joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414560
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.0042af32
mov esi, dword [eax + 0xc]
push 0x57d088
push 0x81
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x41458d
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x4145d4
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push ebx
push edi
push eax
call fcn.00528a40
add esp, 0xc
lea eax, [ebp - 4]
push eax
push 0
push esi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
je 0x4145df
pop ebx
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
push ecx
call fcn.00414290
mov edx, dword [ebp + 8]
add esp, 4
push esi
mov dword [edx], eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop ebx
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x4159e0
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov eax, dword [0x5a4e60]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x114
xor esi, esi
lea eax, [ebp - 0x118]
push esi
push eax
call fcn.00525e90
add esp, 0xc
lea ecx, [ebp - 0x118]
push ecx
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x415abc
cmp dword [ebp - 0x114], 5
jbe 0x415abc
lea edx, [ebp - 0x11c]
push edx
push 0x20019
push esi
mov eax, 4
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem_
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x11c], esi
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x120], esi
mov dword [ebp - 0x124], eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x415abc
lea eax, [ebp - 0x124]
push eax
mov eax, dword [ebp - 0x11c]
lea ecx, [ebp - 0x120]
push ecx
lea edx, [ebp - 0x128]
push edx
push esi
push str.EnableLUA
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x415aaf
xor ecx, ecx
cmp dword [ebp - 0x120], 1
sete cl
mov esi, ecx
mov edx, dword [ebp - 0x11c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00523022
mov esp, ebp
pop ebp
ret
Function at 0x417030
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1b0
mov eax, dword [0x5a4e60]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push esi
push edi
mov dword [ebp - 0x1b0], 0
mov dword [ebp - 0x1ac], eax
mov dword [ebp - 0x1a8], eax
mov dword [ebp - 0x1a4], eax
mov dword [ebp - 0x1a0], eax
mov dword [ebp - 0x19c], eax
mov dword [ebp - 0x198], eax
mov dword [ebp - 0x194], eax
mov dword [ebp - 0x190], eax
mov dword [ebp - 0x18c], eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push 5
push eax
call dword [sym.imp.USER32.dll_GetWindow]
mov esi, eax
test esi, esi
je 0x417174
mov edi, dword [sym.imp.USER32.dll_GetClassNameW]
lea eax, [ebp - 0x1b0]
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetWindowTextW]
mov dword [ebp - 0x188], eax
lea esp, [esp]
push 0x40
lea ecx, [ebp - 0x84]
push ecx
push esi
call edi
push 0x80
lea edx, [ebp - 0x184]
push edx
push esi
call ebx
mov ecx, 0x57c8c8
lea eax, [ebp - 0x184]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x41710c
test dx, dx
je 0x417108
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x41710c
add eax, 4
add ecx, 4
test dx, dx
jne 0x4170e6
xor eax, eax
jmp 0x417111
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x417160
mov ecx, str.32770
lea eax, [ebp - 0x84]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x417146
test dx, dx
je 0x417142
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x417146
add eax, 4
add ecx, 4
test dx, dx
jne 0x417120
xor eax, eax
jmp 0x41714b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x417160
mov eax, dword [ebp - 0x188]
mov dword [eax], esi
add eax, 4
mov dword [ebp - 0x188], eax
push 2
push esi
call dword [sym.imp.USER32.dll_GetWindow]
mov esi, eax
test esi, esi
jne 0x4170c0
pop ebx
mov edi, dword [sym.imp.USER32.dll_PostMessageW]
xor esi, esi
lea esp, [esp]
mov eax, dword [ebp + esi*4 - 0x1b0]
test eax, eax
je 0x41719d
push 0
push 0
push 0x404
push eax
call edi
inc esi
cmp esi, 0xa
jl 0x417180
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00523022
mov esp, ebp
pop ebp
ret
Function at 0x4171c0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x294
mov eax, dword [0x5a4e60]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push edi
xor ecx, ecx
push 0x206
push ecx
lea edx, [ebp - 0x28a]
push edx
mov dword [ebp - 0x294], eax
mov word [ebp - 0x28c], cx
call fcn.00525e90
mov ebx, str.Statistic.ini
lea edi, [ebp - 0x28c]
call fcn.0040a3d0
xor eax, eax
push 0x3e
push eax
lea ecx, [ebp - 0x82]
push ecx
mov word [ebp - 0x84], ax
call fcn.00525e90
xor edx, edx
push 0x3e
push edx
lea eax, [ebp - 0x42]
push eax
mov word [ebp - 0x44], dx
call fcn.00525e90
add esp, 0x24
mov ecx, edi
push ecx
push 0x20
lea edx, [ebp - 0x44]
push edx
push str.0_121
push str.ShortKey
push 0x57cd64
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x290]
call fcn.00404770
mov eax, dword [ebp - 0x290]
cmp dword [eax - 0xc], 0
pop edi
pop ebx
jle 0x4172aa
push 0x2c
push eax
call fcn.00523e32
add esp, 8
test eax, eax
je 0x4172aa
sub eax, dword [ebp - 0x290]
sar eax, 1
cmp eax, 0xffffffff
je 0x4172aa
lea edx, [ebp + eax*2 - 0x42]
xor ecx, ecx
push edx
mov word [ebp + eax*2 - 0x44], cx
lea eax, [ebp - 0x84]
push 0x20
push eax
call fcn.005231b8
add esp, 0xc
lea ecx, [ebp - 0x44]
push ecx
call fcn.00523a4c
lea edx, [ebp - 0x84]
push edx
mov dword [esi], eax
call fcn.00523a4c
mov ecx, dword [ebp - 0x294]
mov dword [ecx], eax
mov eax, dword [ebp - 0x290]
add eax, 0xfffffff0
add esp, 8
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4172ee
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 1
call fcn.00523022
mov esp, ebp
pop ebp
ret 4
Function at 0x417310
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x294
mov eax, dword [0x5a4e60]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push edi
xor ecx, ecx
push 0x206
push ecx
lea edx, [ebp - 0x28a]
push edx
mov dword [ebp - 0x294], eax
mov word [ebp - 0x28c], cx
call fcn.00525e90
mov ebx, str.Statistic.ini
lea edi, [ebp - 0x28c]
call fcn.0040a3d0
xor eax, eax
push 0x3e
push eax
lea ecx, [ebp - 0x82]
push ecx
mov word [ebp - 0x84], ax
call fcn.00525e90
xor edx, edx
push 0x3e
push edx
lea eax, [ebp - 0x42]
push eax
mov word [ebp - 0x44], dx
call fcn.00525e90
add esp, 0x24
mov ecx, edi
push ecx
push 0x20
lea edx, [ebp - 0x44]
push edx
push 0x580600
push str.AltWndKey
push 0x57cd64
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x290]
call fcn.00404770
mov eax, dword [ebp - 0x290]
cmp dword [eax - 0xc], 0
pop edi
pop ebx
jle 0x4173fa
push 0x2c
push eax
call fcn.00523e32
add esp, 8
test eax, eax
je 0x4173fa
sub eax, dword [ebp - 0x290]
sar eax, 1
cmp eax, 0xffffffff
je 0x4173fa
lea edx, [ebp + eax*2 - 0x42]
xor ecx, ecx
push edx
mov word [ebp + eax*2 - 0x44], cx
lea eax, [ebp - 0x84]
push 0x20
push eax
call fcn.005231b8
add esp, 0xc
lea ecx, [ebp - 0x44]
push ecx
call fcn.00523a4c
lea edx, [ebp - 0x84]
push edx
mov dword [esi], eax
call fcn.00523a4c
mov ecx, dword [ebp - 0x294]
mov dword [ecx], eax
mov eax, dword [ebp - 0x290]
add eax, 0xfffffff0
add esp, 8
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41743e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 1
call fcn.00523022
mov esp, ebp
pop ebp
ret 4
Function at 0x417460
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x294
mov eax, dword [0x5a4e60]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push edi
xor ecx, ecx
push 0x206
push ecx
lea edx, [ebp - 0x28a]
push edx
mov dword [ebp - 0x294], eax
mov word [ebp - 0x28c], cx
call fcn.00525e90
mov ebx, str.Statistic.ini
lea edi, [ebp - 0x28c]
call fcn.0040a3d0
xor eax, eax
push 0x3e
push eax
lea ecx, [ebp - 0x82]
push ecx
mov word [ebp - 0x84], ax
call fcn.00525e90
xor edx, edx
push 0x3e
push edx
lea eax, [ebp - 0x42]
push eax
mov word [ebp - 0x44], dx
call fcn.00525e90
add esp, 0x24
mov ecx, edi
push ecx
push 0x20
lea edx, [ebp - 0x44]
push edx
push str.2_81
push str.SndKey
push 0x57cd64
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x290]
call fcn.00404770
mov eax, dword [ebp - 0x290]
cmp dword [eax - 0xc], 0
pop edi
pop ebx
jle 0x41754a
push 0x2c
push eax
call fcn.00523e32
add esp, 8
test eax, eax
je 0x41754a
sub eax, dword [ebp - 0x290]
sar eax, 1
cmp eax, 0xffffffff
je 0x41754a
lea edx, [ebp + eax*2 - 0x42]
xor ecx, ecx
push edx
mov word [ebp + eax*2 - 0x44], cx
lea eax, [ebp - 0x84]
push 0x20
push eax
call fcn.005231b8
add esp, 0xc
lea ecx, [ebp - 0x44]
push ecx
call fcn.00523a4c
lea edx, [ebp - 0x84]
push edx
mov dword [esi], eax
call fcn.00523a4c
mov ecx, dword [ebp - 0x294]
mov dword [ecx], eax
mov eax, dword [ebp - 0x290]
add eax, 0xfffffff0
add esp, 8
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41758e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 1
call fcn.00523022
mov esp, ebp
pop ebp
ret 4
Function at 0x418aa0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa1c
mov eax, dword [0x5a4e60]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
cmp ax, word [esi]
jne 0x418ac8
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00523022
mov esp, ebp
pop ebp
ret
push ebx
push edi
mov ebx, str.Statistic.ini
lea edi, [ebp - 0x21c]
call fcn.0040a3d0
mov ecx, edi
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push ecx
push 0x400
lea edx, [ebp - 0xa1c]
push edx
push 0x57d1a4
push str.PopInfo
push 0x57cd64
call edi
lea eax, [ebp - 0xa1c]
push eax
push esi
call fcn.00523c27
add esp, 8
test eax, eax
je 0x418bab
xor ecx, ecx
cmp cx, word [ebp - 0xa1c]
je 0x418bab
lea edx, [ebp - 0x21c]
push edx
push 8
lea eax, [ebp - 0x14]
push eax
push 0x57d1a4
push str.PopEnable
push 0x57cd64
call edi
lea ecx, [ebp - 0x14]
mov eax, 0x57cd60
lea ecx, [ecx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x418b8d
test dx, dx
je 0x418b72
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x418b8d
add eax, 4
add ecx, 4
test dx, dx
jne 0x418b50
xor eax, eax
xor ecx, ecx
test eax, eax
setne cl
pop edi
pop ebx
mov eax, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00523022
mov esp, ebp
pop ebp
ret
sbb eax, eax
sbb eax, 0xffffffff
xor ecx, ecx
test eax, eax
setne cl
pop edi
pop ebx
mov eax, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00523022
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.00523022
mov esp, ebp
pop ebp
ret
Function at 0x41aa60
Capabilities:
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x910
mov eax, dword [0x5a4e60]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
call fcn.00424e6a
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x30a]
push ecx
mov dword [ebp - 0x910], 0
mov word [ebp - 0x30c], ax
call fcn.00525e90
xor edx, edx
push 0xfe
push edx
lea eax, [ebp - 0x102]
push eax
mov word [ebp - 0x104], dx
call fcn.00525e90
mov ecx, dword [esi + 0x98]
push ecx
push ecx
push 0x580fa0
lea eax, [ebp - 0x90c]
push 0x200
push eax
call fcn.0052350d
add esp, 0x2c
push 0
push 0
push 0x200
lea ecx, [ebp - 0x50c]
push ecx
push 0xffffffffffffffff
lea edx, [ebp - 0x90c]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea eax, [ebp - 0x30c]
push eax
push 0
push 0
push 6
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push 0x80
lea ecx, [ebp - 0x104]
push ecx
push 0x3fa
mov ecx, esi
call fcn.00426271
push 0x57e3c4
lea edx, [ebp - 0x30c]
push 0x104
push edx
call fcn.00523249
lea eax, [ebp - 0x104]
push eax
lea ecx, [ebp - 0x30c]
push 0x104
push ecx
call fcn.00523249
push str..url
lea edx, [ebp - 0x30c]
push 0x104
push edx
call fcn.00523249
push 0x57d018
lea eax, [ebp - 0x30c]
push eax
lea ecx, [ebp - 0x910]
push ecx
call fcn.00523f17
add esp, 0x30
lea eax, [ebp - 0x50c]
lea edx, [eax + 1]
pop esi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41ab95
sub eax, edx
mov edx, dword [ebp - 0x910]
push edx
push 1
push eax
lea eax, [ebp - 0x50c]
push eax
call fcn.005240b5
mov ecx, dword [ebp - 0x910]
push ecx
call fcn.0052419c
mov ecx, dword [ebp - 4]
xor ecx, ebp
add esp, 0x14
call fcn.00523022
mov esp, ebp
pop ebp
ret

Function at 0x41b6f8
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x5a4e60]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0x800
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0x234], eax
mov esi, ecx
lea eax, [ebp - 0xc]
jne 0x41b73d
push 0x550120
push 4
push eax
call fcn.005231b8
push eax
call fcn.004048d0
add esp, 0x10
jmp 0x41b753
push 4
push eax
push 3
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x41b7d3
push edi
call fcn.00525a4f
mov edi, dword [eax]
call fcn.00525a4f
and dword [eax], 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x234]
lea eax, [ebp - 0x230]
push esi
push 0x111
mov esi, 0x112
push esi
push eax
call fcn.0052352b
add esp, 0x18
mov dword [ebp - 0x234], eax
call fcn.00525a4f
cmp dword [eax], 0
je 0x41b7a7
call fcn.00525a4f
push dword [eax]
call fcn.0041af78
pop ecx
jmp 0x41b7ae
call fcn.00525a4f
mov dword [eax], edi
cmp dword [ebp - 0x234], 0xffffffff
pop edi
je 0x41b7d3
cmp dword [ebp - 0x234], esi
jae 0x41b7d3
push 0
push 0
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
jmp 0x41b7d5
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00523022
leave
ret
Function at 0x41be85
Capabilities:
Identify system language via api

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [0x5a4e60]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x144], eax
mov eax, dword [ebp + 0xc]
push edi
push str.KERNEL32.DLL
mov dword [ebp - 0x13c], eax
xor esi, esi
call fcn.0041bd33
pop ecx
cmp eax, esi
je 0x41bf6f
push str.GetThreadPreferredUILanguages
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
cmp edi, esi
je 0x41bf6f
xor eax, eax
push 0xc8
mov word [ebp - 0xd0], ax
lea eax, [ebp - 0xce]
push esi
push eax
mov dword [ebp - 0x140], esi
call fcn.00525e90
add esp, 0xc
lea eax, [ebp - 0x138]
push eax
lea eax, [ebp - 0xd0]
push eax
lea eax, [ebp - 0x140]
push eax
push 0x34
mov dword [ebp - 0x138], 0x65
call edi
test eax, eax
je 0x41bf6f
lea edi, [ebp - 0xd0]
cmp word [ebp - 0xd0], si
je 0x41bf6f
cmp esi, 0x14
jge 0x41bf6f
push 0x10
push 0
push edi
call fcn.00525e6b
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x41bf5e
call fcn.00525a4f
cmp dword [eax], 0x22
je 0x41bf5e
mov dword [ebp + esi*4 - 0x134], ebx
inc esi
push edi
call fcn.005254b8
lea edi, [edi + eax*2 + 2]
cmp word [edi], 0
pop ecx
jne 0x41bf34
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov edi, dword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
movzx eax, ax
mov ecx, eax
and ecx, 0x3ff
mov ebx, 0xfc00
and eax, ebx
or eax, ecx
push eax
mov dword [ebp - 0x138], ecx
call edi
push dword [ebp - 0x138]
mov dword [ebp + esi*4 - 0x134], eax
call edi
mov dword [ebp + esi*4 - 0x130], eax
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
movzx eax, ax
mov ecx, eax
and ecx, 0x3ff
and eax, ebx
or eax, ecx
push eax
mov dword [ebp - 0x138], ecx
call edi
push dword [ebp - 0x138]
mov dword [ebp + esi*4 - 0x12c], eax
call edi
mov dword [ebp + esi*4 - 0x128], eax
add esi, 4
cmp dword [0x5a6c0c], 0
jne 0x41bffa
mov dword [ebp + esi*4 - 0x134], 0x800
inc esi
xor edi, edi
test esi, esi
jle 0x41c023
push dword [ebp + edi*4 - 0x134]
mov ecx, dword [ebp - 0x144]
push dword [ebp - 0x13c]
call fcn.0041b6f8
pop ecx
pop ecx
test eax, eax
jne 0x41c025
inc edi
cmp edi, esi
jl 0x41c000
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00523022
leave
ret 8
Function at 0x41d97c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
cmp dword [ebp + 0xc], ebx
je 0x41d9c4
call fcn.0042af32
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x41d9c4
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
test eax, eax
je 0x41da07
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
test ebx, ebx
je 0x41d9f0
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x41d9f0
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x68], 0
je 0x41da04
mov ecx, dword [esi + 0x68]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x424ca9
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x424cf0
call fcn.0042af32
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x424cf0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x424d0c
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.004247a9
mov esi, eax
test edi, edi
je 0x424d0a
test ebx, ebx
je 0x424d0a
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x425779
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor ebx, ebx
call fcn.0042af32
mov esi, dword [eax + 0xc]
push 5
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x4257b2
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov ecx, dword [ebp - 4]
push esi
push dword [ebp + 0xc]
push ebx
call fcn.004253b6
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8
Function at 0x425810
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x78], ebx
test ebx, 0xffff0000
jne 0x425834
cmp dword [edi + 0x74], 0
jne 0x425834
movzx eax, bx
mov dword [edi + 0x74], eax
call fcn.0042af32
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.004257d1
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x4269cd
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x5461a7
call fcn.005258b7
mov esi, ecx
cmp dword [esi + 0x6c], 0
jne 0x4269f2
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x426a44
call fcn.0041d189
push eax
lea ecx, [ebp - 0x10]
call fcn.00404160
mov ecx, dword [esi + 0x6c]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0052482b
push eax
call fcn.004048d0
add esp, 0x14
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00404460
mov eax, esi
call fcn.0052598f
ret 8

Function at 0x42b311
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push dword [ebp + 0xc]
mov ecx, esi
call fcn.0042afb5
cmp dword [esi], 0
mov edi, eax
mov dword [esi + 0xc], 1
je 0x42b35b
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.0041d08a
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.00415dd0
jmp 0x42b366
mov eax, dword [ebp + 0x10]
push dword [eax]
push edi
call fcn.00441e57
pop edi
pop esi
pop ebp
ret 0xc