joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1006791b
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x184
mov dword [ebp - 0x17c], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x178], 0
mov eax, dword [ebp + 0x10]
mov byte [eax], 0
push 0x800
push 0x160
lea ecx, [ebp - 0x174]
push ecx
push 0
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
test eax, eax
je 0x1006797c
mov eax, dword [ebp - 0x16c]
and eax, 0x10000
test eax, eax
jne 0x10067983
xor eax, eax
jmp 0x10067ab3
lea ecx, [ebp - 0x14]
push ecx
push 0x1012ab40
push 0
push 0x1012ab50
lea ecx, [ebp - 4]
call fcn.100675b7
test eax, eax
jge 0x100679a6
xor eax, eax
jmp 0x10067ab3
lea edx, [ebp - 0x10]
push edx
push 0x1012d168
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x14]
push edx
call dword [ecx]
test eax, eax
jl 0x10067aa5
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 0
jne 0x100679e0
mov dword [ebp - 0x180], 0
jmp 0x10067a2e
mov ecx, dword [ebp - 0x178]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
mov dword [ebp - 0x17c], eax
mov eax, dword [ebp - 0x17c]
shl eax, 1
add eax, 3
and al, 0xfc
call fcn.10010f00
mov dword [ebp - 0x184], esp
mov edx, dword [ebp - 0x17c]
push edx
mov eax, dword [ebp - 0x178]
push eax
mov ecx, dword [ebp - 0x184]
push ecx
call fcn.1000bee0
mov dword [ebp - 0x180], eax
push 0
mov edx, dword [ebp - 0x180]
push edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x10]
push edx
call dword [ecx + 0x14]
test eax, eax
jl 0x10067a99
push 2
mov ecx, dword [ebp + 8]
call fcn.100b1f3c
push eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x14]
push edx
call dword [ecx + 0x4c]
test eax, eax
jl 0x10067a99
push 0
push 0
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x14]
push ecx
call dword [eax + 0xc]
mov edx, dword [ebp - 0x10]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x10]
push ecx
call dword [eax + 8]
mov edx, dword [ebp - 0x14]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x14]
push ecx
call dword [eax + 8]
mov eax, 1
jmp 0x10067ab3
mov edx, dword [ebp - 0x10]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x10]
push ecx
call dword [eax + 8]
mov edx, dword [ebp - 0x14]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x14]
push ecx
call dword [eax + 8]
xor eax, eax
lea esp, [ebp - 0x184]
mov esp, ebp
pop ebp
ret 0x10
Function at 0x10067abf
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d196d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x15c
push ebx
push esi
push edi
push 1
push 0x104
mov eax, dword [ebp + 8]
push eax
call fcn.10031c66
test eax, eax
jne 0x10067b08
push 0x216
push str.filecore.cpp
call fcn.100af1b0
test eax, eax
je 0x10067b08
int3
xor ecx, ecx
test ecx, ecx
jne 0x10067ae0
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ebp + 8]
push eax
push 0x104
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
test eax, eax
jne 0x10067b5e
mov edx, dword [ebp + 0xc]
movsx eax, byte [edx]
test eax, eax
je 0x10067b44
mov ecx, dword [ebp + 0xc]
push ecx
push str.Warning:_could_not_parse_the_path__s._n
call fcn.10031655
add esp, 8
push 0x104
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
xor eax, eax
jmp 0x10067c51
lea ecx, [ebp - 0x1c]
call fcn.100ab737
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.10067c64
push 0
push 0
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x10]
push ecx
push 0
push 0
push 0
lea ecx, [ebp - 0x1c]
call fcn.100ab7da
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
jne 0x10067bd6
lea ecx, [ebp - 0x1c]
call fcn.100ab7da
push eax
push str.Warning:_could_not_get_volume_information__s._n
call fcn.10031655
add esp, 8
mov dword [ebp - 0x164], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.1005fe4c
mov eax, dword [ebp - 0x164]
jmp 0x10067c51
mov edx, dword [ebp - 0x18]
and edx, 2
test edx, edx
jne 0x10067bea
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_CharUpperA]
mov ecx, dword [ebp - 0x18]
and ecx, 4
test ecx, ecx
jne 0x10067c32
lea edx, [ebp - 0x15c]
push edx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 0xffffffff
je 0x10067c32
mov ecx, dword [ebp - 0x160]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
lea edx, [ebp - 0x130]
push edx
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp - 0x168], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.1005fe4c
mov eax, dword [ebp - 0x168]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10079830
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
add ecx, 0x20
call fcn.100ab7da
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
and eax, 1
test eax, eax
je 0x10079886
push 1
push 0
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov ecx, dword [ebp - 8]
call dword [edx + 0xa0]
test eax, eax
jne 0x10079884
push str.Warning:_File_save_with_new_name_failed._n
push 0x1013e58c
call fcn.10031655
add esp, 8
xor eax, eax
jmp 0x100798c1
jmp 0x100798bc
push 1
mov ecx, dword [ebp - 8]
add ecx, 0x20
call fcn.100ab7da
push eax
mov eax, dword [ebp - 8]
mov edx, dword [eax]
mov ecx, dword [ebp - 8]
call dword [edx + 0xa0]
test eax, eax
jne 0x100798bc
push str.Warning:_File_save_failed._n
push 0x1013e5ac
call fcn.10031655
add esp, 8
xor eax, eax
jmp 0x100798c1
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x10079ff0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d1cc5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x110
mov dword [ebp - 0x11c], 0
lea ecx, [ebp - 0x10]
call fcn.100ab737
mov dword [ebp - 4], 1
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0x114]
push ecx
push 0x104
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
mov eax, dword [ebp - 0x118]
mov byte [eax], 0
push 0x105
lea ecx, [ebp - 0x10]
call fcn.100605f8
push eax
push 0
push 0x1013e638
lea ecx, [ebp - 0x114]
push ecx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.10060733
cmp dword [ebp + 0x10], 0
jne 0x1007a08d
lea ecx, [ebp - 0x10]
call fcn.100ab7da
push eax
call fcn.10067594
lea edx, [ebp - 0x10]
push edx
mov ecx, dword [ebp + 8]
call fcn.1005fa7a
mov eax, dword [ebp - 0x11c]
or al, 1
mov dword [ebp - 0x11c], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.1005fe4c
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x1007fb26
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
lea eax, [ebp + 0x18]
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp + 8]
call fcn.1007f750
mov dword [ebp - 0x28], eax
mov edx, dword [ebp + 8]
cmp dword [edx], 0
je 0x1007fb85
push 0x20
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x24]
push ecx
call fcn.1007f8e4
test eax, eax
jne 0x1007fb83
push 0xffffffffffffffff
push 0
mov edx, dword [ebp + 0x14]
push edx
call fcn.10081249
mov ecx, dword [ebp + 8]
call fcn.1007f86f
jmp 0x1007fba4
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
lea edx, [ebp - 0x24]
push edx
call dword [sym.imp.USER32.dll_wvsprintfA]
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
call fcn.100727a3
mov dword [ebp - 4], 0
mov esp, ebp
pop ebp
ret

Function at 0x1007fdbc
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
call fcn.1007f750
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
cmp dword [ecx], 0
je 0x1007fe10
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
add eax, 1
push eax
mov ecx, dword [ebp - 8]
push ecx
mov ecx, dword [ebp + 0x10]
call fcn.100607a7
push eax
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0xffffffffffffffff
mov ecx, dword [ebp + 0x10]
call fcn.10060733
jmp 0x1007fe22
mov ecx, dword [ebp + 0x10]
call fcn.100ab7da
push eax
mov eax, dword [ebp - 4]
push eax
call fcn.100727a3
mov esp, ebp
pop ebp
ret 0xc

Function at 0x10080214
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
call fcn.1007f79e
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
cmp dword [ecx], 0
je 0x1008028d
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jle 0x10080264
mov eax, dword [ebp - 8]
add eax, 1
push eax
mov ecx, dword [ebp - 8]
push ecx
mov ecx, dword [ebp + 0x10]
call fcn.100607a7
push eax
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x10080281
push 0x100
push 0xff
mov ecx, dword [ebp + 0x10]
call fcn.100605f8
push eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0xffffffffffffffff
mov ecx, dword [ebp + 0x10]
call fcn.10060733
jmp 0x100802be
mov ecx, dword [ebp + 0x10]
call fcn.100ab7da
push eax
push 0xffffffffffffffff
push 0x14d
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 0xffffffff
jne 0x100802be
mov ecx, dword [ebp + 0x10]
call fcn.100ab7da
push eax
mov edx, dword [ebp - 4]
push edx
call fcn.100727a3
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10081535
Capabilities:
Delete registry key
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 0x14], ecx
cmp dword [ebp + 8], 0
jne 0x1008155b
push 0x110
push str.appui3.cpp
call fcn.100af1b0
test eax, eax
je 0x1008155b
int3
xor eax, eax
test eax, eax
jne 0x10081541
mov ecx, dword [ebp - 0x14]
cmp dword [ecx + 0x80], 0
je 0x10081646
cmp dword [ebp + 0xc], 0
jne 0x100815af
mov ecx, dword [ebp - 0x14]
call fcn.100c44ac
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1008158f
xor eax, eax
jmp 0x100816b9
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1008163b
cmp dword [ebp + 0x10], 0
jne 0x100815ee
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x14]
call fcn.100c45b2
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x100815d1
xor eax, eax
jmp 0x100816b9
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1008163b
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x14]
call fcn.100c45b2
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x1008160a
xor eax, eax
jmp 0x100816b9
mov ecx, dword [ebp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
push eax
mov edx, dword [ebp + 0x10]
push edx
push 1
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp dword [ebp - 4], 0
sete al
jmp 0x100816b9
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x94], 0
jne 0x10081666
push 0x132
push str.appui3.cpp
call fcn.100af1b0
test eax, eax
je 0x10081666
int3
xor ecx, ecx
test ecx, ecx
jne 0x10081646
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x94]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 0xfff
jl 0x10081697
push 0x133
push str.appui3.cpp
call fcn.100af1b0
test eax, eax
je 0x10081697
int3
xor ecx, ecx
test ecx, ecx
jne 0x1008166c
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x94]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1009b60e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
and ecx, 1
test ecx, ecx
je 0x1009b632
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xc]
mov dword [ebp - 4], eax
jmp 0x1009b66c
push 5
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1009b686
push 0xc9
push str.dlgprop.cpp
call fcn.100af1b0
test eax, eax
je 0x1009b686
int3
xor eax, eax
test eax, eax
jne 0x1009b66c
mov ecx, dword [ebp - 4]
xor edx, edx
mov dx, word [ecx + 2]
cmp edx, 0xffff
jne 0x1009b761
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
and eax, 0x80000000
test eax, eax
je 0x1009b731
push 0x1013c474
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x1009b6de
push 0xe1
push str.dlgprop.cpp
call fcn.100af1b0
test eax, eax
je 0x1009b6de
int3
xor ecx, ecx
test ecx, ecx
jne 0x1009b6c4
cmp dword [ebp - 0x18], 0
je 0x1009b72f
push 0x1013c484
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x1009b725
mov eax, 1
test eax, eax
je 0x1009b71f
push 0xe6
push str.dlgprop.cpp
call fcn.100af1b0
test eax, eax
je 0x1009b71f
int3
xor ecx, ecx
test ecx, ecx
jne 0x1009b702
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x1009b761
mov eax, dword [ebp - 0x14]
and eax, 0xff
cmp eax, 3
jne 0x1009b761
mov ecx, 1
test ecx, ecx
je 0x1009b75b
push 0xed
push str.dlgprop.cpp
call fcn.100af1b0
test eax, eax
je 0x1009b75b
int3
xor edx, edx
test edx, edx
jne 0x1009b73e
call fcn.100c5803
cmp dword [eax + 0x1038], 0
je 0x1009b77e
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0x20]
call fcn.1009b5c3
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.1009b485
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x20]
cmp dword [eax + 0x44], 0
je 0x1009b7ae
mov ecx, dword [ebp - 0x20]
mov edx, dword [ecx + 0x44]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x44], 0
cmp dword [ebp - 8], 0
je 0x1009b7c3
mov ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 8]
mov dword [edx + 0x44], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 4]
mov dword [ecx + 0xc], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
or ecx, 1
mov edx, dword [ebp + 8]
mov dword [edx + 4], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100a0cc8
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
push 5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindow]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x100a0db7
mov eax, dword [ebp - 4]
push eax
call fcn.10057198
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x100a0da3
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x1c]
cmp edx, dword [ebp - 4]
je 0x100a0da3
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x1c]
push edx
call fcn.100a08e0
test eax, eax
je 0x100a0da3
push 0xfffffffffffffff0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov dword [ebp - 0xc], eax
cmp dword [ebp + 8], 0
jne 0x100a0d69
mov ecx, dword [ebp - 0xc]
and ecx, 0x18000000
cmp ecx, 0x10000000
jne 0x100a0d69
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x24]
or ecx, 2
mov edx, dword [ebp - 8]
mov dword [edx + 0x24], ecx
jmp 0x100a0da3
cmp dword [ebp + 8], 0
je 0x100a0da3
mov eax, dword [ebp - 0xc]
and eax, 0x18000000
test eax, eax
jne 0x100a0da3
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x24]
and edx, 2
test edx, edx
je 0x100a0da3
push 4
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x24]
and edx, 0xfffffffd
mov eax, dword [ebp - 8]
mov dword [eax + 0x24], edx
push 2
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_GetWindow]
mov dword [ebp - 4], eax
jmp 0x100a0ce3
mov esp, ebp
pop ebp
ret 4
Function at 0x100c701c
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
mov dword [ebp - 0x1c], ecx
cmp dword [ebp + 8], 0
jne 0x100c7042
push 0x146
push str.afxtls.cpp
call fcn.100af1b0
test eax, eax
je 0x100c7042
int3
xor eax, eax
test eax, eax
jne 0x100c7028
mov dword [ebp - 4], 1
mov dword [ebp - 8], 1
jmp 0x100c7061
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 8]
cmp eax, dword [edx + 8]
jge 0x100c70e4
cmp dword [ebp + 0xc], 0
je 0x100c7084
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx + 0x10]
mov eax, dword [ebp - 8]
mov ecx, dword [edx + eax*8 + 4]
cmp ecx, dword [ebp + 0xc]
jne 0x100c70c9
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xc]
mov ecx, dword [ebp - 8]
mov edx, dword [eax + ecx*4]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x100c70b0
push 1
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xc]
call dword [edx]
mov dword [ebp - 0x20], eax
jmp 0x100c70b7
mov dword [ebp - 0x20], 0
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 8]
mov dword [ecx + edx*4], 0
jmp 0x100c70df
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 8]
cmp dword [ecx + edx*4], 0
je 0x100c70df
mov dword [ebp - 4], 0
jmp 0x100c7058
cmp dword [ebp - 4], 0
je 0x100c7158
mov eax, dword [ebp - 0x1c]
add eax, 0x1c
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x1c]
add ecx, 0x14
call fcn.100c76e0
mov edx, dword [ebp - 0x1c]
add edx, 0x1c
push edx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov edx, dword [ebp + 8]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x100c7143
push 1
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x14]
call dword [edx]
mov dword [ebp - 0x24], eax
jmp 0x100c714a
mov dword [ebp - 0x24], 0
push 0
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100c7161
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
add eax, 0x1c
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [ebp + 0xc], 0
jne 0x100c71a4
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x100c71a2
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov ecx, dword [ebp - 0x10]
call fcn.100c701c
jmp 0x100c71d9
mov ecx, dword [ebp - 0x10]
add ecx, 0x14
call fcn.100c7700
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x100c71d9
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [ebp - 0x10]
call fcn.100c701c
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
jmp 0x100c71b2
mov ecx, dword [ebp - 0x10]
add ecx, 0x1c
push ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esp, ebp
pop ebp
ret 8
Function at 0x42312c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x42313b
pop dword [ebp - 0x44]
mov eax, 0x5a1359f8
add eax, 0xa62ed743
sub dword [ebp - 0x44], eax
push 0x40
push 0x1000
push 0x40f03
push 0
mov eax, 0x8f132708
sub eax, 0x8ed0d4f0
add eax, dword [ebp - 0x44]
call dword [eax]
mov ecx, 0x5443
xor esi, esi
add esi, eax
mov edx, 0x435400
add edx, dword [ebp - 0x44]
mov ebx, 0x96fbfd3a
xor dword [ebp - 0x1c], 0xee10faf9
mov edi, dword [edx]
sub dword [ebp - 0x1c], ebx
sub edi, ebx
mov dword [esi], edi
sub dword [ebp - 0x34], ebx
add esi, 0xfdcdbd3f
sub esi, 0xfdcdbd3b
add edx, 0xd46cd65f
sub edx, 0xd46cd65b
loop 0x42318a
add eax, 0x11c0a84f
sub eax, 0x11bf6470
xor ebx, ebx
add ebx, eax
add eax, 0x7cf7d14a
add eax, 0x83082ebb
mov ecx, 0x400000
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x40c6a4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x40c6b3
pop dword [ebp - 0x20]
mov eax, 0x40c6b3
sub dword [ebp - 0x20], eax
push 0x40
push 0x1000
push 0x3bb82
push 0
mov eax, 0xb2ce1180
sub eax, 0xb28bbf68
add eax, dword [ebp - 0x20]
call dword [eax]
mov ecx, 0xeebc1946
add ecx, 0x11442668
xor esi, esi
add esi, eax
mov edx, 0x6e527385
add edx, 0x91f0e07b
add edx, dword [ebp - 0x20]
mov edi, 0x1d2a2163
sub dword [ebp - 0x14], 0xcc515e7d
mov ebx, dword [edx]
xor dword [ebp - 0x1c], 0x958d680c
sub ebx, edi
mov dword [ebp - 4], 0xab70d7ee
mov dword [esi], ebx
add dword [ebp - 0x10], 0x85c766c7
add esi, 0xf0499672
sub esi, 0xf049966e
add edx, 0x2a291789
sub edx, 0x2a291785
loop 0x40c709
add eax, 0xf18b
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x20]
call ebx
leave
ret