joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10032306
Capabilities:
Get file version info

Disassembly:
push 0x18
mov eax, 0x100a7beb
call fcn.100a5688
mov eax, ecx
mov dword [ebp - 0x14], eax
xor ebx, ebx
mov dword [ebp - 4], ebx
push 0x1000893c
mov dword [ebp - 0x1c], ebx
call fcn.1006f4e2
xor edi, edi
mov dword [ebp - 4], ebx
inc edi
mov dword [ebp - 0x1c], edi
call fcn.1008e9f3
push eax
lea ecx, [ebp - 0x10]
call fcn.10091a7b
mov dword [ebp - 4], edi
mov ecx, 0x105
mov esi, dword [ebp - 0x10]
mov eax, dword [esi - 8]
sub edi, dword [esi - 4]
sub eax, ecx
or edi, eax
jge 0x10032363
push ecx
lea ecx, [ebp - 0x10]
call fcn.10091a7b
mov esi, dword [ebp - 0x10]
push 0x104
push esi
push ebx
call dword [sym.imp.kernel32.dll_GetModuleFileNameW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.10091a7b
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], ebx
push eax
push esi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov ebx, eax
test ebx, ebx
je 0x100323f7
push ebx
call fcn.10091a7b
pop ecx
mov edi, eax
push edi
push ebx
push dword [ebp - 0x18]
push esi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x100323eb
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x20]
push eax
push 0x10021634
push edi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
mov ebx, dword [ebp - 0x14]
test eax, eax
je 0x100323ee
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 0xc]
mov edx, dword [eax + 8]
movzx eax, cx
push eax
shr ecx, 0x10
push ecx
movzx eax, dx
push eax
shr edx, 0x10
push edx
push 0x1000894c
push ebx
call fcn.10091a7b
add esp, 0x18
jmp 0x100323ee
mov ebx, dword [ebp - 0x14]
push edi
call fcn.10091716
pop ecx
jmp 0x100323fa
mov ebx, dword [ebp - 0x14]
lea ecx, [esi - 0x10]
call fcn.1008ebf5
mov eax, ebx
call fcn.100a5651
ret
Function at 0x100324d7
Capabilities:
Check if file exists
Get common file path
Get file attributes
Query or enumerate registry value

Disassembly:
push 0x10
mov eax, 0x100a7c16
call fcn.100a5688
mov edi, ecx
xor esi, esi
mov ebx, 0x80004005
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], esi
test edi, edi
je 0x100325f9
lea eax, [ebp - 0x10]
push eax
push 0x20019
push esi
push 0x10008a30
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.advapi32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10032561
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x208
push eax
push edi
push esi
push esi
push 0x10008aa0
push dword [ebp - 0x10]
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
push dword [ebp - 0x10]
mov esi, eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
test esi, esi
jne 0x1003255f
xor eax, eax
push edi
mov word [edi + 0x206], ax
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1003255f
xor ebx, ebx
jmp 0x100325f9
xor esi, esi
push edi
push esi
push esi
push 0x2b
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x10032598
push 0x10008ab0
push 0x104
push edi
call fcn.10091a7b
add esp, 0xc
test eax, eax
jne 0x10032598
push edi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x10032598
mov ebx, esi
jmp 0x100325f9
call fcn.1008e9f3
push eax
lea ecx, [ebp - 0x18]
call fcn.10091a7b
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], esi
call fcn.10030831
push 0x10008aec
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
push dword [eax]
call fcn.10091a7b
mov ecx, dword [ebp - 0x1c]
lea ecx, [ecx - 0x10]
call fcn.1008ebf5
mov esi, dword [ebp - 0x18]
push esi
push 0x104
push edi
call fcn.10091a7b
add esp, 0xc
push edi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
inc eax
lea ecx, [esi - 0x10]
neg eax
sbb eax, eax
not eax
and ebx, eax
call fcn.1008ebf5
mov eax, ebx
call fcn.100a5651
ret
Function at 0x10037543
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xc
mov eax, 0x100a8953
call fcn.100a5688
mov edi, ecx
mov dword [ebp - 4], 1
mov ecx, dword [ebp + 0xc]
lea ecx, [ecx - 0x10]
call fcn.1008eb5d
lea esi, [eax + 0x10]
mov dword [ebp - 0x10], esi
mov byte [ebp - 4], 2
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.1008eb5d
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x14], 4
push ecx
push 1
add eax, 0x10
xor ebx, ebx
push ebx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x18], eax
call dword [sym.imp.advapi32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100375b5
lea eax, [ebp - 0x14]
push eax
push edi
push ebx
push ebx
push esi
push dword [ebp - 0x10]
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
test eax, eax
jne 0x100375b5
mov bl, 1
push dword [ebp - 0x10]
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.1008ebf5
lea ecx, [esi - 0x10]
call fcn.1008ebf5
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.1008ebf5
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.1008ebf5
mov al, bl
call fcn.100a5651
ret 8

Function at 0x1003fa2b
Capabilities:
Identify system language via api

Disassembly:
push 0x24
mov eax, 0x100aa25c
call fcn.100a5688
mov ebx, edx
mov edi, ecx
push 0x1000c240
lea ecx, [ebp - 0x18]
call fcn.1006f4e2
and dword [ebp - 4], 0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
mov ecx, edi
push eax
call fcn.1003557e
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x30], eax
test eax, eax
je 0x1003fa78
mov ecx, dword [eax]
push eax
mov esi, dword [ecx + 4]
mov ecx, esi
call dword [0x100d0614]
call esi
mov eax, dword [ebp - 0x14]
mov ecx, dword [edi + 4]
mov dword [ebp - 0x2c], ecx
mov ecx, dword [edi + 8]
mov dword [ebp - 0x28], ecx
test eax, eax
je 0x1003fa98
mov ecx, dword [eax]
push eax
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x100d0614]
call esi
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.1008ebf5
mov ecx, dword [ebp - 0x30]
push ecx
mov eax, dword [ecx]
mov esi, dword [eax + 0x28]
mov ecx, esi
call dword [0x100d0614]
call esi
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x30]
call fcn.1003576c
mov byte [ebp - 4], 3
cmp dword [ebp - 0x24], 0
setne al
test al, al
je 0x1003fb4e
sub esp, 0xc
lea eax, [ebp - 0x24]
mov esi, esp
mov ecx, esi
push eax
call fcn.10091a7b
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp + 8]
mov dword [esi + 4], eax
mov eax, dword [ebp - 0x1c]
mov dword [esi + 8], eax
call fcn.1003fb66
mov dword [ebp - 0x10], eax
cmp eax, 0xfffffffd
jne 0x1003fb0d
call dword [sym.imp.kernel32.dll_GetUserDefaultUILanguage]
movzx eax, ax
mov dword [ebp - 0x10], eax
test eax, eax
je 0x1003fb2c
lea eax, [ebp - 0x10]
mov ecx, ebx
push eax
call fcn.10091a7b
cmp eax, 0xffffffff
jne 0x1003fb2c
lea eax, [ebp - 0x10]
mov ecx, ebx
push eax
call fcn.10091a7b
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 2
call fcn.1006e50b
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x30]
call fcn.1003576c
mov byte [ebp - 4], 3
cmp dword [ebp - 0x24], 0
jne 0x1003fad5
lea ecx, [ebp - 0x24]
call fcn.1006e50b
lea ecx, [ebp - 0x30]
call fcn.1006e50b
call fcn.100a5651
ret 4
Function at 0x100412ad
Capabilities:
Enumerate files on windows

Disassembly:
push 0x260
mov eax, 0x100aa826
call fcn.100a56bc
mov esi, ecx
mov dword [ebp - 0x264], esi
xor ebx, ebx
mov dword [ebp - 0x26c], esi
mov dword [ebp - 0x268], ebx
push 0x250
lea eax, [ebp - 0x260]
mov dword [ebp - 4], 1
push ebx
push eax
call fcn.10093d90
add esp, 0xc
lea ecx, [ebp + 8]
push 0x1000c87c
call fcn.10091a7b
lea eax, [ebp - 0x260]
push eax
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_FindFirstFileW]
mov edi, eax
mov dword [esi], ebx
cmp edi, 0xffffffff
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
setne al
mov dword [ebp - 0x268], 1
test al, al
je 0x100413de
lea ecx, [ebp - 0x234]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x10041336
sub ecx, edx
sar ecx, 1
cmp ecx, 4
jne 0x100413c8
movzx eax, word [ebp - 0x234]
push eax
call fcn.10091a7b
pop ecx
test eax, eax
je 0x100413c8
movzx eax, word [ebp - 0x232]
push eax
call fcn.10091a7b
pop ecx
test eax, eax
je 0x100413c8
movzx eax, word [ebp - 0x230]
push eax
call fcn.10091a7b
pop ecx
test eax, eax
je 0x100413c8
movzx eax, word [ebp - 0x22e]
push eax
call fcn.10091a7b
pop ecx
test eax, eax
je 0x100413c8
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x264]
call fcn.1006f4e2
lea eax, [ebp - 0x264]
mov byte [ebp - 4], 2
push eax
mov ecx, esi
call fcn.1006e65f
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x264]
lea ecx, [ecx - 0x10]
call fcn.1008ebf5
lea eax, [ebp - 0x260]
push eax
push edi
call dword [sym.imp.kernel32.dll_FindNextFileW]
test eax, eax
jne 0x1004132d
push edi
call dword [sym.imp.kernel32.dll_FindClose]
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.1008ebf5
mov eax, esi
call fcn.100a5666
ret 4
Function at 0x10041521
Capabilities:
Check if file exists

Disassembly:
push 0x38
mov eax, 0x100aa8c6
call fcn.100a5688
mov ebx, ecx
cmp byte [ebx + 0x24], 0
je 0x100415f3
lea ecx, [ebp - 0x18]
call fcn.10030831
and dword [ebp - 4], 0
push ecx
mov esi, esp
mov dword [ebp - 0x1c], esi
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.1008eb5d
add eax, 0x10
lea ecx, [ebp - 0x38]
mov dword [esi], eax
call fcn.100412ad
xor edi, edi
mov byte [ebp - 4], 1
cmp dword [ebp - 0x34], edi
jle 0x100415e0
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.1008eb5d
add eax, 0x10
mov dword [ebp - 0x10], eax
push edi
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 2
call fcn.10091a7b
lea ecx, [ebp - 0x10]
push dword [eax]
call fcn.10091a7b
push 0x1000c888
lea ecx, [ebp - 0x10]
call fcn.10091a7b
mov esi, dword [ebp - 0x10]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10041684
push edi
lea ecx, [ebp - 0x38]
call fcn.10091a7b
push ecx
lea eax, [ebp - 0x10]
mov ecx, ebx
push eax
call fcn.100413fa
test al, al
je 0x100415f9
lea ecx, [esi - 0x10]
mov byte [ebp - 4], 1
call fcn.1008ebf5
inc edi
cmp edi, dword [ebp - 0x34]
jl 0x1004156e
lea ecx, [ebp - 0x38]
call fcn.1007993a
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.1008ebf5
call fcn.100a5651
ret
lea ecx, [ebp - 0x14]
call fcn.1008eab0
push edi
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 3
call fcn.10091a7b
push dword [eax]
lea eax, [ebp - 0x14]
push 0x1000c8b0
push eax
call fcn.10091a7b
mov edi, dword [ebx + 0x20]
lea ecx, [ebp - 0x14]
add esp, 0xc
mov edx, dword [edi]
call fcn.1006e4b8
mov esi, dword [edx + 4]
mov ecx, esi
push eax
push 0
call dword [0x100d0614]
mov ecx, edi
call esi
push 0x100093a4
lea ecx, [ebp - 0x1c]
call fcn.1006f4e2
push eax
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x2c]
call fcn.10033056
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 6
call fcn.1002e190
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x44]
call fcn.100352a0
push 0x100c575c
lea eax, [ebp - 0x44]
push eax
call fcn.10091a7b
lea ecx, [ebp - 0x14]
call fcn.1008eab0
push edi
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 7
call fcn.10091a7b
push dword [eax]
lea eax, [ebp - 0x14]
push 0x1000c948
push eax
call fcn.10091a7b
mov edi, dword [ebx + 0x20]
lea ecx, [ebp - 0x14]
add esp, 0xc
mov edx, dword [edi]
call fcn.1006e4b8
mov esi, dword [edx + 4]
mov ecx, esi
push eax
push 0
call dword [0x100d0614]
mov ecx, edi
call esi
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x20]
call fcn.10091a7b
lea eax, [ebp - 0x20]
mov byte [ebp - 4], 8
push eax
lea ecx, [ebp - 0x28]
call fcn.10091a7b
push 0x100c55f0
lea eax, [ebp - 0x28]
jmp 0x1004167e
Function at 0x10045169
Capabilities:
Check if file exists

Disassembly:
push 0x18
mov eax, 0x100ab525
call fcn.100a5688
mov ebx, ecx
xor edi, edi
cmp dword [ebx + 0xc], edi
jle 0x100452d5
lea eax, [ebx + 4]
push edi
mov ecx, eax
call fcn.10091a7b
push 0
push 0x100c9500
push 0x100c9520
push 0
push dword [eax]
call fcn.100a698d
mov esi, eax
add esp, 0x14
mov dword [ebp - 0x1c], esi
test esi, esi
je 0x100452c8
cmp byte [ebp + 0x10], 0
je 0x1004522f
call fcn.1008e9f3
push eax
lea ecx, [ebp - 0x14]
call fcn.10091a7b
and dword [ebp - 4], 0
lea eax, [ebp - 0x20]
push eax
mov ecx, esi
call fcn.10091a7b
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
push dword [eax]
mov eax, dword [ebp + 8]
push dword [eax]
call fcn.10091a7b
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x20]
lea ecx, [ecx - 0x10]
call fcn.1008ebf5
mov esi, dword [ebp - 0x14]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10045220
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 0x14]
push eax
add ecx, 8
call fcn.10091a7b
or dword [ebp - 4], 0xffffffff
lea ecx, [esi - 0x10]
jmp 0x100452c3
or dword [ebp - 4], 0xffffffff
lea ecx, [esi - 0x10]
call fcn.1008ebf5
mov esi, dword [ebp - 0x1c]
push edi
lea ecx, [ebx + 4]
call fcn.10091a7b
push 0
push 0x100c9540
push 0x100c9520
push 0
push dword [eax]
call fcn.100a698d
add esp, 0x14
mov byte [ebp - 0xd], 0
test eax, eax
je 0x10045265
cmp dword [eax + 0x134], 5
jne 0x10045265
mov byte [ebp - 0xd], 1
call fcn.1008e9f3
push eax
lea ecx, [ebp - 0x18]
call fcn.10091a7b
cmp byte [ebp - 0xd], 0
mov dword [ebp - 4], 2
jne 0x100452b9
lea eax, [ebp - 0x24]
mov ecx, esi
push eax
call fcn.10091a7b
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x18]
push dword [eax]
mov eax, dword [ebp + 0xc]
push dword [eax]
call fcn.10091a7b
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x24]
lea ecx, [ecx - 0x10]
call fcn.1008ebf5
lea eax, [ebp - 0x18]
push eax
lea ecx, [esi + 8]
call fcn.10091a7b
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.1008ebf5
inc edi
lea eax, [ebx + 4]
cmp edi, dword [ebx + 0xc]
jl 0x10045185
call fcn.100a5651
ret 0xc
Function at 0x10050944
Capabilities:
Enumerate services

Disassembly:
push 0x34
mov eax, 0x100addbe
call fcn.100a5688
mov dword [ebp - 0x20], edx
mov eax, ecx
mov dword [ebp - 0x18], eax
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov esi, ebx
mov dword [ebp - 0x14], ebx
mov edi, ebx
mov dword [ebp - 0x1c], ebx
call fcn.1006b7e9
push 4
push ebx
push ebx
call dword [sym.imp.advapi32.dll_OpenSCManagerW]
mov ebx, eax
mov dword [ebp - 0x34], ebx
test ebx, ebx
jne 0x1005099c
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
push ecx
mov ecx, dword [ebp - 0x20]
push 0x1000ff04
push 5
pop edx
call fcn.1003211a
jmp 0x10050b0d
xor ecx, ecx
lea eax, [ebp - 0x1c]
push ecx
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x10]
push ecx
push 1
push 0x30
push ecx
jmp 0x100509f6
call dword [sym.imp.kernel32.dll_GetLastError]
mov edi, eax
cmp edi, 0xea
jne 0x10050a03
xor edi, edi
test esi, esi
je 0x100509d3
push esi
call fcn.10091716
pop ecx
push dword [ebp - 0x10]
call fcn.10091a7b
pop ecx
push 0
mov esi, eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x10]
push esi
push 1
push 0x30
push 0
push ebx
call dword [sym.imp.advapi32.dll_EnumServicesStatusExW]
test eax, eax
je 0x100509b6
jmp 0x10050a1d
push edi
push ecx
mov ecx, dword [ebp - 0x20]
push 0x1000ff20
push 5
pop edx
call fcn.1003211a
test edi, edi
jne 0x10050af9
and dword [ebp - 0x2c], 0
cmp dword [ebp - 0x14], 0
jbe 0x10050af9
mov ebx, esi
mov eax, dword [ebx + 0x24]
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
call fcn.10091a7b
mov dword [ebp - 0x30], eax
cmp eax, 0xffffffff
je 0x10050a8c
push dword [ebx]
lea ecx, [ebp - 0x20]
call fcn.1006f4e2
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x30]
test eax, eax
js 0x10050b13
mov edx, dword [ebp - 0x18]
cmp eax, dword [edx + 8]
jge 0x10050b13
imul ecx, eax, 0xc
lea eax, [ebp - 0x20]
push eax
add ecx, dword [edx + 4]
call fcn.1006e65f
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x20]
lea ecx, [ecx - 0x10]
call fcn.1008ebf5
jmp 0x10050ae3
xor eax, eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x24]
push dword [ebx]
call fcn.1006f4e2
lea eax, [ebp - 0x24]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x40]
call fcn.1006e65f
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x24]
lea ecx, [ecx - 0x10]
call fcn.1008ebf5
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.1006b833
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.1007993a
mov eax, dword [ebp - 0x2c]
add ebx, 0x2c
inc eax
mov dword [ebp - 0x2c], eax
cmp eax, dword [ebp - 0x14]
jb 0x10050a2d
mov ebx, dword [ebp - 0x34]
test esi, esi
je 0x10050b04
push esi
call fcn.10091716
pop ecx
push ebx
call dword [sym.imp.advapi32.dll_CloseServiceHandle]
mov eax, edi
call fcn.100a5651
ret
call fcn.1008cd60
int3
Function at 0x10050c1d
Capabilities:
Enumerate gui resources

Disassembly:
push 0x30
mov eax, 0x100ade5c
call fcn.100a5688
mov dword [ebp - 0x10], edx
mov esi, ecx
push 0x1001000c
lea ecx, [ebp - 0x14]
call fcn.1006f4e2
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x14]
push eax
push 0x10010020
push 0x10010068
xor ebx, ebx
lea ecx, [ebp - 0x2c]
push edi
mov dword [ebp - 4], ebx
call fcn.1002e26b
mov ecx, dword [ebp - 0x10]
call fcn.1006b69e
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x3c], ebx
push eax
push 0x10050e60
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], edi
call dword [sym.imp.USER32.dll_EnumWindows]
lea eax, [ebp - 0x20]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x3c]
call fcn.10091a7b
push ecx
push dword [ebp - 0x10]
mov edx, esi
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x20]
call fcn.10050d48
mov eax, dword [ebp - 0x10]
cmp dword [eax + 4], ebx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
jne 0x10050cc1
push 0x10010078
push 2
call dword [0x100d0614]
mov ecx, edi
call esi
jmp 0x10050d1b
push 0x100100a4
push 2
call dword [0x100d0614]
mov ecx, edi
call esi
call fcn.10050bb1
mov ecx, dword [edi]
push dword [eax]
mov esi, dword [ecx + 4]
mov ecx, esi
push 2
call dword [0x100d0614]
mov ecx, edi
call esi
mov eax, dword [ebp - 0x10]
cmp dword [eax + 4], ebx
jle 0x10050d1b
push ebx
mov ecx, eax
call fcn.10091a7b
mov ecx, dword [edi]
push dword [eax + 0x10]
mov esi, dword [ecx + 4]
mov ecx, esi
push 2
call dword [0x100d0614]
mov ecx, edi
call esi
mov eax, dword [ebp - 0x10]
inc ebx
cmp ebx, dword [eax + 4]
jl 0x10050cf4
lea ecx, [ebp - 0x20]
call fcn.1006b69e
lea ecx, [ebp - 0x3c]
call fcn.1006b69e
lea ecx, [ebp - 0x2c]
call fcn.10091a7b
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.1008ebf5
xor eax, eax
call fcn.100a5651
ret 4
Function at 0x10050e72
Capabilities:
Get graphical window text

Disassembly:
push 0x2c
mov eax, 0x100adeb2
call fcn.100a5688
mov eax, edx
mov dword [ebp - 0x1c], eax
mov edi, ecx
mov dword [ebp - 0x18], edi
lea ecx, [ebp - 0x14]
xor ebx, ebx
push ecx
push eax
mov dword [ebp - 0x14], ebx
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
call dword [sym.imp.kernel32.dll_GetCurrentProcessId]
cmp eax, dword [ebp - 0x14]
je 0x10050fd8
call fcn.1008e9f3
push eax
lea ecx, [ebp - 0x10]
call fcn.10091a7b
mov dword [ebp - 4], ebx
xor ecx, ecx
mov esi, dword [ebp - 0x10]
inc ecx
mov edx, 0x200
mov eax, dword [esi - 8]
sub ecx, dword [esi - 4]
sub eax, edx
or eax, ecx
jge 0x10050ee0
push edx
lea ecx, [ebp - 0x10]
call fcn.10091a7b
mov esi, dword [ebp - 0x10]
mov edx, 0x200
push edx
lea ecx, [ebp - 0x10]
call fcn.10091a7b
cmp dword [esi - 4], 1
mov eax, dword [esi - 8]
mov dword [ebp - 0x24], eax
jle 0x10050f06
push dword [esi - 0xc]
lea ecx, [ebp - 0x10]
call fcn.10091a7b
mov esi, dword [ebp - 0x10]
mov eax, dword [ebp - 0x24]
push eax
push esi
push dword [ebp - 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.10091a7b
push dword [edi + 0xc]
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x20]
call fcn.10091a7b
push dword [ebp - 0x1c]
mov byte [ebp - 4], 1
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
lea ecx, [ebp - 0x38]
lea eax, [ebp - 0x10]
setne byte [ebp - 0x24]
push dword [ebp - 0x24]
push eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x14]
call fcn.10050b19
mov byte [ebp - 4], 2
cmp dword [edi + 4], ebx
jle 0x10050fb2
mov ecx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x38]
push ebx
call fcn.10091a7b
cmp edi, dword [eax]
mov edi, dword [ebp - 0x18]
je 0x10050f76
inc ebx
cmp ebx, dword [edi + 4]
jl 0x10050f5b
jmp 0x10050fb2
push ebx
mov ecx, edi
call fcn.10091a7b
mov edx, eax
mov ecx, dword [edx]
sub ecx, dword [ebp - 0x38]
jne 0x10050fa6
cmp byte [edx + 0xc], cl
setne cl
xor eax, eax
cmp byte [ebp - 0x2c], al
setne al
sub ecx, eax
jne 0x10050fa6
push dword [ebp - 0x30]
lea ecx, [edx + 8]
call fcn.10091a7b
mov ecx, eax
test ecx, ecx
jns 0x10050fbd
push ebx
mov ecx, edi
call fcn.10091a7b
lea eax, [ebp - 0x38]
mov ecx, edi
push eax
call fcn.1006b72e
lea ecx, [ebp - 0x38]
call fcn.10050fe6
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
call fcn.1008ebf5
lea ecx, [esi - 0x10]
call fcn.1008ebf5
xor eax, eax
inc eax
call fcn.100a5651
ret
Function at 0x10055063
Capabilities:
Check if file exists

Disassembly:
push 0x28
mov eax, 0x100ae45f
call fcn.100a5688
mov edi, ecx
cmp dword [edi + 4], 0
je 0x10055280
push 0
push 0x100c9500
mov esi, 0x100c9520
push esi
push 0
push dword [edi + 4]
call fcn.100a698d
mov ebx, eax
add esp, 0x14
test ebx, ebx
jne 0x100550a2
mov al, 1
jmp 0x10055282
push 0
push 0x100c9424
push esi
push 0
push dword [edi + 4]
call fcn.100a698d
add esp, 0x14
mov dword [ebp - 0x10], eax
test eax, eax
je 0x100550d6
mov ecx, dword [eax]
push 0
mov esi, dword [ecx + 4]
mov ecx, esi
call dword [0x100d0614]
mov ecx, dword [ebp - 0x10]
call esi
test al, al
je 0x1005509b
lea eax, [ebp - 0x10]
mov ecx, ebx
push eax
call fcn.10091a7b
push dword [eax]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ecx, dword [ebp - 0x10]
mov esi, eax
add ecx, 0xfffffff0
call fcn.1008ebf5
test esi, esi
je 0x1005524b
push 0
push 0x100c9400
push 0x100c9520
push 0
push dword [edi + 4]
call fcn.100a698d
mov esi, eax
add esp, 0x14
mov dword [ebp - 0x14], esi
test esi, esi
je 0x1005509b
lea eax, [ebp - 0x10]
mov ecx, ebx
push eax
call fcn.10091a7b
and dword [ebp - 4], 0
cmp byte [ebp + 8], 0
je 0x100551ec
lea eax, [ebp - 0x1c]
mov ecx, esi
push eax
call fcn.10091a7b
mov esi, eax
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 1
push eax
mov ecx, ebx
call fcn.10091a7b
push dword [ebp + 0x14]
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x14]
push dword [ecx + 0x14]
push dword [ecx + 0x10]
lea ecx, [ebp - 0x10]
push esi
push ecx
push eax
lea ecx, [ebp - 0x34]
call fcn.10091a7b
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.1008ebf5
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x1c]
lea ecx, [ecx - 0x10]
call fcn.1008ebf5
lea ecx, [ebp - 0x34]
call fcn.10054cf4
test eax, eax
jns 0x100551c4
push eax
push dword [ebp - 0x10]
lea eax, [ebp - 0x14]
push 0x10010db0
push 7
push dword [ebp + 0x14]
push eax
call fcn.1002e335
mov ecx, dword [ebp - 0x20]
add esp, 0x18
lea ecx, [ecx - 0x10]
call fcn.1008ebf5
jmp 0x1005521d
push dword [ebp - 0x10]
lea eax, [ebp - 0x14]
push 0x10010e98
push 4
push dword [ebp + 0x14]
push eax
call fcn.1002e335
mov byte [ebp - 4], 0
add esp, 0x14
mov ecx, dword [ebp - 0x20]
lea ecx, [ecx - 0x10]
call fcn.1008ebf5
cmp byte [ebp + 0xc], 0
je 0x1005523b
lea eax, [ebp - 0x1c]
mov ecx, ebx
push eax
call fcn.10091a7b
mov edx, dword [ebp + 0x14]
mov ecx, eax
mov byte [ebp - 4], 6
call fcn.10091a7b
mov ecx, dword [ebp - 0x1c]
mov ebx, eax
add ecx, 0xfffffff0
call fcn.1008ebf5
cmp ebx, 0xffffffff
jne 0x10055222
mov eax, dword [ebp - 0x10]
jmp 0x10055278
mov esi, dword [edi + 4]
cmp dword [esi + 0xc], 0
je 0x10055234
push dword [esi + 0xc]
call dword [sym.imp.kernel32.dll_CloseHandle]
mov dword [esi + 0xc], ebx
mov byte [edi + 8], 1
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.1008ebf5
jmp 0x1005509b
lea eax, [ebp - 0x1c]
mov ecx, ebx
push eax
call fcn.10091a7b
mov dword [ebp - 4], 7
push dword [eax]
lea eax, [ebp - 0x18]
push 0x10010ee0
push 4
push dword [ebp + 0x14]
push eax
call fcn.1002e335
mov eax, dword [ebp - 0x1c]
add esp, 0x14
lea ecx, [eax - 0x10]
call fcn.1008ebf5
xor al, al
call fcn.100a5651
ret 0x10