joyce8/EMBER2024-capa huggingface dataset:
Function at 0x467a1058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.467a11a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x467a107e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x467a106a
add dl, dl
jne 0x467a1089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x467a10dc
xor eax, eax
add dl, dl
jne 0x467a1096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x467a117d
add dl, dl
jne 0x467a10a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x467a10b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x467a10bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x467a10c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x467a10d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x467a1075
mov eax, 1
add dl, dl
jne 0x467a10ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x467a10f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x467a10e1
sub eax, ebx
mov ebx, 1
jne 0x467a1128
mov ecx, 1
add dl, dl
jne 0x467a110e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x467a1119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x467a1105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x467a1075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x467a113f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x467a114a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x467a1136
cmp eax, 0x7d00
jae 0x467a116d
cmp eax, 0x500
jb 0x467a1168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x467a1075
cmp eax, 0x7f
ja 0x467a1170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x467a1075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x467a119e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x467a1075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x10070fe
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [ecx + 4]
cmp eax, 0xffffffff
je 0x1007113
dec eax
test eax, eax
mov dword [ecx + 4], eax
jne 0x1007113
jmp 0x100cdef
ret
push ebx
push esi
push edi
push dword [0x1026bb8]
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, dword [eax + 8]
movsx eax, word [esi + 2]
sub eax, 4
je 0x100ceb0
dec eax
je 0x100ce44
sub eax, 5
je 0x100cea1
dec eax
je 0x100ce62
dec eax
je 0x100ce53
dec eax
je 0x100ce44
dec eax
jne 0x100cebd
xor eax, eax
mov ax, word [esi + 8]
test ax, ax
je 0x100cebd
push eax
call dword [sym.imp.KERNEL32.dll_DeleteAtom]
jmp 0x100cebd
mov eax, dword [esi + 8]
test eax, eax
je 0x100cebd
push eax
call fcn.01007e69
jmp 0x100cebd
mov eax, dword [esi + 8]
test eax, eax
je 0x100cebd
push eax
call fcn.01008446
jmp 0x100cebd
xor eax, eax
mov al, byte [esi + 0x14]
and eax, 3
sub eax, 0
je 0x100ce99
dec eax
je 0x100ce7d
dec eax
jne 0x100cebd
mov edi, dword [sym.imp.GDI32.dll_DeleteEnhMetaFile]
jmp 0x100ce83
mov edi, dword [sym.imp.USER32.dll_DestroyIcon]
mov eax, dword [esi + 8]
test eax, eax
je 0x100ce8d
push eax
call edi
mov eax, dword [esi + 0xc]
test eax, eax
je 0x100cebd
push eax
call edi
jmp 0x100cebd
mov edi, dword [sym.imp.GDI32.dll_DeleteObject]
jmp 0x100ce83
mov eax, dword [esi + 8]
test eax, eax
je 0x100cebd
push eax
call fcn.0100c88d
jmp 0x100cebd
mov eax, dword [esi + 8]
test eax, eax
je 0x100cebd
push eax
call fcn.01008446
push esi
mov ecx, ebx
call fcn.010182d3
pop edi
pop esi
pop ebx
ret
Function at 0x1007ac2
Capabilities:
Get keyboard layout

Disassembly:
sub esp, 0x44
or dword [esp], 0xffffffff
push ebx
push esi
mov esi, dword [esp + 0x58]
mov eax, esi
shl eax, 2
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
test ebx, ebx
jne 0x1007aec
or eax, 0xffffffff
jmp 0x1007bcd
push ebp
push ebx
push esi
call dword [sym.imp.USER32.dll_GetKeyboardLayoutList]
xor ebp, ebp
test esi, esi
jbe 0x1007bc1
push edi
mov edi, dword [esp + 0x58]
add edi, 4
lea esi, [ebx + ebp*4]
mov eax, dword [esi]
mov dword [edi - 4], eax
mov eax, dword [esi]
cmp eax, dword [esp + 0x5c]
jne 0x1007b1b
mov dword [esp + 0x10], ebp
shr eax, 0x10
and ax, 0xf000
cmp ax, 0xe000
jne 0x1007ba5
cmp dword [0x102ba04], 0
jne 0x1007b5a
push str.imm32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1007b51
push 0x1001f4c
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x102ba04], eax
cmp dword [0x102ba04], 0
je 0x1007ba5
push 0x40
lea eax, [esp + 0x18]
push eax
push dword [esi]
call dword [0x102ba04]
test eax, eax
je 0x1007ba5
push 0x1001f34
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x1007bb2
push 0x1001f24
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1007b9c
push 1
push edi
push 0
push 0
lea ecx, [esp + 0x24]
push ecx
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x1007bb2
xor eax, eax
mov ax, word [esi]
push eax
call fcn.010078d1
mov dword [edi], eax
inc ebp
add edi, 8
cmp ebp, dword [esp + 0x60]
jb 0x1007b07
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [esp + 0xc]
pop ebp
pop esi
pop ebx
add esp, 0x44
ret 0xc

Function at 0x1007c15
Capabilities:
Get keyboard layout

Disassembly:
push edi
push 0
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayoutList]
mov edi, eax
cmp edi, 2
jae 0x1007c2b
xor eax, eax
jmp 0x1007c82
mov eax, dword [esp + 8]
push esi
lea esi, [eax + eax*2]
shl esi, 2
mov eax, dword [esi + 0x102b9f4]
test eax, eax
jne 0x1007c62
mov eax, edi
shl eax, 3
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
test eax, eax
jne 0x1007c56
xor eax, eax
jmp 0x1007c81
mov dword [esi + 0x102b9f0], edi
mov dword [esi + 0x102b9f4], eax
push edi
mov edi, dword [esp + 0x14]
push edi
push eax
call fcn.01007bd5
test eax, eax
je 0x1007c52
push eax
call fcn.01008321
xor eax, eax
mov dword [esi + 0x102b9ec], edi
inc eax
pop esi
pop edi
ret 8

Function at 0x1007d20
Capabilities:
Find taskbar

Disassembly:
push 0
push 0x1001f60
call dword [sym.imp.USER32.dll_FindWindowW]
neg eax
sbb eax, eax
inc eax
ret

Function at 0x1008f87
Capabilities:
Hide graphical window

Disassembly:
mov dword [ecx + 0xc0], 4
mov ecx, dword [ecx + 0xc4]
test ecx, ecx
je 0x1008fa6
push 0
push dword [ecx + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
ret
Function at 0x100ae8b
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x70
push 0x10026f0
call fcn.0100b104
xor ebx, ebx
push ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x100aec8
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100aec8
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x100aee0
cmp eax, 0x20b
je 0x100aecd
mov dword [ebp - 0x1c], ebx
jmp 0x100aef4
cmp dword [ecx + 0x84], 0xe
jbe 0x100aec8
xor eax, eax
cmp dword [ecx + 0xf8], ebx
jmp 0x100aeee
cmp dword [ecx + 0x74], 0xe
jbe 0x100aec8
xor eax, eax
cmp dword [ecx + 0xe8], ebx
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], ebx
push 2
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x103c300], 0xffffffff
or dword [0x103c304], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x102bf6c]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x102bf68]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x103c2fc], eax
call fcn.01010c0b
cmp dword [0x1026980], ebx
jne 0x100af4f
push fcn.01010c0b
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.0100b0f2
push 0x100162c
push 0x1001628
call sub.msvcrt.dll__initterm
mov eax, dword [0x102bf64]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
push dword [0x102bf60]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.msvcrt.dll___getmainargs]
mov dword [ebp - 0x30], eax
push 0x1001624
push 0x10014e0
call sub.msvcrt.dll__initterm
add esp, 0x24
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x34], esi
cmp byte [esi], 0x22
jne 0x100afe5
inc esi
mov dword [ebp - 0x34], esi
mov al, byte [esi]
cmp al, bl
je 0x100afb9
cmp al, 0x22
jne 0x100afab
cmp byte [esi], 0x22
jne 0x100afc2
inc esi
mov dword [ebp - 0x34], esi
mov al, byte [esi]
cmp al, bl
je 0x100afcc
cmp al, 0x20
jbe 0x100afbe
mov dword [ebp - 0x4c], ebx
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x4c], 1
je 0x100aff0
movzx eax, word [ebp - 0x48]
jmp 0x100aff3
cmp byte [esi], 0x20
jbe 0x100afc2
inc esi
mov dword [ebp - 0x34], esi
jmp 0x100afe5
push 0xa
pop eax
push eax
push esi
push ebx
push ebx
call edi
push eax
call main
mov esi, eax
mov dword [ebp - 0x7c], esi
cmp dword [ebp - 0x1c], ebx
jne 0x100b010
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
jmp 0x100b045
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.0100b13d
ret
Function at 0x100b38b
Capabilities:
Get domain controller name
Get hostname
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
push esi
push edi
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x3c]
xor ebx, ebx
push eax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], 0x10
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
jne 0x100b3b6
mov word [ebp - 0x3c], bx
cmp dword [ebp + 0xc], ebx
je 0x100b3eb
push dword [ebp + 0xc]
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x100b3eb
lea eax, [ebp - 4]
push eax
push ebx
push ebx
push ebx
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.NETAPI32.dll_DsGetDcNameW]
test eax, eax
jne 0x100b3eb
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
jmp 0x100b3f1
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], ebx
mov edi, dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 8]
push eax
push ebx
lea eax, [ebp - 0xc]
push eax
push ebx
push dword [ebp + 8]
mov dword [ebp - 8], ebx
push dword [ebp - 0x10]
mov dword [ebp - 0xc], ebx
call edi
push dword [ebp - 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_LocalAlloc]
push ebx
call esi
cmp eax, ebx
mov dword [ebp + 0xc], eax
je 0x100b475
mov eax, dword [ebp - 8]
add eax, eax
push eax
push ebx
call esi
mov esi, eax
cmp esi, ebx
je 0x100b467
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 8]
push eax
push esi
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 0x10]
call edi
test eax, eax
je 0x100b460
cmp dword [ebp - 0x14], 1
jne 0x100b460
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
mov dword [ebp + 0xc], ebx
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp + 0xc], ebx
je 0x100b475
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 4], ebx
pop edi
pop esi
pop ebx
je 0x100b485
push dword [ebp - 4]
call sub.NETAPI32.dll_NetApiBufferFree
mov eax, dword [ebp - 0x18]
leave
ret 8
Function at 0x100b48c
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push ebx
push 0xffffffffffffffff
push dword [ebp + 8]
xor ebx, ebx
mov byte [ebp - 1], bl
call dword [sym.imp.KERNEL32.dll_IsBadStringPtrW]
test eax, eax
jne 0x100b578
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0x208
push edi
call dword [sym.imp.KERNEL32.dll_IsBadWritePtr]
test eax, eax
jne 0x100b576
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 8]
push eax
push 1
push ebx
push 0x1002ba8
push 0x80000002
mov word [edi], bx
call esi
test eax, eax
jne 0x100b576
lea eax, [ebp + 0xc]
push eax
push 1
push ebx
push dword [ebp + 8]
push dword [ebp - 8]
call esi
test eax, eax
jne 0x100b56d
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp + 8]
push eax
push ebx
push 0x1002b80
push dword [ebp + 0xc]
mov esi, 0x104
mov dword [ebp - 0xc], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100b564
cmp dword [ebp + 8], 2
jne 0x100b54c
push esi
push edi
lea eax, [ebp - 0x214]
push eax
mov byte [ebp - 1], 1
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x100b54c
mov dword [ebp + 8], 1
cmp dword [ebp + 8], 1
jne 0x100b564
lea eax, [ebp - 0x214]
push eax
push edi
mov byte [ebp - 1], 1
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov al, byte [ebp - 1]
pop ebx
leave
ret 8
Function at 0x100b921
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
xor ebx, ebx
cmp dword [0x102bf88], ebx
mov dword [ebp - 8], ebx
jne 0x100ba3f
push esi
push 7
xor esi, esi
call fcn.0100bcac
test eax, eax
je 0x100b99a
call fcn.0100b850
cmp ax, bx
mov word [0x102bf84], ax
je 0x100ba2a
push 0x10
lea ecx, [ebp - 0x38]
push ecx
movzx eax, ax
push 0x58
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x100ba2a
test byte [ebp - 0x29], 8
je 0x100ba2a
xor eax, eax
mov ax, word [0x102bf84]
push eax
call fcn.0100b8c2
test eax, eax
je 0x100ba2a
jmp 0x100ba27
push 5
call fcn.0100bcac
test eax, eax
je 0x100ba2a
push 0x4a
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x100ba2a
lea eax, [ebp - 4]
push eax
push 0x20019
push ebx
push 0x1002c30
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100ba2a
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x18]
push eax
push ebx
push ebx
push 0x1002c2c
push dword [ebp - 4]
mov dword [ebp - 0xc], 0xc
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov byte [ebp - 0xd], bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.0100b771
test eax, eax
je 0x100ba2a
mov eax, dword [ebp - 8]
and eax, 0x3ff
cmp eax, 1
je 0x100ba21
cmp eax, 0xd
jne 0x100ba2a
mov word [0x102bf84], ax
xor esi, esi
inc esi
xor eax, eax
cmp esi, ebx
sete al
inc eax
push eax
push 0x102bf88
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
pop esi
cmp dword [0x102bf88], 1
jne 0x100ba59
mov eax, dword [ebp + 8]
cmp eax, ebx
je 0x100ba59
mov cx, word [0x102bf84]
mov word [eax], cx
xor eax, eax
cmp dword [0x102bf88], 1
pop ebx
sete al
leave
ret 4

Function at 0x100ba72
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push edi
lea eax, [ebp + 0xc]
push eax
push 1
xor edi, edi
push edi
push dword [ebp + 0xc]
mov dword [ebp - 4], edi
push dword [ebp + 8]
call esi
test eax, eax
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
jne 0x100bad1
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push dword [ebp + 0x14]
mov dword [ebp - 8], 4
push dword [ebp + 0xc]
call ebx
test eax, eax
jne 0x100bac8
cmp dword [ebp - 0xc], 4
je 0x100bac8
mov dword [ebp - 4], edi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp + 0xc]
push eax
push 1
push edi
push dword [ebp + 0x10]
push dword [ebp + 8]
call esi
test eax, eax
jne 0x100bb14
push 4
pop esi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push dword [ebp + 0x14]
mov dword [ebp - 8], esi
push dword [ebp + 0xc]
call ebx
test eax, eax
jne 0x100bb0b
cmp dword [ebp - 0xc], esi
je 0x100bb0b
mov dword [ebp - 4], edi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x100bb1e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push esi
lea eax, [ebp + 0xc]
push eax
push 1
xor esi, esi
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100bb74
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 4]
push eax
push esi
push dword [ebp + 0x10]
mov dword [ebp + 8], 0x104
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp + 0xc]
mov esi, eax
neg esi
sbb esi, esi
inc esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret 0xc
Function at 0x100c1cb
Capabilities:
Get thread local storage value

Disassembly:
push dword [0x1026bb8]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [eax + 8]
call fcn.010182a8
test eax, eax
je 0x100c1fe
mov ecx, dword [esp + 4]
mov dword [eax + 8], ecx
mov ecx, dword [esp + 8]
mov word [eax + 2], 6
mov dword [eax + 0xc], ecx
mov dword [eax + 4], 1
ret 8

Function at 0x100c201
Capabilities:
Get thread local storage value

Disassembly:
push dword [0x1026bb8]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [eax + 8]
call fcn.010182a8
test eax, eax
je 0x100c234
mov ecx, dword [esp + 4]
mov dword [eax + 8], ecx
mov ecx, dword [esp + 8]
mov word [eax + 2], 7
mov dword [eax + 0xc], ecx
mov dword [eax + 4], 1
ret 8

Function at 0x100c27f
Capabilities:
Get thread local storage value

Disassembly:
push dword [0x1026bb8]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [eax + 8]
call fcn.010182a8
test eax, eax
je 0x100c2af
mov ecx, dword [esp + 4]
mov word [eax + 2], 9
mov byte [eax + 8], 2
mov dword [eax + 0xc], ecx
mov dword [eax + 4], 1
ret 4

Function at 0x100c2b2
Capabilities:
Get thread local storage value

Disassembly:
push dword [0x1026bb8]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [eax + 8]
call fcn.010182a8
test eax, eax
je 0x100c2ec
mov cl, byte [esp + 0xc]
mov byte [eax + 8], cl
mov ecx, dword [esp + 4]
mov dword [eax + 0xc], ecx
mov ecx, dword [esp + 8]
mov word [eax + 2], 9
mov dword [eax + 0x10], ecx
mov dword [eax + 4], 1
ret 0xc

Function at 0x100c2ef
Capabilities:
Get thread local storage value

Disassembly:
push dword [0x1026bb8]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [eax + 8]
call fcn.010182a8
test eax, eax
je 0x100c330
mov cl, byte [esp + 0x10]
mov byte [eax + 8], cl
mov ecx, dword [esp + 4]
mov dword [eax + 0xc], ecx
mov ecx, dword [esp + 8]
mov dword [eax + 0x10], ecx
mov ecx, dword [esp + 0xc]
mov word [eax + 2], 9
mov dword [eax + 0x14], ecx
mov dword [eax + 4], 1
ret 0x10

Function at 0x100c333
Capabilities:
Get thread local storage value

Disassembly:
push dword [0x1026bb8]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [eax + 8]
call fcn.010182a8
test eax, eax
je 0x100c36a
mov ecx, dword [esp + 4]
mov dword [eax + 0xc], ecx
mov ecx, dword [esp + 8]
mov word [eax + 2], 9
mov byte [eax + 8], 5
mov dword [eax + 0x10], ecx
mov dword [eax + 4], 1
ret 8

Function at 0x100c36d
Capabilities:
Get thread local storage value

Disassembly:
push dword [0x1026bb8]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [eax + 8]
call fcn.010182a8
test eax, eax
je 0x100c3ab
mov ecx, dword [esp + 4]
mov dword [eax + 0xc], ecx
mov ecx, dword [esp + 8]
mov dword [eax + 0x10], ecx
mov ecx, dword [esp + 0xc]
mov word [eax + 2], 9
mov byte [eax + 8], 6
mov dword [eax + 0x14], ecx
mov dword [eax + 4], 1
ret 0xc
Function at 0x100c3dd
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push dword [0x1026bb8]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov bl, byte [ebp + 0xc]
cmp bl, 2
mov esi, dword [eax + 8]
je 0x100c402
cmp bl, 7
jne 0x100c417
push dword [ebp + 8]
call fcn.01013f30
push dword [ebp + 8]
mov edi, eax
call dword [sym.imp.GDI32.dll_DeleteObject]
jmp 0x100c41a
mov edi, dword [ebp + 8]
test edi, edi
jne 0x100c425
xor eax, eax
jmp 0x100c518
mov ecx, esi
call fcn.010182a8
mov esi, eax
test esi, esi
je 0x100c516
mov al, byte [ebp + 0x18]
mov cl, byte [ebp + 0x14]
and dword [esi + 0xc], 0
or al, 0xfe
shl al, 1
and cl, 1
or al, cl
mov cl, byte [esi + 0x14]
shl al, 5
and cl, 0x1c
or al, cl
mov byte [esi + 0x14], al
lea eax, [ebp - 0x18]
push eax
push 0x18
push edi
mov word [esi + 2], 0xb
mov dword [esi + 8], edi
call dword [sym.imp.GDI32.dll_GetObjectW]
mov ax, word [ebp - 0x14]
mov word [esi + 0x10], ax
mov ax, word [ebp - 0x10]
mov word [esi + 0x12], ax
mov al, bl
shl al, 2
xor al, byte [esi + 0x14]
and al, 0x1c
xor byte [esi + 0x14], al
test bl, bl
je 0x100c50b
jbe 0x100c50f
cmp bl, 2
jbe 0x100c4a4
cmp bl, 3
je 0x100c4ac
cmp bl, 6
je 0x100c4fa
cmp bl, 7
jne 0x100c50f
mov al, byte [ebp + 0x10]
mov byte [esi + 0x15], al
jmp 0x100c50f
mov ebx, dword [ebp + 0x10]
cmp ebx, 0xffffffff
jne 0x100c4fd
cmp dword [esi + 8], 0
je 0x100c4fd
push 0
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
test eax, eax
mov dword [ebp + 0xc], eax
je 0x100c4fd
push dword [esi + 8]
mov edi, dword [sym.imp.GDI32.dll_SelectObject]
push eax
call edi
push 0
push 0
push dword [ebp + 0xc]
mov dword [ebp + 0x18], eax
call dword [sym.imp.GDI32.dll_GetPixel]
push dword [ebp + 0x18]
mov ebx, eax
push dword [ebp + 0xc]
call edi
push dword [ebp + 0xc]
call dword [sym.imp.GDI32.dll_DeleteDC]
jmp 0x100c4fd
mov ebx, dword [ebp + 0x10]
mov byte [esi + 0x15], bl
mov byte [esi + 0x16], bh
shr ebx, 0x10
mov byte [esi + 0x17], bl
jmp 0x100c50f
and byte [esi + 0x15], 0
mov dword [esi + 4], 1
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 0x14
Function at 0x100c51f
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push esi
push dword [0x1026bb8]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [eax + 8]
call fcn.010182a8
mov esi, eax
test esi, esi
je 0x100c5c8
mov cl, byte [esi + 0x14]
mov eax, dword [ebp + 8]
and dword [esi + 0xc], 0
and cl, 0xfd
or cl, 1
test eax, eax
mov word [esi + 2], 0xb
mov dword [esi + 8], eax
mov byte [esi + 0x14], cl
je 0x100c5a0
push edi
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetIconInfo]
lea eax, [ebp - 0x2c]
push eax
push 0x18
push dword [ebp - 4]
call dword [sym.imp.GDI32.dll_GetObjectW]
mov ax, word [ebp - 0x28]
push dword [ebp - 8]
mov edi, dword [sym.imp.GDI32.dll_DeleteObject]
mov word [esi + 0x10], ax
mov ax, word [ebp - 0x24]
mov word [esi + 0x12], ax
call edi
push dword [ebp - 4]
call edi
pop edi
mov al, byte [ebp + 0x10]
mov cl, byte [ebp + 0xc]
and byte [esi + 0x15], 0
or al, 0xfe
and cl, 1
shl al, 1
or al, cl
mov cl, byte [esi + 0x14]
shl al, 5
and cl, 3
or al, cl
mov byte [esi + 0x14], al
mov dword [esi + 4], 1
mov eax, esi
pop esi
leave
ret 0xc

Function at 0x100c64f
Capabilities:
Get thread local storage value

Disassembly:
push esi
push dword [0x1026bb8]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [eax + 8]
call fcn.010182a8
mov esi, eax
test esi, esi
je 0x100c68b
push edi
mov edi, dword [esp + 0xc]
test edi, edi
mov word [esi + 2], 0xc
je 0x100c680
mov ecx, edi
call fcn.01018608
mov dword [esi + 8], edi
mov dword [esi + 4], 1
pop edi
mov eax, esi
pop esi
ret 4

Function at 0x100cfb2
Capabilities:
Get thread local storage value

Disassembly:
push dword [0x1026bb8]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x100cfc3
ret
mov eax, dword [eax + 0xc]
ret