joyce8/EMBER2024-capa huggingface dataset:
Function at 0x651d7a
Capabilities:
Encode data using xor

Disassembly:
mov ebx, dword [esp]
push 0x16fb806a
mov dword [esp], edi
mov dword [esp], ebp
jmp 0x651435
pop dword [esp]
pop esp
push 0x6898489d
jmp 0x65194e
pop esi
sub esp, 4
mov dword [esp], ebp
push dword [esp + 4]
pop ebp
pop dword [esp]
pop esp
xor eax, eax
jmp 0x65156a
neg ebx
xor ebx, 0x7d6f2062
not ebx
shr ebx, 2
add ebx, 0xc02c6856
jmp 0x65149c
sub esp, 4
mov dword [esp], esp
add dword [esp], 4
jmp 0x651a17
mov ebp, 0xfdb97578
jmp 0x651588
add ebp, ebx
mov ebx, dword [esp]
jmp 0x6514da
add esp, 4
push 0x3ac90d78
mov dword [esp], edx
jmp 0x651b56
push dword [eax + ebx]
push dword [esp]
push dword [esp]
jmp 0x651878
mov edx, esp
jmp 0x6518bc
sub ebp, eax
pop eax
add ebx, ebp
mov ebp, dword [esp]
push edx
jmp 0x651578
add ebx, 0x5f7adfa8
jmp 0x651c3b
pop eax
add eax, 0xc000a53d
sub edi, 0x2bef17ff
sub edi, eax
add edi, 0x2bef17ff
pop eax
jmp 0x6518f1
sub ebx, 0x69f76e56
sub ebx, 0x7dbbeb64
jmp 0x6515d8
mov esi, 4
add ebp, esi
jmp 0x6513b4
push ebx
mov ebx, esp
add ebx, 4
add ebx, 4
xchg dword [esp], ebx
jmp 0x65189f
mov ecx, dword [esp]
jmp fcn.0065199f
pop esp
push 0x1e195af9
mov dword [esp], ebp
push esi
mov esi, esp
add esi, 4
sub esi, 4
jmp 0x651d4b
add edx, 4
add edx, 4
jmp 0x651c13
and ecx, ebx
pop ebx
inc ecx
sub ecx, 0x40028bfd
sub ebp, 0x578d673d
add ebp, ecx
add ebp, 0x578d673d
mov ecx, dword [esp]
add esp, 4
push esi
jmp 0x651814
pop edx
shr edi, 4
neg edi
add edi, 0x8d57eaa4
sub ebx, 0x773b6fdb
sub ebx, edi
add ebx, 0x773b6fdb
jmp 0x651b4e
mov dword [esp], ebx
mov ebx, 0x7dde8123
xchg ebx, esi
jmp 0x6519ff
mov ebx, 0x1fe881ae
xor ebx, 0x791a4d65
jmp 0x6518ca
xchg esi, ebp
not ebp
jmp 0x651aec
push dword [esp]
pop ebp
push ebx
mov ebx, esp
add ebx, 4
push eax
mov eax, 4
add ebx, eax
jmp 0x651aa7
pop eax
push ebx
push dword [esp + 4]
pop ebx
jmp 0x65137c
xchg esi, ebp
xchg ebx, esi
jmp 0x6513cb
mov dword [esp], ebp
jmp 0x651d97
pop ebp
push esi
jmp 0x651c2e
mov edi, dword [esp]
jmp 0x65183f
mov edx, 0x4f7b04fc
xor edx, 0x4f7b04f8
add ebp, edx
pop edx
xor ebp, dword [esp]
xor dword [esp], ebp
xor ebp, dword [esp]
mov esp, dword [esp]
sti
add ebx, 0x7d7ebfc2
jmp 0x6516c1
sub esi, 4
xchg dword [esp], esi
pop esp
mov dword [esp], ebp
mov dword [esp], 0x21b523a
mov dword [esp], ecx
mov ecx, 0x19b7fd63
jmp 0x651d77
sub ebp, ecx
push ebp
pop ecx
pop ebp
push ebx
jmp 0x6519cc
xchg dword [esp], edx
pop esp
jmp 0x651cb7
mov esi, esp
add esi, 4
jmp 0x651bc9
add ebx, dword [esp]
sub ebx, 0x5f7adfa8
push 0x2a290dd6
mov dword [esp], ebp
push eax
push 0x58783835
mov dword [esp], ecx
mov ecx, 0x7e6e1e7e
shl ecx, 1
neg ecx
shr ecx, 8
xor ecx, 0x7ffea9d7
mov eax, ecx
pop ecx
jmp 0x65144a
add ebx, 0x69f76e56
jmp 0x651cd7
push edi
mov edi, 0x3d7a158e
inc edi
dec edi
jmp 0x651d5e
xchg dword [esp], esi
pop esp
mov dword [esp], esp
add dword [esp], 4
jmp 0x651b1e
push edx
mov edx, 0x3fe76766
add edi, 0x3fea7e7c
jmp 0x651e60
shl ecx, 8
push ebp
mov ebp, esp
add ebp, 4
sub ebp, 4
xchg dword [esp], ebp
jmp 0x651d91
pop esp
jmp 0x651b0d
mov ebp, 0
jmp 0x651c08
sub edi, edx
push eax
mov eax, 0xeffc3dc
sub eax, 0x44ff6b41
shl eax, 6
push eax
not dword [esp]
jmp 0x6515e3
Function at 0x10006440
Capabilities:
Decode data using base64 via winapi

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101807be
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push edi
mov edi, edx
mov ebx, ecx
mov dword [ebp - 0x1c], ebx
mov eax, edi
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0
cmp dword [edi + 0x14], 0xf
mov dword [ebp - 0x10], 0
jbe 0x10006483
mov eax, dword [edi]
push esi
mov esi, dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
lea ecx, [ebp - 0x10]
push 0
push 0
push ecx
push 0
push 1
push 0
push eax
call esi
test eax, eax
je 0x10006537
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
test eax, eax
je 0x100064f2
cmp eax, 0x7fffffff
ja 0x10006552
push eax
mov ecx, ebx
call fcn.10006e50
push dword [ebp - 0x14]
mov esi, dword [ebx]
push 0
push esi
call fcn.10157f20
mov eax, dword [ebp - 0x14]
add esp, 0xc
add eax, esi
mov esi, dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
mov dword [ebx + 4], eax
mov dword [ebp - 4], 0
cmp dword [edi + 0x14], 0xf
mov dword [ebp - 0x18], 1
jbe 0x10006508
mov edi, dword [edi]
push 0
push 0
lea eax, [ebp - 0x10]
push eax
push dword [ebx]
push 1
push 0
push edi
call esi
test eax, eax
jne 0x10006524
push str.Failed_to_decode_base64_string.
jmp 0x1000653c
mov ecx, dword [ebp - 0xc]
mov eax, ebx
pop esi
pop edi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
push str.Failed_to_calculate_base64_decoded_size.
lea ecx, [ebp - 0x28]
call fcn.10006400
push 0x101e19b8
lea eax, [ebp - 0x28]
push eax
call fcn.1015821e
call fcn.100063f0
int3
Function at 0x1000a240
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x10180400
push eax
mov dword fs:[0], esp
push esi
mov esi, ecx
push edi
push 8
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.100171d6
mov edi, eax
add esp, 4
test edi, edi
je 0x1000a2dc
push 1
mov dword [ebp - 4], 0
call fcn.1015628f
add esp, 4
mov dword [edi + 4], eax
jmp 0x1000a2de
xor edi, edi
mov ecx, esi
mov dword [esi + 0x34], edi
call fcn.1000a0e0
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10012750
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10180f9d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ebx
sub esp, 0x44
push esi
mov esi, ecx
mov dword [ebp - 0x20], 0x35366976
xorps xmm0, xmm0
mov dword [ebp - 0x1c], 0x31346572
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x18], 0x72657776
mov word [ebp - 0x14], 0x3635
lea edx, [ecx + 1]
mov byte [ebp - 0x12], 0
movups xmmword [ebp - 0x38], xmm0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100127c0
sub ecx, edx
lea eax, [ebp - 0x20]
push ecx
push eax
lea ecx, [ebp - 0x38]
call fcn.10005380
lea eax, [ebp - 0x38]
mov dword [ebp - 4], 0
push eax
mov edx, esi
lea ecx, [ebp - 0x50]
call fcn.100068b0
mov esi, eax
add esp, 4
cmp esi, 0x101e7b60
je 0x10012874
mov ecx, dword [0x101e7b74]
cmp ecx, 0xf
jbe 0x10012831
mov eax, dword [0x101e7b60]
inc ecx
cmp ecx, 0x1000
jb 0x10012827
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100128f8
mov eax, edx
push ecx
push eax
call fcn.10154c15
add esp, 8
mov dword [0x101e7b70], 0
mov dword [0x101e7b74], 0xf
mov byte [0x101e7b60], 0
movups xmm0, xmmword [esi]
movups xmmword [0x101e7b60], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [0x101e7b70], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
mov ecx, dword [ebp - 0x3c]
cmp ecx, 0xf
jbe 0x100128a4
mov edx, dword [ebp - 0x50]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1001289a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100128f8
push ecx
push edx
call fcn.10154c15
add esp, 8
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0xf
mov byte [ebp - 0x50], 0
cmp ecx, 0xf
jbe 0x100128e6
mov edx, dword [ebp - 0x38]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x100128dc
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100128f8
push ecx
push edx
call fcn.10154c15
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.1015ff88
int3
Function at 0x10012900
Capabilities:
Contain obfuscated stackstrings
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x797a7979
push eax
mov dword [ebp - 0xc], 0x65736142
mov dword [ebp - 8], 0x6c6c642e
mov byte [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, eax
mov dword [ebp - 0x20], 0x4f0043
xor eax, eax
mov dword [ebp - 0x1c], 0x46004e
mov word [ebp - 0x14], ax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x18], 0x470049
push eax
push edi
mov dword [ebp - 0x44], 0x460041
mov dword [ebp - 0x40], 0x5f0058
mov dword [ebp - 0x3c], 0x490044
mov dword [ebp - 0x38], 0x4c0041
mov dword [ebp - 0x34], 0x47004f
mov dword [ebp - 0x30], 0x4c005f
mov dword [ebp - 0x2c], 0x590041
mov dword [ebp - 0x28], 0x55004f
mov dword [ebp - 0x24], 0x54
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x100129eb
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push ebx
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x100129eb
lea ecx, [edi + 1]
push ecx
call fcn.100284b5
add esp, 4
mov esi, eax
push edi
push ebx
push esi
call fcn.101579a0
add esp, 0xc
mov byte [esi + edi], 0
mov ecx, esi
call fcn.10011d50
push esi
call fcn.100284b0
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10014650
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov eax, edi
shr eax, 4
inc eax
push 6
movzx eax, ax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp + 0xc], eax
test eax, eax
jne 0x10014679
pop edi
pop ebx
pop ebp
ret
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x1001468f
xor esi, esi
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x10014686
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [esi + eax]
and edi, 0xf
jbe 0x100146c2
nop
cmp esi, ecx
jae 0x10014686
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edi, 1
jne 0x100146b0
cmp esi, ecx
jae 0x10014686
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x100148e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
movzx eax, word [ebp + 8]
mov dword [ebp + 8], eax
pop ebp
jmp fcn.1002f204
Function at 0x10014b90
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10180400
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
mov edi, dword [ebp + 8]
push edi
mov dword [ebp - 4], 0
call fcn.100308d6
mov esi, eax
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x10], esi
test esi, esi
je 0x10014cb3
mov eax, edi
shr eax, 4
inc eax
push 6
movzx eax, ax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp + 8], eax
test eax, eax
je 0x10014cb3
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x10014c00
xor esi, esi
jmp 0x10014c43
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x10014c43
push dword [ebp + 8]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [esi + eax]
and edi, 0xf
jbe 0x10014c33
cmp esi, ecx
jae 0x10014c37
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edi, 1
jne 0x10014c21
cmp esi, ecx
jb 0x10014c3b
xor esi, esi
jmp 0x10014c43
xor eax, eax
cmp word [esi], ax
cmove esi, eax
test esi, esi
je 0x10014cb3
mov eax, dword [ebx]
mov ecx, 1
movzx edi, word [esi]
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, edi
or ecx, eax
jge 0x10014c65
push edi
mov ecx, ebx
call fcn.100150a0
movzx ecx, word [esi]
lea eax, [esi + 2]
push ecx
push eax
push edi
push dword [ebx]
call fcn.1016527f
add esp, 0x10
cmp eax, 0x50
ja case.0x10014c84.1
movzx eax, byte [eax + 0x10014cec]
jmp dword [eax*4 + 0x10014cdc]
mov eax, dword [ebx]
cmp edi, dword [eax - 8]
jg 0x10014ccd
mov dword [eax - 0xc], edi
xor ecx, ecx
mov eax, dword [ebx]
mov word [eax + edi*2], cx
lea eax, [ecx + 1]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 0xc]
xor eax, eax
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
call fcn.1002321b
push 0x80070057
call fcn.10001dc0
call fcn.10023201
mov ecx, dword [ecx + eax + 0x10]
enter 332, 0x10
xlatb
dec esp
add dword [eax], edx
xlatb
dec esp
add dword [eax], edx
add byte [ebx], al
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add dword [ebx], eax
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add al, byte [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add al, byte [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add ah, cl
int3
Function at 0x100194a5
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
xor esi, esi
mov ebx, ecx
push edi
cmp dword [ebp + 8], esi
je 0x100194e4
call fcn.10030cf9
push 0xf0
push dword [ebp + 8]
mov edi, dword [eax + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x100194e4
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x100194ec
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
push esi
mov ecx, ebx
call fcn.10032f61
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x10019f2b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
je 0x10019fb7
cmp dword [esi + 0x20], 0
je 0x10019fb7
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x10019fb7
cmp dword [ebp + 8], 0
je 0x10019fb7
xor edi, edi
mov ebx, edi
call fcn.10030cf9
push 0x10192128
push dword [ebp + 8]
mov eax, dword [eax + 0xc]
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 8], eax
test eax, eax
je 0x10019f9b
mov ebx, dword [ebp - 4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp - 8]
mov edi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x10019fb7
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
push edi
push ebx
push esi
call fcn.10033a2e
mov edi, eax
add esp, 0xc
test edi, edi
je 0x10019fb3
mov ecx, esi
call fcn.10019cd4
mov eax, edi
jmp 0x10019fb9
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x1001e521
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x1018166f
call fcn.10154fe8
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x74], ebx
jne 0x1001e547
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x1001e5a1
lea ecx, [ebp - 0x10]
call fcn.10014dc0
mov edi, dword [edi + 0x74]
lea ecx, [ebp - 0x10]
push ecx
mov dword [ebp - 4], ebx
mov eax, dword [edi]
mov esi, dword [eax + 0x8c]
mov ecx, esi
call dword [0x10190a00]
mov ecx, edi
call esi
mov esi, dword [ebp + 8]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push esi
call fcn.10165440
push eax
call fcn.100145c0
add esp, 0x14
test esi, esi
je 0x1001e594
push esi
call fcn.1016556d
pop ecx
mov ebx, eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.100146e0
mov eax, ebx
call fcn.10154fb5
ret 8
Function at 0x10029167
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov dword [ebp - 4], ecx
call fcn.10030cf9
push 0xf1
push dword [ebp + 8]
mov esi, dword [eax + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x10029235
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x10029235
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x10029235
movzx eax, word [edi + 6]
push ebx
push 4
pop ecx
mul ecx
push 0xffffffffffffffff
pop ecx
cmovb eax, ecx
push eax
call fcn.100284b5
pop ecx
movzx ecx, word [edi + 6]
xor esi, esi
xor edx, edx
mov ebx, eax
mov eax, ecx
cmp si, cx
jae 0x100291ef
lea ecx, [edi + 8]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov dword [ebx + edx*4], eax
inc edx
movzx esi, word [edi + 6]
cmp edx, esi
jl 0x100291db
mov eax, esi
mov ecx, dword [ebp - 4]
movzx eax, ax
push eax
push ebx
call fcn.10029899
push ebx
mov esi, eax
call fcn.100284b0
pop ecx
test esi, esi
je 0x10029230
movzx ecx, word [edi + 4]
movzx esi, word [edi + 2]
push ecx
push esi
lea eax, [ecx + 7]
mov ecx, dword [ebp - 4]
lea edx, [esi + 7]
push eax
push edx
call fcn.10029a65
push dword [ebp + 8]
mov ecx, dword [ebp - 4]
call fcn.10029116
mov esi, eax
mov eax, esi
pop ebx
jmp 0x10029237
xor eax, eax
pop edi
pop esi
leave
ret 4
Function at 0x1002ddd3
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x18
mov eax, 0x10181e0a
call fcn.10154fe8
mov eax, ecx
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp + 0x10]
xor edi, edi
mov esi, dword [ebp + 0x14]
push edi
mov dword [ebx], edi
mov dword [esi], edi
cmp dword [eax + 0x58], edi
je 0x1002de7b
push dword [ebp + 8]
call fcn.1002e0f3
mov dword [ebp - 0x10], eax
test eax, eax
je 0x1002df01
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], edi
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], edi
push ecx
push edi
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], edi
push ecx
push edi
push dword [ebp + 0xc]
mov dword [ebp - 0x14], edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp - 0x14]
mov dword [esi], ecx
test eax, eax
jne 0x1002de64
push ecx
call fcn.100284b5
pop ecx
lea ecx, [ebp - 0x14]
mov dword [ebx], eax
push ecx
push eax
lea eax, [ebp - 0x18]
push eax
push edi
push dword [ebp + 0xc]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1002de64
xor edi, edi
inc edi
jmp 0x1002de6e
push dword [ebx]
call fcn.100284b0
pop ecx
mov dword [ebx], edi
lea ecx, [ebp - 0x24]
call fcn.1002dc76
jmp 0x1002deff
mov eax, dword [eax]
push dword [ebp + 0xc]
push dword [ebp + 8]
mov esi, dword [eax + 0x84]
lea eax, [ebp - 0x10]
push eax
mov ecx, esi
call dword [0x10190a00]
mov ecx, dword [ebp - 0x18]
call esi
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], 1
mov ecx, dword [eax - 0xc]
test ecx, ecx
je 0x1002def7
mov esi, dword [ebp + 0x14]
shr ecx, 1
push ecx
mov dword [esi], ecx
call fcn.100284b5
mov dword [ebx], eax
pop ecx
cmp dword [esi], edi
jbe 0x1002def1
lea esi, [edi + edi]
lea eax, [esi + 1]
push eax
lea ecx, [ebp - 0x10]
call fcn.1002dc52
push esi
lea ecx, [ebp - 0x10]
mov bl, al
call fcn.1002dc52
mov ecx, dword [ebp + 0x10]
shl bl, 4
sub bl, 0x51
add al, bl
mov ecx, dword [ecx]
mov byte [edi + ecx], al
inc edi
mov eax, dword [ebp + 0x14]
cmp edi, dword [eax]
jb 0x1002debf
mov eax, dword [ebp - 0x10]
xor edi, edi
inc edi
lea ecx, [eax - 0x10]
call fcn.100146e0
mov eax, edi
call fcn.10154fb5
ret 0x10

Function at 0x1002df09
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
push edi
cmp dword [ecx + 0x58], esi
je 0x1002df5c
push esi
push dword [ebp + 8]
call fcn.1002e0f3
mov edi, eax
test edi, edi
je 0x1002df57
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp + 0xc]
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x1002df57
mov eax, dword [ebp - 8]
jmp 0x1002df6e
mov eax, dword [ebp + 0x10]
jmp 0x1002df6e
push dword [ecx + 0x6c]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
pop edi
pop esi
leave
ret 0xc
Function at 0x1002df74
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10181e37
mov eax, dword fs:[0]
push eax
mov eax, 0x201c
call fcn.10155260
mov eax, dword [0x101e7000]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xor eax, eax
mov edx, dword [ebp + 0x10]
mov ebx, dword [ebp + 0x14]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x201c], edi
mov dword [ebp - 0x2024], edx
cmp dword [ecx + 0x58], eax
je 0x1002e0a5
push eax
push esi
call fcn.1002e0f3
mov esi, eax
test esi, esi
jne 0x1002dfdc
push ebx
jmp 0x1002e0ce
lea ecx, [ebp - 0x2014]
call fcn.10014dc0
xor ecx, ecx
lea eax, [ebp - 0x2018]
push eax
push ecx
lea eax, [ebp - 0x2020]
mov dword [ebp - 4], ecx
push eax
push ecx
push dword [ebp - 0x2024]
mov dword [ebp - 0x2020], ecx
push esi
mov dword [ebp - 0x2018], ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x201c], eax
test eax, eax
jne 0x1002e064
mov eax, dword [ebp - 0x2018]
lea ecx, [ebp - 0x2014]
shr eax, 1
push eax
call fcn.10015030
lea ecx, [ebp - 0x2018]
push ecx
push eax
lea eax, [ebp - 0x2020]
push eax
push 0
push dword [ebp - 0x2024]
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x2014]
mov dword [ebp - 0x201c], eax
call fcn.1001bc86
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x201c], 0
jne 0x1002e092
mov esi, dword [ebp - 0x2014]
add esi, 0xfffffff0
push esi
call fcn.100157f6
pop ecx
add eax, 0x10
mov ecx, esi
mov dword [edi], eax
call fcn.100146e0
jmp 0x1002e0d5
push ebx
mov ecx, edi
call fcn.100228ba
mov ecx, dword [ebp - 0x2014]
lea ecx, [ecx - 0x10]
jmp 0x1002e08b
push dword [ecx + 0x6c]
lea eax, [ebp - 0x2010]
test ebx, ebx
push 0x1000
push eax
mov eax, 0x101916b0
cmovne eax, ebx
push eax
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x2010]
push eax
mov ecx, edi
call fcn.100228ba
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10154fa7
leave
ret 0x10