joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1813e6d6
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov byte [ebp - 4], dl
push 1
lea edx, [ebp - 4]
mov ecx, dword [esi]
not ecx
call fcn.18138fce
mov ecx, dword [esi + 8]
lea edx, [ebp - 4]
not eax
not ecx
mov dword [esi], eax
movzx eax, al
add eax, dword [esi + 4]
imul eax, eax, 0x8088405
push 1
inc eax
mov dword [esi + 4], eax
shr eax, 0x18
mov byte [ebp - 4], al
call fcn.18138fce
pop ecx
not eax
pop ecx
mov dword [esi + 8], eax
pop esi
leave
ret

Function at 0x1813e721
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov eax, edx
mov dword [ebp - 4], ecx
xor edx, edx
mov dword [ebp - 0xc], eax
push esi
push edi
mov edi, edx
mov dword [ebp - 8], edx
cmp dword [ebp + 0x10], edx
jb 0x1813e7b5
ja 0x1813e745
cmp dword [ebp + 0xc], edx
jbe 0x1813e7b5
test eax, eax
je 0x1813e793
mov eax, dword [ebp + 8]
mov bl, byte [edi + eax]
mov ax, word [ecx + 8]
mov dl, bl
or ax, 2
movzx esi, ax
call fcn.1813e6d6
mov eax, esi
mov ecx, esi
xor ecx, 1
imul ecx, eax
mov eax, dword [ebp - 0xc]
shr ecx, 8
xor cl, bl
mov byte [edi + eax], cl
add edi, 1
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
adc eax, 0
mov dword [ebp - 8], eax
cmp eax, dword [ebp + 0x10]
jb 0x1813e749
ja 0x1813e7b5
cmp edi, dword [ebp + 0xc]
jb 0x1813e749
jmp 0x1813e7b5
mov ebx, dword [ebp + 8]
mov esi, edx
mov dl, byte [esi + ebx]
call fcn.1813e6d6
mov ecx, dword [ebp - 4]
add esi, 1
adc edi, 0
cmp edi, dword [ebp + 0x10]
jb 0x1813e798
ja 0x1813e7b5
cmp esi, dword [ebp + 0xc]
jb 0x1813e798
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1813e81d
Capabilities:
Create new key via cryptacquirecontext
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0xf0000040
push 0x18
push 0
push 0
lea eax, [ebp - 4]
mov esi, ecx
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x1813e860
push esi
push 0xb
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x1813e860
push 0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
test eax, eax
je 0x1813e860
mov al, 1
jmp 0x1813e862
xor al, al
pop esi
leave
ret

Function at 0x1815a8f4
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x181764c0
push 0x181764b8
push str.FlsAlloc
push 0x1e
call fcn.1815a761
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1815a928
push dword [ebp + 8]
mov ecx, esi
call dword [0x18170908]
call esi
jmp 0x1815a92e
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1815a972
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x181764d0
push 0x181764c8
push str.FlsGetValue
push 0x20
call fcn.1815a761
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1815a9a9
push dword [ebp + 8]
mov ecx, esi
call dword [0x18170908]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x10003a61
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
jmp 0x1000c2af
mov ebp, esp
clc
cmp dh, 0xb6
sub esp, 0x20
push str.libcurl.dll
jmp loc.101e87ef

Function at 0x1000b3e0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov dword [ebp - 4], 0
lea eax, [ebp - 0x108]
push eax
push 0
push 0
mov ecx, dword [ebp + 0xc]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jne 0x1000b42a
lea edx, [ebp - 0x108]
push edx
mov ecx, dword [ebp + 8]
call fcn.10005530
mov eax, dword [ebp - 4]
or eax, 1
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
jmp 0x1000b461
push 0x100136e0
push 0x101bd338
push 0x101e37b0
call fcn.10013410
add esp, 8
mov ecx, eax
call fcn.10012210
push 0x101bc803
mov ecx, dword [ebp + 8]
call fcn.10005530
mov ecx, dword [ebp - 4]
or ecx, 1
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret

Function at 0x1000f927
Capabilities:
Allocate or change rwx memory
Connect socket
Execute shellcode via indirect call
Initialize winsock library
Receive data
Receive data on socket
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add ax, cx
sub esp, 0x1fc
mov dword [ebp - 0x10], 0
cmovle ax, dx
mov dword [ebp - 4], 0
lahf
mov al, 0xb4
lea eax, [ebp - 0x1fc]
jmp loc.101e940c
Function at 0x100117c0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 8], ecx
cmp dword [ebp + 0x10], 0
jg 0x100117e0
jl 0x100117d7
cmp dword [ebp + 0xc], 0
ja 0x100117e0
xor eax, eax
xor edx, edx
jmp 0x10011918
mov eax, dword [ebp - 8]
cmp dword [eax + 0x38], 0
je 0x10011802
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
call fcn.10004e80
jmp 0x10011918
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 8]
call fcn.10005b40
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jbe 0x10011872
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 4]
push edx
call fcn.10007240
add esp, 8
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 8]
call fcn.10005ca0
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.100063b0
add esp, 0xc
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0xc]
mov dword [ebp + 8], eax
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp - 0xc]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0xc]
push edx
mov ecx, dword [ebp - 8]
call fcn.10005c20
nop
mov eax, dword [ebp - 8]
cmp dword [eax + 0x4c], 0
je 0x10011909
mov ecx, dword [ebp - 8]
call fcn.100127c0
mov dword [ebp - 0x18], 0xfff
cmp dword [ebp - 4], 0xfff
jbe 0x100118e2
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x4c]
push edx
push 0xfff
push 1
mov eax, dword [ebp + 8]
push eax
call fcn.10159561
add esp, 0x10
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x10]
mov dword [ebp + 8], ecx
mov edx, dword [ebp - 4]
sub edx, dword [ebp - 0x10]
mov dword [ebp - 4], edx
cmp dword [ebp - 0x10], 0xfff
je 0x100118e0
xor eax, eax
mov ecx, dword [ebp - 0x20]
sub ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x1c]
sbb edx, eax
mov eax, ecx
jmp 0x10011918
jmp 0x1001188e
cmp dword [ebp - 4], 0
jbe 0x10011909
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x4c]
push eax
mov ecx, dword [ebp - 4]
push ecx
push 1
mov edx, dword [ebp + 8]
push edx
call fcn.10159561
add esp, 0x10
mov ecx, dword [ebp - 4]
sub ecx, eax
mov dword [ebp - 4], ecx
xor edx, edx
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x1c]
sbb ecx, edx
mov edx, ecx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x10016ea7
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x10016f00
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x10016f00
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, dword [ebp + 0x10]
lea ecx, [esi + eax]
and edx, 0xf
jbe 0x10016ef1
cmp esi, ecx
jae 0x10016f00
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edx, 1
jne 0x10016edf
cmp esi, ecx
jae 0x10016f00
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
jmp 0x10016f02
xor eax, eax
pop esi
pop ebp
ret
Function at 0x100176d3
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x18
mov eax, 0x101785b0
call fcn.1014f51b
mov eax, ecx
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp + 0x10]
xor edi, edi
mov esi, dword [ebp + 0x14]
push edi
mov dword [ebx], edi
mov dword [esi], edi
cmp dword [eax + 0x58], edi
je 0x1001777b
push dword [ebp + 8]
call fcn.100179f2
mov dword [ebp - 0x10], eax
test eax, eax
je 0x10017801
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], edi
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], edi
push ecx
push edi
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], edi
push ecx
push edi
push dword [ebp + 0xc]
mov dword [ebp - 0x14], edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp - 0x14]
mov dword [esi], ecx
test eax, eax
jne 0x10017764
push ecx
call fcn.1001945b
pop ecx
lea ecx, [ebp - 0x14]
mov dword [ebx], eax
push ecx
push eax
lea eax, [ebp - 0x18]
push eax
push edi
push dword [ebp + 0xc]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10017764
xor edi, edi
inc edi
jmp 0x1001776e
push dword [ebx]
call fcn.10014b8b
pop ecx
mov dword [ebx], edi
lea ecx, [ebp - 0x24]
call fcn.1001759a
jmp 0x100177ff
mov eax, dword [eax]
push dword [ebp + 0xc]
push dword [ebp + 8]
mov esi, dword [eax + 0x84]
lea eax, [ebp - 0x10]
push eax
mov ecx, esi
call dword [0x101879c8]
mov ecx, dword [ebp - 0x18]
call esi
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], 1
mov ecx, dword [eax - 0xc]
test ecx, ecx
je 0x100177f7
mov esi, dword [ebp + 0x14]
shr ecx, 1
push ecx
mov dword [esi], ecx
call fcn.1001945b
mov dword [ebx], eax
pop ecx
cmp dword [esi], edi
jbe 0x100177f1
lea esi, [edi + edi]
lea eax, [esi + 1]
push eax
lea ecx, [ebp - 0x10]
call fcn.10017576
push esi
lea ecx, [ebp - 0x10]
mov bl, al
call fcn.10017576
mov ecx, dword [ebp + 0x10]
shl bl, 4
sub bl, 0x51
add al, bl
mov ecx, dword [ecx]
mov byte [edi + ecx], al
inc edi
mov eax, dword [ebp + 0x14]
cmp edi, dword [eax]
jb 0x100177bf
mov eax, dword [ebp - 0x10]
xor edi, edi
inc edi
lea ecx, [eax - 0x10]
call fcn.10016a5f
mov eax, edi
call fcn.1014f4e9
ret 0x10

Function at 0x10017809
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
push edi
cmp dword [ecx + 0x58], esi
je 0x1001785c
push esi
push dword [ebp + 8]
call fcn.100179f2
mov edi, eax
test edi, edi
je 0x10017857
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp + 0xc]
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x10017857
mov eax, dword [ebp - 8]
jmp 0x1001786e
mov eax, dword [ebp + 0x10]
jmp 0x1001786e
push dword [ecx + 0x6c]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
pop edi
pop esi
leave
ret 0xc
Function at 0x10017874
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101785dd
mov eax, dword fs:[0]
push eax
mov eax, 0x201c
call fcn.1014f6a0
mov eax, dword [0x101db000]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xor ebx, ebx
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x14]
mov dword [ebp - 0x201c], edi
mov dword [ebp - 0x2024], eax
cmp dword [ecx + 0x58], ebx
je 0x100179a5
push ebx
push edx
call fcn.100179f2
mov ebx, eax
test ebx, ebx
jne 0x100178dc
push esi
jmp 0x100179cd
lea ecx, [ebp - 0x2014]
call fcn.10015508
xor ecx, ecx
lea eax, [ebp - 0x2018]
push eax
push ecx
lea eax, [ebp - 0x2020]
mov dword [ebp - 4], ecx
push eax
push ecx
push dword [ebp - 0x2024]
mov dword [ebp - 0x2020], ecx
push ebx
mov dword [ebp - 0x2018], ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x201c], eax
test eax, eax
jne 0x10017964
mov eax, dword [ebp - 0x2018]
lea ecx, [ebp - 0x2014]
shr eax, 1
push eax
call fcn.1001669b
lea ecx, [ebp - 0x2018]
push ecx
push eax
lea eax, [ebp - 0x2020]
push eax
push 0
push dword [ebp - 0x2024]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x2014]
mov dword [ebp - 0x201c], eax
call fcn.10017b2e
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x201c], 0
jne 0x10017992
mov esi, dword [ebp - 0x2014]
add esi, 0xfffffff0
push esi
call fcn.10015d5a
pop ecx
add eax, 0x10
mov ecx, esi
mov dword [edi], eax
call fcn.10016a5f
jmp 0x100179d4
push esi
mov ecx, edi
call fcn.1001545e
mov ecx, dword [ebp - 0x2014]
lea ecx, [ecx - 0x10]
jmp 0x1001798b
test esi, esi
jne 0x100179ae
mov esi, 0x10187f00
push dword [ecx + 0x6c]
lea ecx, [ebp - 0x2010]
push 0x1000
push ecx
push esi
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x2010]
push eax
mov ecx, edi
call fcn.1001545e
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1014f4db
leave
ret 0x10
Function at 0x10017b8f
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov edi, ecx
xor esi, esi
cmp dword [edi + 0x58], esi
je 0x10017bdc
push esi
push dword [ebp + 8]
call fcn.100179f2
mov edi, eax
test edi, edi
je 0x10017c64
push dword [ebp + 0x14]
push ebx
push 3
push esi
push dword [ebp + 0xc]
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
sete al
jmp 0x10017c64
mov eax, dword [ebp + 0x14]
push 2
pop ecx
lea eax, [eax*2 + 1]
mul ecx
setb cl
movsx ecx, cl
neg ecx
or ecx, eax
push ecx
call fcn.1001945b
mov edx, dword [ebp + 0x14]
pop ecx
mov ecx, eax
mov dword [ebp - 8], ecx
test edx, edx
je 0x10017c36
mov dword [ebp - 4], 0x41
mov al, byte [ebx + esi]
and al, 0xf
movzx eax, al
add ax, word [ebp - 4]
mov word [ecx + esi*4], ax
mov al, byte [ebx + esi]
shr al, 4
movzx eax, al
add ax, word [ebp - 4]
mov word [ecx + esi*4 + 2], ax
inc esi
cmp esi, edx
jb 0x10017c0f
xor eax, eax
mov word [ecx + esi*4], ax
mov eax, dword [edi]
push ecx
push dword [ebp + 0xc]
mov esi, dword [eax + 0x88]
mov ecx, esi
push dword [ebp + 8]
call dword [0x101879c8]
mov ecx, edi
call esi
push dword [ebp - 8]
mov esi, eax
call fcn.10014b8b
pop ecx
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x1001a1e8
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push 0x10
mov eax, 0x101787f7
call fcn.1014f584
mov ebx, ecx
mov dword [ebp - 0x18], ebx
lea eax, [ebx + 0x1c]
push eax
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [ebp + 8]
test edi, edi
jle 0x1001a2df
cmp edi, dword [ebx + 0xc]
jge 0x1001a2df
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
je 0x1001a23f
cmp edi, dword [esi + 8]
jl 0x1001a2cd
cmp dword [ebp + 0xc], 0
je 0x1001a2cd
xor edi, edi
jmp 0x1001a271
xor edi, edi
push 0x10
mov dword [ebp - 4], edi
call fcn.10019dfa
mov esi, eax
test esi, esi
je 0x1001a259
mov dword [esi], vtable.CThreadData.0
jmp 0x1001a25b
mov esi, edi
or dword [ebp - 4], 0xffffffff
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0x14]
mov dword [esi + eax], ecx
mov dword [ebx + 0x14], esi
push 4
push dword [ebx + 0xc]
call fcn.10019d47
cmp dword [esi + 0xc], 0
pop ecx
pop ecx
jne 0x1001a28d
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
jmp 0x1001a299
push 2
push eax
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
mov edx, eax
test edx, edx
je 0x1001a306
mov ecx, dword [esi + 8]
mov dword [esi + 0xc], edx
mov eax, dword [ebx + 0xc]
sub eax, ecx
shl eax, 2
push eax
lea eax, [edx + ecx*4]
push edi
push eax
call fcn.101517c0
mov eax, dword [ebx + 0xc]
add esp, 0xc
mov dword [esi + 8], eax
push esi
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov edi, dword [ebp + 8]
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x1001a2df
cmp edi, dword [esi + 8]
jge 0x1001a2df
mov eax, dword [ebp + 0xc]
mov dword [ecx + edi*4], eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.1014f4e9
ret 8
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.100192c3
int3

Function at 0x1001c947
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
xor esi, esi
mov ebx, ecx
push edi
cmp dword [ebp + 8], esi
je 0x1001c986
call fcn.1001a6cd
push 0xf0
push dword [ebp + 8]
mov edi, dword [eax + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x1001c986
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x1001c98e
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
push esi
mov ecx, ebx
call fcn.1002b0ab
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x1001d3d3
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
je 0x1001d45f
cmp dword [esi + 0x20], 0
je 0x1001d45f
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1001d45f
cmp dword [ebp + 8], 0
je 0x1001d45f
xor edi, edi
mov ebx, edi
call fcn.1001a6cd
push 0x1018b580
push dword [ebp + 8]
mov eax, dword [eax + 0xc]
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 8], eax
test eax, eax
je 0x1001d443
mov ebx, dword [ebp - 4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp - 8]
mov edi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x1001d45f
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
push edi
push ebx
push esi
call fcn.1002bc0a
mov edi, eax
add esp, 0xc
test edi, edi
je 0x1001d45b
mov ecx, esi
call fcn.1001d171
mov eax, edi
jmp 0x1001d461
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x10021995
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x101784bd
call fcn.1014f51b
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x74], ebx
jne 0x100219bb
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x10021a15
lea ecx, [ebp - 0x10]
call fcn.10015508
mov edi, dword [edi + 0x74]
lea ecx, [ebp - 0x10]
push ecx
mov dword [ebp - 4], ebx
mov eax, dword [edi]
mov esi, dword [eax + 0x8c]
mov ecx, esi
call dword [0x101879c8]
mov ecx, edi
call esi
mov esi, dword [ebp + 8]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push esi
call fcn.1015a48d
push eax
call fcn.10015aa1
add esp, 0x14
test esi, esi
je 0x10021a08
push esi
call fcn.10159e20
pop ecx
mov ebx, eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.10016a5f
mov eax, ebx
call fcn.1014f4e9
ret 8
Function at 0x10023200
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x101db000]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x18], eax
mov eax, dword [0x101e14bc]
mov dword [ebp - 0x20], ebx
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x1c], edi
test eax, eax
jne 0x10023259
push 0x1018ab14
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1002327e
push str.GetThreadPreferredUILanguages
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_EncodePointer]
mov dword [0x101e14bc], eax
jmp 0x10023262
push eax
call dword [sym.imp.KERNEL32.dll_DecodePointer]
mov esi, eax
test esi, esi
je 0x1002327e
mov eax, dword [ebp - 0x18]
mov ecx, esi
push eax
push edi
push ebx
push dword [ebp + 8]
call dword [0x101879c8]
call esi
jmp 0x100233c0
and dword [ebx], 0
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx ebx, ax
lea eax, [ebp - 0x14]
push 7
push eax
push ebx
call fcn.10023679
lea eax, [ebp - 0x14]
push eax
call fcn.10159e20
mov esi, eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push dword [eax]
push edi
call fcn.1015a34a
mov eax, dword [ebp - 0x20]
lea edi, [esi + 1]
push 7
and ebx, 0x3ff
inc dword [eax]
lea eax, [ebp - 0x14]
push eax
push ebx
call fcn.10023679
lea eax, [ebp - 0x14]
push eax
call fcn.10159e20
lea esi, [eax + 1]
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
sub ecx, edi
push ecx
mov ecx, dword [ebp - 0x1c]
lea ecx, [ecx + edi*2]
push ecx
call fcn.1015a34a
mov eax, dword [ebp - 0x20]
add esp, 0x38
add edi, esi
inc dword [eax]
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
movzx ebx, ax
lea eax, [ebp - 0x14]
push 7
push eax
push ebx
call fcn.10023679
lea eax, [ebp - 0x14]
push eax
call fcn.10159e20
lea esi, [eax + 1]
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x1c]
sub ecx, edi
push ecx
lea ecx, [eax + edi*2]
push ecx
call fcn.1015a34a
mov eax, dword [ebp - 0x20]
add edi, esi
push 7
and ebx, 0x3ff
inc dword [eax]
lea eax, [ebp - 0x14]
push eax
push ebx
call fcn.10023679
lea eax, [ebp - 0x14]
push eax
call fcn.10159e20
lea esi, [eax + 1]
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x1c]
sub ecx, edi
push ecx
lea ecx, [eax + edi*2]
push ecx
call fcn.1015a34a
mov ebx, dword [ebp - 0x20]
lea eax, [ebp - 0x14]
push 7
push eax
add edi, esi
inc dword [ebx]
push 0x800
call fcn.10023679
add esp, 0x44
lea eax, [ebp - 0x14]
push eax
call fcn.10159e20
mov esi, eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x1c]
sub ecx, edi
push ecx
lea ecx, [eax + edi*2]
push ecx
call fcn.1015a34a
mov ecx, dword [ebp - 0x1c]
lea eax, [edi + esi]
add esp, 0x10
xor edx, edx
inc dword [ebx]
mov word [ecx + eax*2 + 2], dx
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1014f4db
leave
ret
Function at 0x100296ae
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, ecx
lea eax, [ebp - 4]
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x100296d8
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x100296de
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
pop esi
leave
ret
lea ecx, [esi + 0xc]
call fcn.10015a37
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push eax
call fcn.100302e2
int3

Function at 0x100299b9
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 0xc], 0
push esi
mov esi, ecx
jne 0x100299ca
xor eax, eax
jmp 0x100299e6
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100299eb
mov eax, dword [ebp - 4]
pop esi
leave
ret 8
lea ecx, [esi + 0xc]
call fcn.10015a37
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push eax
call fcn.100302e2
int3

Function at 0x10029a89
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, ecx
push 0
push dword [ebp + 0xc]
mov eax, dword [edi]
push dword [ebp + 8]
mov esi, dword [eax + 0x2c]
mov ecx, esi
call dword [0x101879c8]
mov ecx, edi
call esi
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x10029abc
pop edi
pop esi
pop ebp
ret 8
lea ecx, [edi + 0xc]
call fcn.10015a37
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push eax
call fcn.100302e2
int3

Function at 0x10029b95
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, ecx
test esi, esi
je 0x10029bc0
push 0
lea eax, [ebp - 4]
push eax
push esi
push dword [ebp + 8]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x10029bc6
cmp dword [ebp - 4], esi
jne 0x10029bdd
pop edi
pop esi
leave
ret 8
lea ecx, [edi + 0xc]
call fcn.10015a37
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push eax
call fcn.100302e2
lea ecx, [edi + 0xc]
call fcn.10015a37
push eax
push 0xffffffffffffffff
push 0xd
call fcn.1002ff38
int3