joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101fbd00
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10219e91
mov eax, dword fs:[0]
push eax
sub esp, 0x288
mov eax, dword [0x105520d0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x24c], eax
xor ebx, ebx
mov eax, vtable.CUintArg.0
mov dword [ebp - 0x244], ecx
mov dword [ebp - 0x258], eax
mov byte [ebp - 0x254], bl
mov dword [ebp - 0x250], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x264], eax
mov byte [ebp - 0x260], bl
mov dword [ebp - 0x25c], ebx
push 0xff
lea edx, [ebp - 0x10f]
push ebx
push edx
mov byte [ebp - 4], 1
mov byte [ebp - 0x110], bl
call sub.MSVCR100.dll_memset
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x240], eax
cmp edi, ebx
jne 0x101fbda9
mov al, 1
jmp 0x101fbee8
push edi
mov ecx, esi
call fcn.101fbcb0
test al, al
je 0x101fbee6
lea ecx, [ebp - 0x294]
call fcn.101fa4b0
push edi
lea ecx, [ebp - 0x294]
mov byte [ebp - 4], 2
call fcn.101f9dd0
lea ecx, [ebp - 0x294]
test al, al
je 0x101fbedd
push ebx
call fcn.101f9f60
push 0x12b
lea eax, [ebp - 0x23b]
push ebx
push eax
mov byte [ebp - 0x23c], bl
call sub.MSVCR100.dll_memset
push edi
lea ecx, [ebp - 0x23c]
push str.Downloading__s
push ecx
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0x18
lea edx, [ebp - 0x23c]
push edx
mov ecx, esi
call fcn.101facc0
mov eax, dword [ebp + 0x14]
push esi
push ebx
push ebx
push 0xbb8
push 0x7d0
push 0x3e8
push 0x3e8
mov ecx, dword [ebp - 0x244]
push 0x1f4
push eax
sub esp, 0xc
mov eax, esp
mov dword [ebp - 0x248], esp
mov dword [eax], vtable.CUintArg.0
mov byte [eax + 4], bl
mov dword [eax + 8], ebx
sub esp, 0xc
mov eax, esp
mov dword [eax], vtable.CUintArg.0
mov byte [eax + 4], bl
mov dword [eax + 8], ebx
mov eax, dword [ebp + 0x1c]
mov edx, dword [ecx]
mov edx, dword [edx + 4]
mov dword [ebp - 0x248], esp
push eax
mov eax, dword [ebp + 0x18]
push eax
lea eax, [ebp - 0x294]
push eax
mov eax, dword [ebp - 0x24c]
push ebx
push ebx
push eax
call edx
mov bl, al
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x240]
push eax
push edi
lea eax, [ebp - 0x110]
push str.Downloaded__s_:__dms
push eax
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0x10
lea ecx, [ebp - 0x110]
push ecx
mov ecx, esi
call fcn.101facc0
lea ecx, [ebp - 0x294]
mov byte [ebp - 4], 1
call fcn.101fa520
mov al, bl
jmp 0x101fbee8
mov byte [ebp - 4], 1
call fcn.101fa520
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10203cc8
mov esp, ebp
pop ebp
ret 0x18
Function at 0x101fbf10
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10219e91
mov eax, dword fs:[0]
push eax
sub esp, 0x288
mov eax, dword [0x105520d0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x24c], eax
xor ebx, ebx
mov eax, vtable.CUintArg.0
mov dword [ebp - 0x244], ecx
mov dword [ebp - 0x258], eax
mov byte [ebp - 0x254], bl
mov dword [ebp - 0x250], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x264], eax
mov byte [ebp - 0x260], bl
mov dword [ebp - 0x25c], ebx
push 0xff
lea edx, [ebp - 0x10f]
push ebx
push edx
mov byte [ebp - 4], 1
mov byte [ebp - 0x110], bl
call sub.MSVCR100.dll_memset
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x240], eax
cmp edi, ebx
jne 0x101fbfb9
mov al, 1
jmp 0x101fc0fb
push edi
mov ecx, esi
call fcn.101fbcb0
test al, al
je 0x101fc0f9
lea ecx, [ebp - 0x294]
call fcn.101fa4b0
push edi
lea ecx, [ebp - 0x294]
mov byte [ebp - 4], 2
call fcn.101f9dd0
lea ecx, [ebp - 0x294]
test al, al
je 0x101fc0f0
push ebx
call fcn.101f9f60
push 0x12b
lea eax, [ebp - 0x23b]
push ebx
push eax
mov byte [ebp - 0x23c], bl
call sub.MSVCR100.dll_memset
push edi
lea ecx, [ebp - 0x23c]
push str.Downloading__s
push ecx
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0x18
lea edx, [ebp - 0x23c]
push edx
mov ecx, esi
call fcn.101facc0
mov eax, dword [ebp + 0x18]
push esi
push ebx
push ebx
push 0xbb8
push 0x7d0
push 0x3e8
push 0x3e8
mov ecx, dword [ebp - 0x244]
push 0x1f4
push eax
sub esp, 0xc
mov eax, esp
mov dword [ebp - 0x248], esp
mov dword [eax], vtable.CUintArg.0
mov byte [eax + 4], bl
mov dword [eax + 8], ebx
sub esp, 0xc
mov eax, esp
mov dword [eax], vtable.CUintArg.0
mov byte [eax + 4], bl
mov dword [eax + 8], ebx
mov eax, dword [ebp + 0x20]
mov edx, dword [ecx]
mov edx, dword [edx + 4]
mov dword [ebp - 0x248], esp
push eax
mov eax, dword [ebp + 0x1c]
push eax
lea eax, [ebp - 0x294]
push eax
mov eax, dword [ebp + 0x14]
push ebx
push eax
mov eax, dword [ebp - 0x24c]
push eax
call edx
mov bl, al
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x240]
push eax
push edi
lea eax, [ebp - 0x110]
push str.Downloaded__s_:__dms
push eax
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0x10
lea ecx, [ebp - 0x110]
push ecx
mov ecx, esi
call fcn.101facc0
lea ecx, [ebp - 0x294]
mov byte [ebp - 4], 1
call fcn.101fa520
mov al, bl
jmp 0x101fc0fb
mov byte [ebp - 4], 1
call fcn.101fa520
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10203cc8
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x10200110
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xd810
call fcn.10203e10
mov eax, dword [0x105520d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
push 0xd7fc
lea eax, [ebp - 0xd800]
push 0
push eax
mov esi, ecx
mov byte [ebp - 0xd805], 1
mov dword [ebp - 0xd804], 0
call sub.MSVCR100.dll_memset
add esp, 0xc
cmp byte [esi + 4], 0
mov dword [ebp - 0xd80c], 0
jne 0x1020017e
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10203cc8
mov esp, ebp
pop ebp
ret 8
cmp dword [edi + 0x14], 0x10
jb 0x10200186
mov edi, dword [edi]
push 0x104279ec
push edi
call dword [sym.imp.MSVCR100.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x102001f5
mov edi, dword [sym.imp.MSVCR100.dll_fread]
push esi
push 1
lea ecx, [ebp - 0xd80c]
push 4
push ecx
call edi
push esi
push 1
lea edx, [ebp - 0xd810]
push 4
push edx
call edi
push esi
push 0x3600
lea eax, [ebp - 0xd804]
push 4
push eax
call edi
push esi
call dword [sym.imp.MSVCR100.dll_fclose]
add esp, 0x34
cmp dword [ebx + 0x14], 0x10
jb 0x102001e0
mov ebx, dword [ebx]
push 0x10223978
push ebx
call dword [sym.imp.MSVCR100.dll_fopen]
mov edi, eax
add esp, 8
test edi, edi
jne 0x102001fe
mov byte [ebp - 0xd805], 0
jmp 0x10200236
mov ebx, dword [sym.imp.MSVCR100.dll_fprintf]
xor esi, esi
jmp 0x10200210
mov ecx, dword [ebp + esi*4 - 0xd804]
push ecx
push str.0x_08X_n
push edi
call ebx
inc esi
add esp, 0xc
cmp esi, 0x3600
jb 0x10200210
push edi
call dword [sym.imp.MSVCR100.dll_fclose]
add esp, 4
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 0xd805]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10203cc8
mov esp, ebp
pop ebp
ret 8
Function at 0x10200250
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
cmp byte [ecx + 4], 0
jne 0x1020025f
xor al, al
pop ebp
ret 8
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 0x10
jb 0x1020026a
mov eax, dword [eax]
push esi
push 0x104279ec
push eax
call dword [sym.imp.MSVCR100.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
jne 0x10200287
xor al, al
pop esi
pop ebp
ret 8
push ebx
mov ebx, dword [sym.imp.MSVCR100.dll_fread]
push edi
mov edi, dword [ebp + 0xc]
push esi
push 1
push 1
push edi
call ebx
push esi
push 1
lea eax, [edi + 1]
push 1
push eax
call ebx
push esi
push 1
lea ecx, [edi + 2]
push 2
push ecx
call ebx
push esi
push 1
lea edx, [edi + 4]
push 2
push edx
call ebx
add esp, 0x40
push esi
push 0x100
lea eax, [edi + 6]
push 2
push eax
call ebx
push esi
push 0x100
lea ecx, [edi + 0x206]
push 2
push ecx
call ebx
push esi
push 1
lea edx, [edi + 0x406]
push 4
push edx
call ebx
push esi
push 1
lea eax, [edi + 0x40a]
push 4
push eax
call ebx
add esp, 0x40
push esi
push 1
lea ecx, [edi + 0x40e]
push 4
push ecx
call ebx
push esi
push 4
lea edx, [edi + 0x412]
push 4
push edx
call ebx
push esi
push 1
lea eax, [edi + 0x422]
push 1
push eax
call ebx
push esi
push 1
lea ecx, [edi + 0x423]
push 2
push ecx
call ebx
add esp, 0x40
push esi
push 1
push 2
lea edx, [edi + 0x425]
push edx
call ebx
push esi
push 1
lea eax, [edi + 0x427]
push 2
push eax
call ebx
push esi
push 1
lea ecx, [edi + 0x429]
push 2
push ecx
call ebx
push esi
push 1
lea edx, [edi + 0x42b]
push 2
push edx
call ebx
add esp, 0x40
push esi
push 1
lea eax, [edi + 0x42d]
push 2
push eax
call ebx
push esi
push 1
lea ecx, [edi + 0x42f]
push 2
push ecx
call ebx
push esi
push 1
lea edx, [edi + 0x431]
push 2
push edx
call ebx
push esi
push 0x10
lea eax, [edi + 0x433]
push 2
push eax
call ebx
add esp, 0x40
push esi
push 0x10
lea ecx, [edi + 0x453]
push 2
push ecx
call ebx
push esi
push 1
lea edx, [edi + 0x473]
push 1
push edx
call ebx
push esi
push 0x40
lea eax, [edi + 0x474]
push 2
push eax
call ebx
push esi
push 0x40
push 2
add edi, 0x4f4
push edi
call ebx
add esp, 0x40
push esi
call dword [sym.imp.MSVCR100.dll_fclose]
add esp, 4
pop edi
pop ebx
mov al, 1
pop esi
pop ebp
ret 8

Function at 0x10203cc8
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x105520d0]
jne 0x10203cd2
repz ret
jmp fcn.102047bb
Function at 0x4097ac
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409860
jmp 0x409855
cmp dword [esi + 0x10], 0x1000
jne 0x409841
test byte [esi + 0x15], 1
jne 0x409841
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409800
cmp eax, 2
je 0x409800
cmp eax, 0x10
je 0x409800
cmp eax, 0x20
jne 0x409815
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409815
mov bl, 1
xor ebp, ebp
jmp 0x409826
mov eax, dword [esi]
add eax, ebp
call fcn.004097a4
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x409819
test bl, bl
je 0x409841
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409860
mov eax, dword [esi + 4]
cmp eax, edi
je 0x4097d8
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x503b67
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
mov dword [0x505076], ecx
call dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
mov dword [0x505298], eax
mov dword [0x505220], 0x5032dd
mov dword [0x50521c], 2
jmp 0x503b97
mov dword [0x505224], 0
mov dword [0x505228], 0
mov dword [0x505218], 0x30
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
mov dword [0x50522c], eax
mov dword [0x505240], 0x504088
mov dword [0x505238], 0xf
mov dword [0x50506e], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x505230], eax
mov dword [0x505244], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x505234], eax
push 0x505218
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x50506e]
push 0
push 0
push 0x1e5
push 0x21e
push 0xffffe52a
push 0xfffff588
push 0x40000
push str.wait
push str.aroka
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x505290], eax
push 5
push dword [0x505290]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x505290]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x503c6a
push 0
push 0
push 0
push 0x505248
call dword [sym.imp.user32.dll_GetMessageA]
or eax, eax
je 0x503c97
push 0x505248
call dword [sym.imp.user32.dll_TranslateMessage]
push 0x505248
call dword [sym.imp.user32.dll_DispatchMessageA]
jmp 0x503c6a
mov eax, dword [0x505250]
jmp 0x503ca4
call 0x502b16
ret
Function at 0x10010bc0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xa8
call fcn.10032ed0
mov eax, dword [0x10057d40]
xor eax, esp
mov dword [esp + 0xa4], eax
mov eax, dword [esp + 0xac]
push ebx
push ebp
push esi
mov esi, dword [esp + 0xbc]
xor ebp, ebp
push edi
mov edi, dword [esp + 0xc4]
mov dword [esp + 0x30], eax
mov esi, dword [esi + 4]
mov dword [esp + 0x1c], esi
sub esi, edi
mov dword [esp + 0x10], esi
cmp dword [esp + 0xc8], edi
jae 0x10010c24
push str.orig_len___md_size
push 0xf8
push str.._ssl_s3_cbc.c
call sub.LIBEAY32.dll_Ordinal_3244
add esp, 0xc
cmp edi, 0x40
jbe 0x10010c40
push str.md_size___EVP_MAX_MD_SIZE
push 0xf9
push str.._ssl_s3_cbc.c
call sub.LIBEAY32.dll_Ordinal_3244
add esp, 0xc
mov ecx, dword [esp + 0xc8]
lea eax, [esp + 0x34]
neg eax
lea ebx, [esp + 0x34]
and eax, 0x3f
add ebx, eax
lea eax, [edi + 0x100]
mov dword [esp + 0x20], ebx
cmp ecx, eax
jbe 0x10010c6e
mov ebp, ecx
sub ebp, edi
sub ebp, 0x100
mov eax, edi
xor edx, edx
and eax, 0xfffffffe
shl eax, 0x17
sub eax, ebp
add eax, esi
div edi
push edi
mov esi, edx
push 0
push ebx
mov dword [esp + 0x38], esi
call fcn.10034710
add esp, 0xc
mov dword [esp + 0x18], 0
cmp ebp, dword [esp + 0xc8]
jae 0x10010d4b
mov ecx, dword [esp + 0x1c]
mov esi, ebx
mov edx, dword [esp + 0x10]
mov eax, ecx
shr eax, 0x1f
sub ebp, ecx
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0xc0]
shr edx, 0x1f
mov dword [esp + 0x10], edx
mov eax, dword [eax + 0xc]
add eax, ecx
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
lea ebx, [ecx + ebp]
shr ebx, 0x1f
lea ecx, [edi + ebp]
shr ecx, 0x1f
xor cl, dl
xor dl, bl
or cl, dl
mov edx, ebp
xor cl, bl
shr edx, 0x1f
xor dl, byte [esp + 0x14]
dec cl
mov dword [esp + 0x28], ecx
mov cl, byte [eax + ebp]
mov al, bl
xor al, byte [esp + 0x14]
inc ebp
or dl, al
xor dl, bl
mov ebx, dword [esp + 0x18]
neg dl
and dl, cl
and dl, byte [esp + 0x28]
or byte [ebx + esi], dl
inc ebx
mov edx, dword [esp + 0x10]
mov ecx, ebx
sub ecx, edi
mov eax, ebx
xor ecx, edi
xor eax, edi
or ecx, eax
xor ecx, ebx
shr ecx, 0x1f
neg ecx
and ebx, ecx
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x18], ebx
lea eax, [ecx + ebp]
cmp eax, dword [esp + 0xc8]
jb 0x10010cd1
mov esi, dword [esp + 0x2c]
mov ebx, dword [esp + 0x20]
xor edx, edx
test edi, edi
je 0x10010d7f
mov ebp, dword [esp + 0x30]
mov eax, esi
xor eax, 0x20
mov al, byte [eax + ebx]
movzx eax, byte [esi + ebx]
inc esi
mov byte [edx + ebp], al
mov ecx, esi
sub ecx, edi
mov eax, esi
xor ecx, edi
xor eax, edi
or ecx, eax
inc edx
xor ecx, esi
shr ecx, 0x1f
neg ecx
and esi, ecx
cmp edx, edi
jb 0x10010d55
mov ecx, dword [esp + 0xb4]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10032eb8
add esp, 0xa8
ret
Function at 0x100118a0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 8
call fcn.10032ed0
push ebx
mov ebx, dword [esp + 0x1c]
push esi
mov esi, dword [esp + 0x14]
inc ebx
push edi
mov edi, dword [esp + 0x1c]
mov dword [esp + 0x24], ebx
mov eax, dword [esi + 8]
mov ecx, dword [edi + 4]
mov eax, dword [eax + 0x64]
test byte [eax + 0x38], 1
je 0x100118ee
mov edx, dword [esp + 0x20]
lea eax, [ebx + edx]
cmp eax, ecx
jbe 0x100118e1
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 8
ret
add dword [edi + 0xc], edx
add dword [edi + 0x10], edx
sub ecx, edx
mov dword [edi + 4], ecx
jmp 0x100118f2
cmp ebx, ecx
ja 0x100118d8
test dword [esi + 0x100], 0x200
mov eax, dword [edi + 0xc]
movzx ebx, byte [eax + ecx - 1]
je 0x10011941
cmp dword [esi + 0x88], 0
jne 0x10011941
mov eax, dword [esi + 0x58]
push 8
add eax, 8
push 0x10044440
push eax
call sub.LIBEAY32.dll_Ordinal_3906
add esp, 0xc
test eax, eax
jne 0x10011934
test bl, 1
jne 0x10011934
mov eax, dword [esi + 0x58]
or dword [eax], 8
mov eax, dword [esi + 0x58]
test byte [eax], 8
je 0x10011941
test ebx, ebx
je 0x10011941
dec ebx
mov eax, dword [esi + 0x80]
push ebp
push dword [eax]
call sub.LIBEAY32.dll_Ordinal_3857
mov ebp, dword [edi + 4]
add esp, 4
mov dword [esp + 0x14], ebp
and eax, 0x200000
je 0x10011973
sub ebp, ebx
mov eax, 1
dec ebp
mov dword [edi + 4], ebp
pop ebp
pop edi
pop esi
pop ebx
add esp, 8
ret
mov ecx, dword [esp + 0x28]
mov edx, ebp
add ecx, ebx
mov eax, ebp
sub edx, ecx
xor eax, ecx
xor edx, ecx
mov ecx, 0xff
or edx, eax
lea eax, [ebp - 1]
xor edx, ebp
shr edx, 0x1f
dec edx
cmp eax, ecx
mov dword [esp + 0x1c], edx
cmovb ecx, eax
xor esi, esi
test ecx, ecx
je 0x100119f8
mov eax, ebx
shr eax, 0x1f
mov dword [esp + 0x28], eax
mov eax, dword [edi + 0xc]
lea edi, [ebp - 1]
add edi, eax
mov ebp, ecx
mov al, byte [esp + 0x28]
lea edi, [edi - 1]
mov edx, ebx
mov ecx, esi
sub edx, esi
shr ecx, 0x1f
shr edx, 0x1f
xor al, cl
xor dl, cl
inc esi
or dl, al
movzx eax, byte [edi + 1]
xor dl, byte [esp + 0x28]
xor eax, ebx
dec dl
movzx ecx, dl
mov edx, dword [esp + 0x1c]
and ecx, eax
not ecx
and edx, ecx
mov dword [esp + 0x1c], edx
cmp esi, ebp
jb 0x100119b5
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x14]
not edx
lea eax, [ebx + 1]
movzx ecx, dl
dec ecx
shr ecx, 0x1f
neg ecx
and eax, ecx
sub ebp, eax
shl eax, 8
or dword [edi], eax
mov eax, ecx
mov dword [edi + 4], ebp
and eax, 1
pop ebp
pop edi
not ecx
pop esi
or eax, ecx
pop ebx
add esp, 8
ret
Function at 0x100350bb
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push esi
push str.FlsAlloc
push 0x1004c110
push str.FlsAlloc
push 0
call fcn.10035034
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100350ed
push dword [ebp + 8]
mov ecx, esi
call fcn.10033b7f
call esi
pop esi
pop ebp
ret
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsAlloc]

Function at 0x1003512f
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push str.FlsGetValue
push 0x1004c134
push str.FlsGetValue
push 2
call fcn.10035034
add esp, 0x10
mov esi, eax
push dword [ebp + 8]
test esi, esi
je 0x10035160
mov ecx, esi
call fcn.10033b7f
call esi
jmp 0x10035166
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
pop esi
pop ebp
ret

Function at 0x10035169
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push str.FlsSetValue
push 0x1004c148
push str.FlsSetValue
push 3
call fcn.10035034
add esp, 0x10
mov esi, eax
push dword [ebp + 0xc]
push dword [ebp + 8]
test esi, esi
je 0x1003519d
mov ecx, esi
call fcn.10033b7f
call esi
jmp 0x100351a3
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop esi
pop ebp
ret
Function at 0x404b49
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9c
push ebx
push esi
push edi
mov edi, ecx
lea eax, [ebp - 0x14]
xor ebx, ebx
push eax
mov dword [ebp - 0x14], ebx
lea ecx, [edi + 0xd8]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
lea esi, [edi + 0x50]
mov dword [ebp - 8], ebx
call fcn.004019e0
test al, al
je 0x404b9b
mov ecx, dword [esi]
mov eax, dword [ebp - 0x14]
mov dword [ecx + 0x63], eax
mov ecx, dword [esi]
mov eax, dword [ebp - 0x10]
mov dword [ecx + 0x67], eax
mov ecx, dword [esi]
mov eax, dword [ebp - 0xc]
mov dword [ecx + 0x6f], eax
mov ecx, dword [esi]
mov eax, dword [ebp - 8]
mov dword [ecx + 0x73], eax
lea eax, [ebp - 0x98]
push eax
push 0x80
push 0xd
push 0x402
push dword [edi + 0xc]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
lea eax, [ebp - 0x98]
push eax
call fcn.00408246
mov ecx, eax
cmp edx, ebx
ja 0x404bd4
cmp ecx, ebx
jbe 0x404bdc
mov eax, dword [esi]
mov dword [eax + 0x5b], ecx
mov dword [eax + 0x5f], edx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x407264
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
push ebx
mov ebx, 0x40e
push esi
mov edx, ebx
mov esi, ecx
call fcn.0040ae8b
cmp eax, 0xffffffff
jne 0x4072e7
push edi
mov edi, 0x80
lea eax, [ebp - 0x88]
push edi
push 0
push eax
call fcn.0041d760
add esp, 0xc
lea eax, [ebp - 0x88]
push eax
push edi
push 0xd
push ebx
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
and dword [ebp - 8], 0
lea eax, [ebp - 1]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x88]
push str.__d__c
push eax
call fcn.0041cfa0
add esp, 0x10
pop edi
cmp eax, 1
jne 0x4072e7
mov ecx, dword [esi + 0x4c]
mov eax, dword [ebp - 8]
mov dword [ecx + 0xe9], eax
pop esi
pop ebx
leave
ret

Function at 0x407e70
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9c
push ebx
push esi
push edi
mov edi, ecx
lea eax, [ebp - 0x14]
xor ebx, ebx
push eax
mov dword [ebp - 0x14], ebx
lea ecx, [edi + 0xd8]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
lea esi, [edi + 0x50]
mov dword [ebp - 8], ebx
call fcn.004019e0
test al, al
je 0x407ec2
mov ecx, dword [esi]
mov eax, dword [ebp - 0x14]
mov dword [ecx + 0x36], eax
mov ecx, dword [esi]
mov eax, dword [ebp - 0x10]
mov dword [ecx + 0x3a], eax
mov ecx, dword [esi]
mov eax, dword [ebp - 0xc]
mov dword [ecx + 0x42], eax
mov ecx, dword [esi]
mov eax, dword [ebp - 8]
mov dword [ecx + 0x46], eax
lea eax, [ebp - 0x98]
push eax
push 0x80
push 0xd
push 0x3f2
push dword [edi + 0xc]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
lea eax, [ebp - 0x98]
push eax
call fcn.00408246
cmp edx, ebx
ja 0x407ef9
cmp eax, ebx
jbe 0x407efe
mov ecx, dword [esi]
mov dword [ecx + 0x2e], eax
pop edi
pop esi
pop ebx
leave
ret