joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10019aa0
Capabilities:
Get system information on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1018b46b
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push esi
mov eax, dword [0x101f7004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x800000
mov dword [0x102007a0], 0x101d1d8c
mov dword [0x102007a8], 0x101d21e4
push 0
mov dword [ebp - 0x10], 0x102007a0
mov dword [0x102007bc], 1
mov dword [0x102007b8], 0x100
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x10019d2e
lea eax, [ecx + 0x800000]
mov dword [0x102007b4], ecx
mov dword [0x102007b0], eax
mov edx, 0x7fff
mov eax, dword [0x102007b8]
mov dword [0x102007ac], ecx
add eax, ecx
mov dword [ecx], eax
mov eax, dword [0x102007b8]
add ecx, eax
sub edx, 1
jne 0x10019b34
mov dword [ecx], edx
mov dword [ebp - 4], edx
mov dword [ebp - 0x14], 0x102007c0
mov dword [ebp - 0x18], 0x102007c0
mov dword [ebp - 0x1c], 0x102007c0
mov dword [0x102007c0], 0x101cfc38
mov dword [0x102007c4], edx
mov dword [0x102007c8], edx
mov byte [ebp - 4], 1
mov dword [0x102007c0], 0x101cfbd4
mov dword [0x102007cc], edx
mov dword [0x102007d4], edx
mov dword [0x102007d0], edx
mov dword [0x102007d8], 0x40
mov byte [ebp - 4], 2
mov dword [0x102007d8], 0x80
mov byte [ebp - 4], 5
mov dword [0x102007dc], edx
mov byte [ebp - 4], 6
mov esi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x102007f0
mov dword [ebp - 0x1c], 0x102007f0
call esi
mov byte [ebp - 4], 7
mov dword [0x10200808], 0
mov byte [ebp - 4], 8
push 0x10200814
mov dword [ebp - 0x1c], 0x10200814
call esi
mov byte [ebp - 4], 9
mov dword [0x1020082c], 0x3e8
mov dword [ebp - 0x18], 0x10200840
mov dword [ebp - 0x14], 0x10200840
mov dword [0x10200840], 0x101cfc38
mov dword [0x10200844], 0
mov dword [0x10200848], 0
mov byte [ebp - 4], 0xa
mov dword [0x10200840], 0x101cfbd4
mov dword [0x1020084c], 0
mov dword [0x10200854], 0
mov dword [0x10200850], 0
mov dword [0x10200858], 0x40
mov byte [ebp - 4], 0xb
mov dword [0x10200858], 0x80
mov byte [ebp - 4], 0xd
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x2c]
mov dword [0x10200834], 0x3e80
mov dword [0x10200838], 1
mov dword [0x1020083c], 0
lea eax, [eax*2 + 2]
mov dword [0x10200830], eax
mov byte [ebp - 4], 0xe
push 0x1020085c
call esi
mov byte [ebp - 4], 0xf
push ecx
mov ecx, 0x10200874
call fcn.10019400
mov byte [ebp - 4], 0x10
mov dword [0x102007e0], 0
mov dword [0x1020089c], 0
movsd xmm0, qword [0x101d2f18]
movsd qword [0x102007e8], xmm0
xorps xmm0, xmm0
mov dword [0x102008a0], 0
mov dword [0x102008a4], 0
mov dword [0x102007e4], 0
movq qword [0x1020080c], xmm0
mov dword [ebp - 4], 0xffffffff
mov eax, 0x102007a0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1016f37b
int3
Function at 0x1001a7f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
mov dword [esi + 0x14], 0
test ebx, ebx
jne 0x1001a812
pop esi
lea eax, [ebx + 1]
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ecx]
push edi
xor edi, edi
call dword [eax]
mov ecx, eax
movzx eax, bx
push 0xa
push eax
push ecx
mov dword [ebp + 0xc], ecx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp + 8], eax
test eax, eax
je 0x1001a8e7
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
test eax, eax
je 0x1001a8e7
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x1001a8de
push dword [ebp + 8]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov dword [esi + 0x14], 0
cmp dword [esi + 0x10], edi
jl 0x1001a8c2
cmp edi, 1
jne 0x1001a887
mov eax, dword [esi + 0xc]
mov cl, byte [ebx]
mov byte [eax], cl
inc dword [esi + 0x14]
jmp 0x1001a8d9
cmp edi, 2
jne 0x1001a89a
mov eax, dword [esi + 0xc]
movzx ecx, word [ebx]
mov word [eax], cx
add dword [esi + 0x14], edi
jmp 0x1001a8d9
cmp edi, 4
jne 0x1001a8ab
mov eax, dword [esi + 0xc]
mov ecx, dword [ebx]
mov dword [eax], ecx
add dword [esi + 0x14], edi
jmp 0x1001a8d9
cmp edi, 8
jne 0x1001a8c2
mov eax, dword [esi + 0xc]
mov ecx, dword [ebx]
mov edx, dword [ebx + 4]
mov dword [eax], ecx
mov dword [eax + 4], edx
add dword [esi + 0x14], edi
jmp 0x1001a8d9
test edi, edi
jle 0x1001a8d9
push edi
mov ecx, esi
call fcn.1001c800
push edi
push ebx
push eax
call fcn.1016a0f0
add esp, 0xc
mov edi, 1
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1001ac20
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp esi, dword [0x102007b8]
jg 0x1001ac5b
push 0x102007bc
call fcn.1001cfa0
mov ecx, dword [0x102007b4]
add esp, 4
test ecx, ecx
je 0x1001ac4d
mov eax, dword [ecx]
mov dword [0x102007b4], eax
mov dword [0x102007bc], 1
test ecx, ecx
jne 0x1001ac71
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x1001ac78
mov eax, ecx
pop esi
pop ebp
ret 4
push 0xffffffffffffffff
call fcn.1016f37b
int3

Function at 0x1001ace0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp esi, dword [0x102007ac]
jb 0x1001ad54
cmp esi, dword [0x102007b0]
jae 0x1001ad54
mov eax, dword [ebp + 0xc]
cmp eax, dword [0x102007b8]
jle 0x1001ad69
push edi
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x1001ad6d
push dword [0x102007b8]
push esi
push edi
call fcn.1016a0f0
push 0x102007bc
call fcn.1001cfa0
mov eax, dword [0x102007b4]
add esp, 0x10
mov dword [esi], eax
mov dword [0x102007b4], esi
mov esi, edi
mov dword [0x102007bc], 1
pop edi
mov eax, esi
pop esi
pop ebp
ret 8
push dword [ebp + 0xc]
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov esi, eax
test esi, esi
jne 0x1001ad4d
push 0xffffffffffffffff
call fcn.1016f37b
int3

Function at 0x1001b7c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101870cd
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push ebx
push esi
mov eax, dword [0x101f7004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, ecx
test edx, edx
je 0x1001b891
cmp word [edx], 0
je 0x1001b891
lea ecx, [ebp - 0x38]
call fcn.10002cf0
mov dword [ebp - 4], 0
cmp word [edx], 0
je 0x1001b860
cmp word [edx + 2], 0
je 0x1001b860
mov ecx, edx
lea esi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1001b820
sub ecx, esi
sar ecx, 1
cmp word [edx + ecx*2 - 2], 0x5c
jne 0x1001b860
cmp word [edx + ecx*2 - 4], 0x3a
je 0x1001b860
lea eax, [ecx - 1]
push eax
push edx
lea ecx, [ebp - 0x38]
call fcn.1001db30
mov edx, dword [ebp - 0x2c]
test edx, edx
jne 0x1001b860
cmp dword [ebp - 0x14], 0
mov edx, 0x101cd86c
cmovne edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ebx, ebx
cmp eax, 0xffffffff
setne bl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.100022c0
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001b8b0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1018b6fd
mov eax, dword fs:[0]
push eax
sub esp, 0x70
push esi
mov eax, dword [0x101f7004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
test esi, esi
je 0x1001ba20
cmp word [esi], 0
je 0x1001ba20
push 0x44
lea eax, [ebp - 0x7c]
push 0
push eax
call fcn.1016abf0
or dword [ebp - 0x50], 1
mov eax, 1
mov dword [ebp - 0x38], 0x101cfc20
add esp, 0xc
mov dword [ebp - 0x7c], 0x44
mov word [ebp - 0x4c], ax
mov dword [ebp - 0x38], vtable.CVolObject.0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x38], vtable.CVolMem.0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x20], 0x40
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x38]
push esi
call fcn.1001c8b0
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
cmp dword [ebp - 0x24], ecx
cmove eax, ecx
lea ecx, [ebp - 0x1c]
push ecx
lea ecx, [ebp - 0x7c]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x1001b990
xor esi, esi
jmp 0x1001b9b0
push 0xffffffffffffffff
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x1c]
call esi
mov esi, 1
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x38], vtable.CVolMem.0
mov dword [ebp - 4], 3
mov ecx, dword [ebp - 0x2c]
test ecx, ecx
je 0x1001b9eb
mov eax, dword [ebp - 0x38]
push ecx
mov eax, dword [eax + 0xc]
cmp eax, method.CWString.virtual_12
jne 0x1001b9e6
mov ecx, 0x102007a8
call fcn.1001d170
jmp 0x1001b9eb
lea ecx, [ebp - 0x38]
call eax
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov dword [ebp - 0x38], vtable.CVolObject.0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1001e8f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov eax, edi
shr eax, 4
inc eax
push 6
movzx eax, ax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp + 0xc], eax
test eax, eax
jne 0x1001e919
pop edi
pop ebx
pop ebp
ret
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x1001e92f
xor esi, esi
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x1001e926
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [esi + eax]
and edi, 0xf
jbe 0x1001e962
nop
cmp esi, ecx
jae 0x1001e926
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edi, 1
jne 0x1001e950
cmp esi, ecx
jae 0x1001e926
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x1001edf0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
movzx eax, word [ebp + 8]
mov dword [ebp + 8], eax
pop ebp
jmp fcn.10036494
Function at 0x100228d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
push edi
call fcn.10038bb1
mov esi, eax
mov dword [ebp - 4], esi
test esi, esi
je 0x100229d1
mov eax, edi
shr eax, 4
inc eax
push 6
movzx eax, ax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp + 8], eax
test eax, eax
je 0x100229d1
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x100229d1
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x100229d1
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [esi + eax]
and edi, 0xf
jbe 0x10022958
cmp esi, ecx
jae 0x100229d1
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edi, 1
jne 0x10022942
cmp esi, ecx
jae 0x100229d1
movzx eax, word [esi]
test ax, ax
je 0x100229d1
mov edx, dword [ebx]
mov edi, eax
mov dword [ebp + 8], eax
mov ecx, 1
mov eax, dword [edx - 8]
sub ecx, dword [edx - 4]
sub eax, edi
or ecx, eax
jge 0x1002298b
push edi
mov ecx, ebx
call fcn.10013970
mov edx, dword [ebx]
movzx eax, word [esi]
jmp 0x1002298e
mov eax, dword [ebp + 8]
movzx ecx, ax
lea eax, [esi + 2]
push ecx
push eax
push edi
push edx
call fcn.101752b1
add esp, 0x10
cmp eax, 0x50
ja case.0x100229ac.1
movzx eax, byte [eax + 0x10022a00]
jmp dword [eax*4 + 0x100229f0]
mov eax, dword [ebx]
cmp edi, dword [eax - 8]
jg 0x100229e1
mov dword [eax - 0xc], edi
xor ecx, ecx
mov eax, dword [ebx]
mov word [eax + edi*2], cx
lea eax, [ecx + 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
call fcn.1002c0d4
push 0x80070057
call fcn.10013a60
call fcn.1002c0ba
mov bl, 0x29
add dl, byte [eax]
fsubr qword [ecx]
add dl, byte [eax]
jmp 0x10022a23
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [eax]
int3
Function at 0x10022db0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
mov ebx, ecx
xor cl, cl
test eax, eax
je 0x10022eba
test eax, 0xffff0000
jne 0x10022eba
push esi
push edi
movzx edi, ax
push edi
call fcn.10038bb1
mov esi, eax
mov dword [ebp - 4], esi
test esi, esi
je 0x10022eb6
mov eax, edi
shr eax, 4
push 6
inc eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp + 8], eax
test eax, eax
je 0x10022eb6
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x10022eb6
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x10022eb6
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [esi + eax]
and edi, 0xf
jbe 0x10022e49
cmp esi, ecx
jae 0x10022eb6
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edi, 1
jne 0x10022e37
cmp esi, ecx
jae 0x10022eb6
movzx eax, word [esi]
test ax, ax
je 0x10022eb6
mov edx, dword [ebx]
mov edi, eax
mov dword [ebp + 8], eax
mov ecx, 1
mov eax, dword [edx - 8]
sub ecx, dword [edx - 4]
sub eax, edi
or ecx, eax
jge 0x10022e7c
push edi
mov ecx, ebx
call fcn.10013970
mov edx, dword [ebx]
movzx eax, word [esi]
jmp 0x10022e7f
mov eax, dword [ebp + 8]
movzx ecx, ax
lea eax, [esi + 2]
push ecx
push eax
push edi
push edx
call fcn.101752b1
add esp, 0x10
cmp eax, 0x50
ja case.0x10022e9d.1
movzx eax, byte [eax + 0x10022ee8]
jmp dword [eax*4 + 0x10022ed8]
mov eax, dword [ebx]
cmp edi, dword [eax - 8]
jg 0x10022ecd
mov dword [eax - 0xc], edi
xor ecx, ecx
mov eax, dword [ebx]
mov word [eax + edi*2], cx
pop edi
mov cl, 1
pop esi
mov al, cl
pop ebx
mov esp, ebp
pop ebp
ret 4
call fcn.1002c0ba
call fcn.1002c0d4
push 0x80070057
call fcn.10013a60
nop
movsb byte es:[edi], byte [esi]
add dl, byte cs:[eax]
enter 0x22e, 0x10
ret
Function at 0x10022f40
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
mov edi, dword [ebp + 0xc]
mov eax, edi
shr eax, 4
inc eax
push 6
movzx eax, ax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp + 0xc], eax
test eax, eax
je 0x1002302e
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x1002302e
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x1002302e
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [esi + eax]
and edi, 0xf
jbe 0x10022fb7
cmp esi, ecx
jae 0x1002302e
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edi, 1
jne 0x10022fa1
cmp esi, ecx
jae 0x1002302e
movzx eax, word [esi]
test ax, ax
je 0x1002302e
mov edx, dword [ebx]
mov edi, eax
mov dword [ebp + 8], eax
mov ecx, 1
mov eax, dword [edx - 8]
sub ecx, dword [edx - 4]
sub eax, edi
or ecx, eax
jge 0x10022fea
push edi
mov ecx, ebx
call fcn.10013970
mov edx, dword [ebx]
movzx eax, word [esi]
jmp 0x10022fed
mov eax, dword [ebp + 8]
movzx ecx, ax
lea eax, [esi + 2]
push ecx
push eax
push edi
push edx
call fcn.101752b1
add esp, 0x10
cmp eax, 0x50
ja case.0x1002300b.1
movzx eax, byte [eax + 0x1002305c]
jmp dword [eax*4 + 0x1002304c]
mov ecx, dword [ebx]
cmp edi, dword [ecx - 8]
jg 0x1002303c
mov dword [ecx - 0xc], edi
xor edx, edx
mov ecx, dword [ebx]
lea eax, [edx + 1]
mov word [ecx + edi*2], dx
pop edi
pop esi
pop ebx
pop ebp
ret 8
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 8
call fcn.1002c0d4
push 0x80070057
call fcn.10013a60
call fcn.1002c0ba
nop
adc dh, byte [eax]
add dl, byte [eax]
aaa
xor byte [edx], al
adc byte [esi + 0x30], al
add dl, byte [eax]
inc esi
xor byte [edx], al
adc byte [eax], al
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ecx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [edx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [edx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [eax]
int3
Function at 0x100261a4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
xor esi, esi
mov ebx, ecx
push edi
cmp dword [ebp + 8], esi
je 0x100261e3
call fcn.1002f6f2
push 0xf0
push dword [ebp + 8]
mov edi, dword [eax + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x100261e3
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x100261eb
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
push esi
mov ecx, ebx
call fcn.1003990d
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x10026c2e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
je 0x10026cba
cmp dword [esi + 0x20], 0
je 0x10026cba
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x10026cba
cmp dword [ebp + 8], 0
je 0x10026cba
xor edi, edi
mov ebx, edi
call fcn.1002f6f2
push str.AFX_DIALOG_LAYOUT
push dword [ebp + 8]
mov eax, dword [eax + 0xc]
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 8], eax
test eax, eax
je 0x10026c9e
mov ebx, dword [ebp - 4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp - 8]
mov edi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x10026cba
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
push edi
push ebx
push esi
call fcn.1003f625
mov edi, eax
add esp, 0xc
test edi, edi
je 0x10026cb6
mov ecx, esi
call fcn.100269d0
mov eax, edi
jmp 0x10026cbc
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x1002e4fe
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x1018c30b
call fcn.101687b1
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x74], ebx
jne 0x1002e524
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x1002e584
call fcn.1002c5b4
push eax
lea ecx, [ebp - 0x10]
call fcn.10013650
mov edi, dword [edi + 0x74]
lea ecx, [ebp - 0x10]
push ecx
mov dword [ebp - 4], ebx
mov eax, dword [edi]
mov esi, dword [eax + 0x8c]
mov ecx, esi
call dword [0x1019ba8c]
mov ecx, edi
call esi
mov esi, dword [ebp + 8]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push esi
call fcn.10175524
push eax
call fcn.1001e860
add esp, 0x14
test esi, esi
je 0x1002e577
push esi
call fcn.10174fd9
pop ecx
mov ebx, eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.10013840
mov eax, ebx
call fcn.1016877a
ret 8

Function at 0x10032b1e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
xor esi, esi
mov eax, ecx
push edi
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], esi
je 0x10032b63
call fcn.1002f6f2
push 0xf0
push dword [ebp + 0xc]
mov edi, dword [eax + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x10032b60
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x10032ba8
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
mov eax, dword [ebp - 4]
mov edi, dword [ebp + 8]
push ebx
xor ebx, ebx
inc ebx
test esi, esi
je 0x10032b87
mov ecx, dword [eax]
push dword [ebp + 0x10]
push esi
mov esi, dword [ecx + 0x20]
mov ecx, esi
push edi
call dword [0x1019ba8c]
mov ecx, dword [ebp - 4]
call esi
mov ebx, eax
mov edi, dword [edi + 0x70]
test edi, edi
je 0x10032ba5
mov edx, dword [edi]
push dword [ebp + 0x10]
mov esi, dword [edx + 0xa0]
mov ecx, esi
call dword [0x1019ba8c]
mov ecx, edi
call esi
mov eax, ebx
pop ebx
pop edi
pop esi
leave
ret 0xc

Function at 0x10033e2f
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
push edi
cmp dword [ecx + 0x58], esi
je 0x10033e82
push esi
push dword [ebp + 8]
call fcn.1003401e
mov edi, eax
test edi, edi
je 0x10033e7d
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp + 0xc]
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x10033e7d
mov eax, dword [ebp - 8]
jmp 0x10033e94
mov eax, dword [ebp + 0x10]
jmp 0x10033e94
push dword [ecx + 0x6c]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
pop edi
pop esi
leave
ret 0xc