963be
mov ecx, dword [esp + 0x14]
mov dword [edi], eax
lea edx, [ecx + ecx]
push edx
call fcn.101963be
mov esi, eax
mov eax, dword [edi]
add esp, 8
test eax, eax
je 0x1018cbd0
test esi, esi
je 0x1018cbe1
lea ecx, [esp + 0x20]
lea edx, [esp + 0x10]
push ecx
push edx
lea ecx, [esp + 0x1c]
push esi
push ecx
push eax
push ebp
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov ebx, eax
test esi, esi
je 0x1018cbdd
push esi
call fcn.101963e7
add esp, 4
test ebx, ebx
jne 0x1018cbf0
mov edi, dword [edi]
test edi, edi
je 0x1018cbf0
push edi
call fcn.101963e7
add esp, 4
pop esi
pop edi
mov eax, ebx
pop ebp
pop ebx
add esp, 8
ret

Function at 0x101913b0
Capabilities:
Create thread
Resume thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 8]
test eax, eax
jne 0x10191400
lea eax, [esi + 4]
push eax
push 4
push esi
push 0x101915d0
push 0
push 0
call fcn.100ec32c
add esp, 0x18
mov dword [esi + 8], eax
test eax, eax
je 0x10191400
mov ecx, dword [esi + 0x1c]
mov dword [esi + 0xc], 1
test ecx, ecx
je 0x101913ef
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov ecx, dword [esi + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, 1
pop esi
ret
xor eax, eax
pop esi
ret

Function at 0x10191450
Capabilities:
Terminate thread

Disassembly:
sub esp, 8
push esi
mov esi, ecx
mov eax, dword [esi + 8]
test eax, eax
jne 0x10191464
xor eax, eax
pop esi
add esp, 8
ret
mov eax, dword [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [esi + 0x14]
mov eax, dword [esi + 0x18]
mov edx, dword [esi + 8]
mov dword [esp + 4], ecx
push eax
lea ecx, [esp + 8]
push 0
push ecx
push 2
mov dword [esp + 0x18], edx
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov edx, dword [esi + 8]
push 0x3e8
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x101914b1
mov eax, dword [esi + 8]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [esi + 0x10]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ResetEvent]
push ecx
call edi
mov edx, dword [esi + 0x14]
push edx
call edi
mov dword [esi + 0xc], 0
pop edi
mov eax, 1
pop esi
add esp, 8
ret
Function at 0x101916e2
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
push edi
lea ebp, [esi + 0x42c]
lea edi, [esi + 0x2c]
mov ecx, 0x100
xor eax, eax
push ebx
mov dword [esi], ebx
mov dword [esi + 4], 0xffffffff
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [ebp], ebx
push 0x80
push 3
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x20]
push ebx
lea edi, [esi + 0xc]
push 7
push SysReAllocString
push eax
mov dword [esi + 8], ebx
mov dword [edi], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], 1
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esi + 4], eax
je 0x10191772
cmp eax, ebx
je 0x10191772
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [esi + 4]
mov dword [esi + 8], eax
push ebx
push ebp
lea eax, [esi + 0x2c]
push 0x400
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1019177a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x10191925
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
je 0x10191a77
xor edx, edx
cmp eax, edx
je 0x10191a77
mov ebx, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x14], edx
lea eax, [ebx + ecx]
cmp eax, ebx
jb 0x1019195a
cmp eax, ecx
jb 0x1019195a
xor ecx, ecx
jmp 0x1019195f
mov ecx, 1
mov edi, dword [esi + 0xc]
mov dword [esp + 0x14], ecx
cmp ecx, edi
jl 0x10191979
jg 0x10191a77
cmp eax, dword [esi + 8]
ja 0x10191a77
cmp ecx, edx
jne 0x10191993
cmp eax, dword [esi + 0x42c]
ja 0x10191993
lea eax, [ebx + esi + 0x2c]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 8
mov ebp, dword [esi + 0x1c]
cmp ebp, edx
je 0x101919d8
mov ecx, dword [esi + 0x28]
mov dword [esp + 0x1c], edx
mov edx, dword [esi + 0x24]
lea edi, [edx + ecx]
cmp edi, ecx
jb 0x101919b3
cmp edi, edx
jb 0x101919b3
xor edx, edx
jmp 0x101919b8
mov edx, 1
cmp ecx, ebx
ja 0x101919d8
cmp dword [esp + 0x14], edx
jg 0x101919d8
jl 0x101919c8
cmp eax, edi
ja 0x101919d8
mov eax, ebp
pop edi
sub eax, ecx
pop esi
add eax, ebx
pop ebp
pop ebx
add esp, 0x10
ret 8
mov eax, dword [esp + 0x28]
mov ecx, esi
push eax
call fcn.10191a90
test eax, eax
je 0x10191a77
cmp ebx, 0x7fffffff
push 0
push 0
jbe 0x10191a26
mov ecx, dword [esi + 4]
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push SysReAllocString
push ecx
call edi
cmp eax, 0xffffffff
je 0x10191a67
mov eax, dword [esi + 4]
push 1
lea edx, [ebx - 0x7fffffff]
push 0
push edx
push eax
call edi
cmp eax, 0xffffffff
je 0x10191a67
jmp 0x10191a36
mov ecx, dword [esi + 4]
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x10191a67
mov ebp, dword [esp + 0x28]
mov edx, dword [esi + 0x1c]
mov eax, dword [esi + 4]
lea edi, [esi + 0x24]
push 0
push edi
push ebp
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10191a67
cmp dword [edi], ebp
jne 0x10191a67
mov eax, dword [esi + 0x1c]
mov dword [esi + 0x28], ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 8
xor eax, eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret 8
Function at 0x10191ec0
Capabilities:
Get file size

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x101b61f8
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, ecx
push edi
xor ebx, ebx
mov eax, dword [esi + 0x20]
xor edi, edi
xor ebp, ebp
cmp eax, ebx
je 0x10191ef2
call fcn.1018d5c0
mov ebp, eax
mov eax, dword [esi + 0x18]
mov ecx, 0xc0000000
cmp eax, ebx
je 0x10191f03
mov ecx, SysReAllocString
mov eax, dword [esi + 0x24]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], ebx
cmp dword [eax - 8], ebx
je 0x10191f58
push ebx
push 0x80
push 3
push ebp
push 3
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [esi + 4], eax
je 0x10191f3e
lea ecx, [esp + 0x18]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esp + 0x14], eax
cmp dword [esi + 4], 0xffffffff
je 0x10192084
cmp dword [esp + 0x18], ebx
jne 0x10191f58
cmp dword [esp + 0x14], ebx
je 0x10192084
mov eax, dword [esi + 0x18]
mov edi, 4
cmp eax, ebx
je 0x10191f69
mov edi, 2
lea ebx, [esi + 0x28]
lea ecx, [esp + 0x10]
push ebx
call fcn.10195a62
mov eax, dword [esi + 0x1c]
mov dword [esp + 0x24], 0
test eax, eax
je 0x10191faf
mov edx, dword [ebx]
mov eax, dword [edx - 8]
test eax, eax
je 0x10191faf
call fcn.10115020
test eax, eax
je 0x10191faf
push 0x101f1edc
lea ecx, [esp + 0x14]
call fcn.10195e8c
push ebx
lea ecx, [esp + 0x14]
call fcn.10196122
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx - 8]
neg eax
sbb eax, eax
and eax, ecx
mov ecx, dword [esi + 4]
push eax
mov eax, dword [esi + 0x10]
push eax
push 0
push edi
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
test eax, eax
mov dword [esi + 8], eax
je 0x1019205e
mov edx, dword [esi + 0x18]
mov ecx, 6
test edx, edx
je 0x10191feb
mov ecx, 4
mov edx, dword [esi + 0x10]
push edx
mov edx, dword [esi + 0x14]
push edx
push 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
mov dword [esi + 0xc], eax
je 0x1019205e
mov eax, dword [esi + 0x10]
mov ebp, 1
test eax, eax
jne 0x10192039
mov eax, dword [esi + 4]
or ebx, 0xffffffff
cmp eax, ebx
je 0x1019203c
mov ecx, dword [esp + 0x14]
mov edx, dword [esi + 0x14]
mov eax, dword [esp + 0x18]
xor edi, edi
sub ecx, edx
sbb eax, edi
test eax, eax
jle 0x10192034
mov dword [esi + 0x10], ebx
jmp 0x1019203c
mov dword [esi + 0x10], ecx
jmp 0x1019203c
or ebx, 0xffffffff
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], ebx
call fcn.10195cf5
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], 0xffffffff
call fcn.10195cf5
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
mov ecx, dword [esp + 0x1c]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x10191eda
Capabilities:
Get file size

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x101b61f8
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, ecx
push edi
xor ebx, ebx
mov eax, dword [esi + 0x20]
xor edi, edi
xor ebp, ebp
cmp eax, ebx
je 0x10191ef2
call fcn.1018d5c0
mov ebp, eax
mov eax, dword [esi + 0x18]
mov ecx, 0xc0000000
cmp eax, ebx
je 0x10191f03
mov ecx, SysReAllocString
mov eax, dword [esi + 0x24]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], ebx
cmp dword [eax - 8], ebx
je 0x10191f58
push ebx
push 0x80
push 3
push ebp
push 3
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [esi + 4], eax
je 0x10191f3e
lea ecx, [esp + 0x18]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esp + 0x14], eax
cmp dword [esi + 4], 0xffffffff
je 0x10192084
cmp dword [esp + 0x18], ebx
jne 0x10191f58
cmp dword [esp + 0x14], ebx
je 0x10192084
mov eax, dword [esi + 0x18]
mov edi, 4
cmp eax, ebx
je 0x10191f69
mov edi, 2
lea ebx, [esi + 0x28]
lea ecx, [esp + 0x10]
push ebx
call fcn.10195a62
mov eax, dword [esi + 0x1c]
mov dword [esp + 0x24], 0
test eax, eax
je 0x10191faf
mov edx, dword [ebx]
mov eax, dword [edx - 8]
test eax, eax
je 0x10191faf
call fcn.10115020
test eax, eax
je 0x10191faf
push 0x101f1edc
lea ecx, [esp + 0x14]
call fcn.10195e8c
push ebx
lea ecx, [esp + 0x14]
call fcn.10196122
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx - 8]
neg eax
sbb eax, eax
and eax, ecx
mov ecx, dword [esi + 4]
push eax
mov eax, dword [esi + 0x10]
push eax
push 0
push edi
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
test eax, eax
mov dword [esi + 8], eax
je 0x1019205e
mov edx, dword [esi + 0x18]
mov ecx, 6
test edx, edx
je 0x10191feb
mov ecx, 4
mov edx, dword [esi + 0x10]
push edx
mov edx, dword [esi + 0x14]
push edx
push 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
mov dword [esi + 0xc], eax
je 0x1019205e
mov eax, dword [esi + 0x10]
mov ebp, 1
test eax, eax
jne 0x10192039
mov eax, dword [esi + 4]
or ebx, 0xffffffff
cmp eax, ebx
je 0x1019203c
mov ecx, dword [esp + 0x14]
mov edx, dword [esi + 0x14]
mov eax, dword [esp + 0x18]
xor edi, edi
sub ecx, edx
sbb eax, edi
test eax, eax
jle 0x10192034
mov dword [esi + 0x10], ebx
jmp 0x1019203c
mov dword [esi + 0x10], ecx
jmp 0x1019203c
or ebx, 0xffffffff
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], ebx
call fcn.10195cf5
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], 0xffffffff
call fcn.10195cf5
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
mov ecx, dword [esp + 0x1c]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x101970fb
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov eax, ebx
push edi
mov edi, ecx
shr eax, 0x10
test ax, ax
mov dword [edi + 0x40], ebx
jne 0x1019711d
cmp dword [edi + 0x3c], 0
jne 0x1019711d
movzx eax, bx
mov dword [edi + 0x3c], eax
call fcn.101a24ea
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
mov ecx, edi
push dword [esp + 0x18]
push eax
call fcn.1019715c
pop edi
pop esi
pop ebx
ret 8

Function at 0x10198861
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x10198899
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.101961b3
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.1019618a
jmp 0x101988a5
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x1019a666
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x1019a6a8
call fcn.101a24ea
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
cmp eax, edi
je 0x1019a6a8
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x1019a69f
xor eax, eax
jmp 0x1019a6b0
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.1019a6b6
pop edi
pop esi
pop ebx
ret 4
Function at 0x10762053
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1075c140]
jne 0x1076205d
repz ret
jmp fcn.107622df

Function at 0x10766feb
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1075c140]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.10762a36
and dword [ebp - 0x14], 0
cmp dword [0x1075facc], 0
mov dword [ebp - 0x18], eax
jne 0x1076709e
push str.USER32.DLL
call dword [sym.imp.kernel32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x10767146
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x10767146
mov esi, dword [sym.imp.kernel32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x1075facc], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x1075fad0], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x1075fad4], eax
call edi
push eax
call esi
mov dword [0x1075fadc], eax
test eax, eax
je 0x1076709e
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x1075fad8], eax
mov eax, dword [0x1075fad8]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.kernel32.dll_DecodePointer]
cmp eax, ecx
je 0x107670f7
cmp dword [0x1075fadc], ecx
je 0x107670f7
push eax
call esi
push dword [0x1075fadc]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x107670f7
test ebx, ebx
je 0x107670f7
call edi
test eax, eax
je 0x107670ee
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x107670ee
test byte [ebp - 8], 1
jne 0x107670f7
or dword [ebp + 0x10], 0x200000
jmp 0x1076712a
mov eax, dword [0x1075fad0]
cmp eax, dword [ebp - 0x18]
je 0x1076712a
push eax
call esi
test eax, eax
je 0x1076712a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x1076712a
mov eax, dword [0x1075fad4]
cmp eax, dword [ebp - 0x18]
je 0x1076712a
push eax
call esi
test eax, eax
je 0x1076712a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x1075facc]
call esi
test eax, eax
je 0x10767146
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x10767148
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10762053
leave
ret