joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100695b1
Capabilities:
Parse url

Disassembly:
push 0x14
push 0x1009ec98
call fcn.10038208
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x100695ce
mov ebx, dword [eax]
jmp 0x100695d1
xor ebx, ebx
inc ebx
xor esi, esi
push 0x3c
push esi
mov edi, dword [ebp + 0x10]
push edi
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [edi], 0x3c
or dword [edi + 0xc], 0xffffffff
mov dword [edi + 0x14], 1
test ebx, ebx
je 0x10069685
mov dword [ebp - 4], esi
push edi
push esi
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], 0xfffffffe
cmp eax, 1
je 0x10069685
test byte [0x100a4750], 2
je 0x1006964a
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x10069636
movzx eax, ax
or eax, 0x80070000
push 0x28d
mov edx, 0x1000bdf0
mov ecx, eax
call fcn.10051341
pop ecx
jmp 0x10069650
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, 0x80070057
jmp 0x10069685
mov eax, esi
call fcn.1003824d
ret

Function at 0x10069ac1
Capabilities:
Delete registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x100a2bb4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
xor edx, edx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, ecx
push edx
push edx
push edx
push edx
lea ecx, [ebp - 0x214]
mov dword [ebp - 0x214], 0x105
push ecx
lea ecx, [ebp - 0x210]
push ecx
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0x103
jne 0x10069b16
push edi
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.10037870
mov esp, ebp
pop ebp
ret 8

Function at 0x10069cb6
Capabilities:
Delete registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100a2bb4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
mov edi, ecx
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, bx
jne 0x10069cd5
sub esi, ecx
sar esi, 1
inc esi
lea eax, [esi + esi]
call fcn.10038910
mov ecx, esp
mov edx, esi
push dword [ebp + 8]
mov dword [ebp - 0xc], ecx
call fcn.1002706a
mov esi, eax
cmp dword [edi], ebx
je 0x10069d4f
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.1006a547
test eax, eax
je 0x10069d4f
lea eax, [ebp - 8]
mov ecx, edi
push eax
push dword [ebp - 0x10]
call fcn.1006a463
mov esi, eax
test esi, esi
jne 0x10069d4f
push dword [ebp - 0xc]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov esi, eax
test esi, esi
jne 0x10069d46
push dword [ebp - 0x10]
mov ecx, edi
push dword [ebp - 8]
call fcn.10069ac1
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test byte [0x100a4750], 2
je 0x10069d70
mov ecx, dword [0x100aa0f4]
mov edx, 0x56c09
push esi
push 0x1000bf60
call fcn.1005682f
mov esi, eax
mov eax, esi
lea esp, [ebp - 0x1c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10037870
mov esp, ebp
pop ebp
ret 4
Function at 0x10069d88
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x628
mov eax, dword [0x100a2bb4]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
mov eax, ecx
xor ebx, ebx
push edi
mov edi, dword [ebp + 8]
mov ecx, 0x180
mov dword [ebp - 0x618], ecx
mov dword [ebp - 0x610], ecx
lea ecx, [ebp - 0x628]
push ecx
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x618]
mov dword [edi], ebx
push ecx
lea ecx, [ebp - 0x30c]
mov dword [ebp - 0x620], eax
push ecx
push ebx
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov dword [ebp - 0x61c], ebx
jmp 0x10069ea8
mov ecx, dword [ebp - 0x620]
lea eax, [ebp - 0x614]
push eax
lea eax, [ebp - 0x30c]
push eax
call fcn.1006a463
mov esi, eax
test esi, esi
jne 0x10069eb4
xor ecx, ecx
lea eax, [ebp - 0x610]
push ecx
push ecx
push ecx
push ecx
push eax
lea eax, [ebp - 0x60c]
push eax
push ecx
jmp 0x10069e3c
inc ebx
xor eax, eax
push eax
push eax
push eax
push eax
lea eax, [ebp - 0x610]
push eax
lea eax, [ebp - 0x60c]
push eax
push ebx
push dword [ebp - 0x614]
mov dword [ebp - 0x610], 0x180
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov esi, eax
test esi, esi
je 0x10069e26
push dword [ebp - 0x614]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, 0x103
jne 0x10069ec2
add dword [edi], ebx
lea ecx, [ebp - 0x618]
mov eax, dword [ebp - 0x61c]
xor ebx, ebx
push ebx
push ebx
push ebx
push ebx
push ecx
inc eax
mov dword [ebp - 0x618], 0x180
lea ecx, [ebp - 0x30c]
mov dword [ebp - 0x61c], eax
push ecx
push eax
mov eax, dword [ebp - 0x620]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov esi, eax
test esi, esi
je 0x10069dec
jmp 0x10069eb6
xor ebx, ebx
cmp esi, 0x103
jne 0x10069ec2
mov esi, ebx
jmp 0x10069ec5
and dword [edi], 0
test byte [0x100a4750], 2
je 0x10069ee6
mov ecx, dword [0x100aa0f4]
mov edx, 0x70009
push esi
push 0x1000bfb0
call fcn.1005682f
mov esi, eax
mov ecx, dword [ebp - 8]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10037870
mov esp, ebp
pop ebp
ret 4
Function at 0x10069efb
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x4d8
mov eax, dword [0x100a2bb4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, ecx
mov dword [ebp - 0x4bc], 1
mov ecx, dword [ebp + 8]
xor edx, edx
push ebx
mov dword [ebp - 0x4d0], ecx
mov ebx, edx
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x4cc], ecx
mov ecx, 0x10e
mov dword [ebp - 0x4b4], ecx
mov dword [ebp - 0x4a8], ecx
lea ecx, [ebp - 0x4d8]
push ecx
push edx
push edx
push edx
lea ecx, [ebp - 0x4b4]
mov dword [ebp - 0x4c8], eax
push ecx
lea ecx, [ebp - 0x280]
mov dword [ebp - 0x4c0], edi
push ecx
mov dword [ebp - 0x4c4], edx
mov dword [ebp - 0x4ac], ebx
mov dword [ebp - 0x4a4], 0x52
push edx
jmp 0x1006a126
cmp ebx, dword [edi]
jae 0x1006a138
mov ecx, dword [ebp - 0x4c8]
lea eax, [ebp - 0x4b0]
and dword [ebp - 0x4b8], 0
push eax
lea eax, [ebp - 0x280]
push eax
call fcn.1006a463
mov esi, eax
test esi, esi
jne 0x1006a138
lea eax, [ebp - 0x4a4]
mov dword [ebp - 0x4a8], 0x10e
push eax
lea eax, [ebp - 0x60]
mov dword [ebp - 0x4a4], 0x52
push eax
lea eax, [ebp - 0x4bc]
push eax
push esi
lea eax, [ebp - 0x4a8]
push eax
lea eax, [ebp - 0x4a0]
push eax
push esi
push dword [ebp - 0x4b0]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov esi, eax
xor eax, eax
mov word [ebp - 0x10], ax
test esi, esi
jne 0x1006a0da
mov edi, ebx
imul ebx, ebx, 0x300
shl edi, 4
add edi, dword [ebp - 0x4cc]
add ebx, dword [ebp - 0x4d0]
lea eax, [ebp - 0x4a0]
push eax
lea eax, [ebp - 0x280]
push eax
push 0x1000c008
push 0x180
push ebx
call fcn.10032cbe
push ebx
call dword [sym.imp.msvcrt.dll__wcslwr]
mov esi, dword [ebp - 0x4b8]
lea eax, [ebp - 0x60]
add esp, 0x18
inc esi
mov dword [ebp - 0x4b8], esi
push edi
push eax
call dword [sym.imp.ole32.dll_CLSIDFromString]
test eax, eax
je 0x1006a072
mov eax, dword [ebp - 0x4c0]
dec dword [eax]
jmp 0x1006a081
inc dword [ebp - 0x4ac]
add ebx, 0x300
add edi, 0x10
lea eax, [ebp - 0x4a4]
mov dword [ebp - 0x4a8], 0x10e
push eax
lea eax, [ebp - 0x60]
mov dword [ebp - 0x4a4], 0x52
push eax
lea eax, [ebp - 0x4bc]
push eax
push 0
lea eax, [ebp - 0x4a8]
push eax
lea eax, [ebp - 0x4a0]
push eax
push esi
push dword [ebp - 0x4b0]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov esi, eax
test esi, esi
je 0x1006a024
mov ebx, dword [ebp - 0x4ac]
mov edi, dword [ebp - 0x4c0]
push dword [ebp - 0x4b0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, 0x103
jne 0x1006a138
mov eax, dword [ebp - 0x4c4]
lea ecx, [ebp - 0x4d8]
push ecx
inc eax
mov dword [ebp - 0x4b4], 0x10e
xor ecx, ecx
mov dword [ebp - 0x4c4], eax
push ecx
push ecx
push ecx
lea ecx, [ebp - 0x4b4]
push ecx
lea ecx, [ebp - 0x280]
push ecx
push eax
mov eax, dword [ebp - 0x4c8]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov esi, eax
test esi, esi
je 0x10069f89
lea eax, [esi - 0x103]
neg eax
sbb eax, eax
and eax, esi
test byte [0x100a4750], 2
je 0x1006a163
mov ecx, dword [0x100aa0f4]
mov edx, 0x8f409
push eax
push 0x1000c018
call fcn.1005682f
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10037870
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1006a176
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x36c
mov eax, dword [0x100a2bb4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
mov ecx, ebx
push esi
push edi
push 2
mov dword [ebp - 0x36c], eax
lea edx, [ecx + 2]
pop edi
xor esi, esi
mov ax, word [ecx]
add ecx, edi
cmp ax, si
jne 0x1006a1a4
sub ecx, edx
mov dword [ebp - 0x35c], esi
sar ecx, 1
lea edi, [ecx + 1]
cmp edi, 0x200
ja 0x1006a1cf
lea eax, [edi + edi]
call fcn.10038910
mov ecx, esp
jmp 0x1006a1fe
push 2
xor ecx, ecx
mov eax, edi
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
push 0x1300000
push dword [0x100a3570]
call dword [sym.imp.MSDART.DLL_MpHeapAlloc]
mov esi, eax
add esp, 0xc
mov dword [ebp - 0x35c], esi
mov ecx, esi
mov dword [ebp - 0x360], ecx
test ecx, ecx
jne 0x1006a243
mov eax, dword [0x100a4750]
mov edi, 0x8007000e
test al, 2
je 0x1006a37a
push 0x252
mov edx, 0x1000c070
mov ecx, edi
call fcn.10051341
mov eax, dword [0x100a4750]
pop ecx
test al, 2
je 0x1006a37a
mov edx, 0x94809
jmp 0x1006a361
and dword [ebp - 0x358], 0
mov edx, edi
push ebx
call fcn.1002706a
mov edi, eax
lea eax, [ebp - 0x364]
push eax
lea eax, [ebp - 0x360]
push eax
call fcn.1006a547
test eax, eax
je 0x1006a353
mov ecx, dword [ebp - 0x364]
xor ebx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x1006a27a
sub ecx, edx
sar ecx, 1
lea eax, [ecx + 0x1a]
mov ecx, 0x180
cmp eax, ecx
jb 0x1006a2be
test byte [0x100a4750], 2
mov edi, 0x80070057
je 0x1006a37a
push 0x262
mov edx, 0x1000c070
mov ecx, edi
call fcn.10051341
pop ecx
jmp 0x1006a37a
push 0x1000c11c
push dword [ebp - 0x364]
lea eax, [ebp - 0x354]
push 0x1000c12c
push 0x1000c154
push ecx
push eax
call fcn.10032cbe
add esp, 0x18
lea eax, [ebp - 0x358]
push eax
push 1
push ebx
lea eax, [ebp - 0x354]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test edi, edi
jne 0x1006a353
lea eax, [ebp - 0x368]
mov dword [ebp - 0x368], 0x4e
push eax
lea eax, [ebp - 0x54]
push eax
push ebx
push ebx
push 0x10004420
push dword [ebp - 0x358]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test edi, edi
jne 0x1006a347
push 0x27
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x36c]
call dword [sym.imp.ole32.dll_StringFromGUID2]
mov edi, eax
push dword [ebp - 0x358]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test byte [0x100a4750], 2
je 0x1006a37a
mov edx, 0xa2409
mov ecx, dword [0x100aa0f4]
push edi
push 0x1000c0c8
call fcn.1005682f
mov esi, dword [ebp - 0x35c]
mov edi, eax
test esi, esi
je 0x1006a38d
push esi
push dword [0x100a3570]
call dword [sym.imp.MSDART.DLL_MpHeapFree]
pop ecx
pop ecx
mov eax, edi
lea esp, [ebp - 0x378]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10037870
mov esp, ebp
pop ebp
ret 8
Function at 0x1006a580
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x100a2bb4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
xor edx, edx
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ebx
mov dword [ebp - 0x64], eax
push edi
mov edi, ecx
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, dx
jne 0x1006a5a7
sub esi, ecx
sar esi, 1
inc esi
lea eax, [esi + esi]
call fcn.10038910
mov ecx, esp
mov edx, esi
push ebx
mov dword [ebp - 0x58], ecx
call fcn.1002706a
cmp dword [edi], 0
mov esi, eax
je 0x1006a62b
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.1006a547
test eax, eax
je 0x1006a62b
lea eax, [ebp - 0x68]
mov ecx, edi
push eax
lea eax, [ebp - 0x5c]
push eax
push dword [ebp - 0x60]
call fcn.10069b28
mov esi, eax
test esi, esi
jne 0x1006a62b
push 0x27
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x64]
call dword [sym.imp.ole32.dll_StringFromGUID2]
push 0x4e
lea eax, [ebp - 0x54]
push eax
push 1
push esi
push dword [ebp - 0x58]
push dword [ebp - 0x5c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x5c]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test byte [0x100a4750], 2
je 0x1006a64c
mov ecx, dword [0x100aa0f4]
mov edx, 0x4d009
push esi
push 0x1000bf10
call fcn.1005682f
mov esi, eax
mov eax, esi
lea esp, [ebp - 0x74]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10037870
mov esp, ebp
pop ebp
ret 8

Function at 0x1006fda7
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
xor esi, esi
lea eax, [ebp - 4]
push eax
push 0x10006e4c
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
call dword [sym.imp.ole32.dll_StringFromCLSID]
test eax, eax
js 0x1006fe21
push ecx
push 0x10004420
push SysReAllocString
lea ecx, [ebp - 0x1c]
call fcn.100271aa
push ecx
push dword [ebp - 4]
lea ecx, [ebp - 0x1c]
push dword [ebp - 0x1c]
call fcn.100271aa
test eax, eax
jne 0x1006fe3f
lea eax, [ebp - 0xc]
mov dword [ebp - 0x10], esi
push eax
lea eax, [ebp - 8]
mov dword [ebp - 0xc], 4
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push 0x1000efa4
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
jmp 0x1006fe3f
test byte [0x100a4750], 2
je 0x1006fe3f
push 0x6a4
mov edx, 0x1000efb0
mov ecx, 0x80004005
call fcn.10051341
pop ecx
push dword [ebp - 4]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov esi, dword [ebp - 8]
lea ecx, [ebp - 0x1c]
call fcn.100271eb
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1007221b
Capabilities:
Get file size

Disassembly:
push 0xc
mov eax, 0x1003a8f3
call fcn.10037f34
xor esi, esi
push esi
push 0x80
push 3
push esi
push 1
push SysReAllocString
push ecx
mov dword [ebp - 0x18], esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x1007229c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push 0x1009ded8
push eax
call sub.msvcrt.dll__CxxThrowException
test byte [0x100a4750], 2
je 0x10072291
xor esi, esi
cmp dword [0x100aa41c], esi
je 0x10072291
push esi
push dword [0x100aa41c]
push 0x4e800
push dword [0x100aa108]
call fcn.10056748
add esp, 0x10
mov eax, 0x10072297
ret
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
test eax, eax
jne 0x100722ab
xor esi, esi
inc esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
call fcn.10037e99
ret
Function at 0x100752ba
Capabilities:
Get graphical window text

Disassembly:
push 0x1c
mov eax, 0x1003a9f6
call fcn.10037efe
mov ebx, ecx
mov ecx, dword [ebx + 0x38]
mov edx, 0x1000489c
and dword [ebp - 0x20], 0
mov byte [ebp - 0x1c], 0
call fcn.1003020b
test eax, eax
jne 0x100752e9
lea ecx, [ebp - 0x20]
call fcn.1007db51
and dword [ebp - 4], 0
movzx eax, word [ebx + 0xc]
push eax
mov eax, dword [ebp + 8]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
lea esi, [ebx + 0x18]
mov edi, eax
push esi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x28], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push edi
mov byte [ebp - 4], 1
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov dword [ebp - 0x24], eax
lea edi, [eax*2 + 2]
mov eax, edi
call fcn.10038910
mov eax, esp
push edi
push 0
push eax
mov dword [ebp - 0x18], eax
call sub.msvcrt.dll_memset
mov eax, dword [ebp - 0x24]
add esp, 0xc
mov edi, dword [ebp - 0x14]
test eax, eax
je 0x10075353
inc eax
push eax
push dword [ebp - 0x18]
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
cmp dword [ebx + 0x34], 0
je 0x1007536e
push dword [ebx + 0x34]
push dword [0x100a3570]
call dword [sym.imp.MSDART.DLL_MpHeapFree]
and dword [ebx + 0x34], 0
pop ecx
pop ecx
push dword [ebp + 8]
and dword [ebx + 0x30], 0
mov ecx, ebx
call fcn.100753ae
push dword [ebp - 0x18]
push edi
call dword [sym.imp.USER32.dll_SetWindowTextW]
push esi
mov dword [ebx + 0x3c], 1
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp byte [ebp - 0x1c], 0
je 0x100753a3
push dword [ebp - 0x20]
call dword [sym.imp.USER32.dll_SetCursor]
lea esp, [ebp - 0x38]
call fcn.10037ead
ret 4

Function at 0x10077218
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x100a2bb4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, ecx
push edi
push 0x3ff
mov dword [ebp - 0xc], eax
push dword [eax + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov dword [ebp - 8], eax
lea edi, [eax*2 + 2]
mov eax, edi
call fcn.10038910
mov ebx, esp
push edi
push 0
push ebx
call sub.msvcrt.dll_memset
mov eax, dword [ebp - 8]
add esp, 0xc
test eax, eax
je 0x10077279
inc eax
push eax
push ebx
push esi
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov edi, dword [ebp - 0xc]
lea eax, [ebp - 8]
push 0x18
push 0x17
push eax
push ebx
push 0x16
mov ecx, edi
call fcn.10076d81
test eax, eax
jns 0x100772ae
mov ecx, dword [edi + 4]
xor edx, edx
cmp eax, 0x8007000e
push 0x10
setne dl
add edx, 0x19
call fcn.1007dd66
pop ecx
xor eax, eax
jmp 0x100772c7
jne 0x100772c4
push dword [ebp - 8]
push esi
call dword [sym.imp.USER32.dll_SetWindowTextW]
push dword [ebp - 8]
call dword [sym.imp.MSDART.DLL_mpFree]
pop ecx
xor eax, eax
inc eax
lea esp, [ebp - 0x18]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10037870
mov esp, ebp
pop ebp
ret 0x10
Function at 0x100772dd
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x100a2bb4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, ecx
push edi
push 0xf6
mov dword [ebp - 0xc], eax
push dword [eax + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov dword [ebp - 8], eax
lea edi, [eax*2 + 2]
mov eax, edi
call fcn.10038910
mov ebx, esp
push edi
push 0
push ebx
call sub.msvcrt.dll_memset
mov eax, dword [ebp - 8]
add esp, 0xc
test eax, eax
je 0x1007733e
inc eax
push eax
push ebx
push esi
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0x2c
push 0x2b
lea eax, [ebp - 8]
push eax
push ebx
mov ebx, dword [ebp - 0xc]
mov ecx, ebx
push 0x2a
call fcn.10076d81
mov edi, eax
test edi, edi
jns 0x10077391
test byte [0x100a4750], 2
je 0x10077374
push 0x5e1
mov edx, 0x100105e0
mov ecx, edi
call fcn.10051341
pop ecx
mov ecx, dword [ebx + 4]
xor edx, edx
cmp edi, 0x8007000e
push 0x10
setne dl
add edx, 0x19
call fcn.1007dd66
pop ecx
xor eax, eax
jmp 0x100773aa
jne 0x100773a7
push dword [ebp - 8]
push esi
call dword [sym.imp.USER32.dll_SetWindowTextW]
push dword [ebp - 8]
call dword [sym.imp.MSDART.DLL_mpFree]
pop ecx
xor eax, eax
inc eax
lea esp, [ebp - 0x18]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10037870
mov esp, ebp
pop ebp
ret 0x10
Function at 0x1007a4c5
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
mov eax, ecx
push esi
xor esi, esi
mov dword [ebp - 4], eax
push edi
mov edi, esi
test ebx, ebx
jne 0x1007a507
test byte [0x100a4750], 2
mov edi, 0x80004003
je 0x1007a659
push 0x2e6
mov edx, 0x10010910
mov ecx, edi
call fcn.10051341
pop ecx
jmp 0x1007a659
push 5
push edx
push eax
mov dword [ebx], esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
jne 0x1007a527
test byte [0x100a4750], 2
je 0x1007a573
push 0x29b
jmp 0x1007a563
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x1007a545
test byte [0x100a4750], 2
je 0x1007a573
push 0x2a1
jmp 0x1007a563
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, eax
mov dword [ebp - 4], ecx
test ecx, ecx
jne 0x1007a5b5
test byte [0x100a4750], 2
je 0x1007a573
push 0x2a7
mov edx, 0x10010910
mov ecx, 0x80004005
call fcn.10051341
pop ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
jle 0x1007a588
movzx edi, di
or edi, 0x80070000
test byte [0x100a4750], 2
je 0x1007a5a3
push 0x2de
mov edx, 0x10010910
mov ecx, edi
call fcn.10051341
pop ecx
test edi, edi
js 0x1007a659
mov edi, 0x80004005
jmp 0x1007a659
mov eax, dword [ecx]
mov edx, 0xffff0000
and eax, edx
cmp eax, edx
jne 0x1007a5e7
test byte [0x100a4750], 2
je 0x1007a5e3
push 0x2af
mov edx, 0x10010910
mov ecx, 0x80004005
call fcn.10051341
pop ecx
mov ecx, dword [ebp - 4]
push 0x1a
jmp 0x1007a60a
test byte [0x100a4750], 2
je 0x1007a608
push 0x2b4
mov edx, 0x10010910
mov ecx, 0x80004005
call fcn.10051341
pop ecx
mov ecx, dword [ebp - 4]
push 0x12
pop eax
add eax, ecx
mov edx, 0xffff
mov dword [ebx], eax
movzx ecx, word [eax]
cmp cx, dx
jne 0x1007a621
add eax, 4
jmp 0x1007a633
test cx, cx
je 0x1007a630
add dword [ebx], 2
mov eax, dword [ebx]
cmp word [eax], si
jne 0x1007a626
add eax, 2
mov dword [ebx], eax
movzx ecx, word [eax]
cmp cx, dx
jne 0x1007a642
add eax, 4
jmp 0x1007a654
test cx, cx
je 0x1007a651
add dword [ebx], 2
mov eax, dword [ebx]
cmp word [eax], si
jne 0x1007a647
add eax, 2
xor esi, esi
mov dword [ebx], eax
inc esi
neg esi
sbb esi, esi
not esi
and esi, edi
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1007e3df
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x6c
mov eax, dword [0x100a2bb4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x5c
lea eax, [ebp - 0x68]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x68], 8
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x58], 0x190
mov byte [ebp - 0x51], 1
push 0x10011350
push 0x20
pop edx
call fcn.1002706a
call fcn.100564c0
mov edi, eax
test edi, edi
je 0x1007e51a
push 5
push 0x3ee
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x1007e513
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x1007e513
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x1007e513
mov edx, dword [eax]
mov ebx, 0xffff0000
xor ecx, ecx
and edx, ebx
cmp edx, ebx
mov dword [ebp - 0x6c], edx
sete cl
lea esi, [ecx*8 + 0x12]
mov ecx, 0xffff
add esi, eax
cmp word [esi], cx
jne 0x1007e495
add esi, 4
jmp 0x1007e4a0
movzx eax, word [esi]
add esi, 2
test ax, ax
jne 0x1007e495
cmp word [esi], cx
jne 0x1007e4aa
add esi, 4
jmp 0x1007e4b5
movzx eax, word [esi]
add esi, 2
test ax, ax
jne 0x1007e4aa
movzx eax, word [esi]
add esi, 2
test ax, ax
jne 0x1007e4b5
push 0
call dword [sym.imp.USER32.dll_GetDC]
mov ebx, eax
test ebx, ebx
je 0x1007e4f2
push 0x48
push 0x5a
push ebx
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
movzx ecx, word [esi]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MulDiv]
push ebx
neg eax
push 0
mov dword [ebp - 0x68], eax
call dword [sym.imp.USER32.dll_ReleaseDC]
xor eax, eax
lea ecx, [ebp - 0x4c]
cmp dword [ebp - 0x6c], 0xffff0000
sete al
lea eax, [eax*4 + 2]
add eax, esi
push eax
push 0x20
pop edx
call fcn.1002706a
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10037870
mov esp, ebp
pop ebp
ret