joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c983
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x4131b8], ebx
push esi
push edi
jne 0x40ca03
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x40ca3e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
mov dword [0x4131b8], eax
je 0x40ca3e
push str.GetActiveWindow
push edi
call esi
push str.GetLastActivePopup
push edi
mov dword [0x4131bc], eax
call esi
cmp dword [0x412d4c], 2
mov dword [0x4131c0], eax
jne 0x40ca03
push str.GetUserObjectInformationA
push edi
call esi
test eax, eax
mov dword [0x4131c8], eax
je 0x40ca03
push str.GetProcessWindowStation
push edi
call esi
mov dword [0x4131c4], eax
mov eax, dword [0x4131c4]
test eax, eax
je 0x40ca48
call eax
test eax, eax
je 0x40ca2f
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x4131c8]
test eax, eax
je 0x40ca2f
test byte [ebp - 8], 1
jne 0x40ca48
cmp dword [0x412d58], 4
jb 0x40ca42
or byte [ebp + 0x12], 0x20
jmp 0x40ca67
xor eax, eax
jmp 0x40ca77
or byte [ebp + 0x12], 4
jmp 0x40ca67
mov eax, dword [0x4131bc]
test eax, eax
je 0x40ca67
call eax
mov ebx, eax
test ebx, ebx
je 0x40ca67
mov eax, dword [0x4131c0]
test eax, eax
je 0x40ca67
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x4131b8]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40cc88
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.00404b30
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x40cd23
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x412d4c]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x40cd23
cmp eax, 1
je 0x40cd44
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x40cd23
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x40ccf0
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x40cd1f
xor eax, eax
inc eax
jmp 0x40cd63
cmp edi, eax
jae 0x40cd27
xor eax, eax
jmp 0x40cd63
cmp eax, esi
jae 0x40cd2e
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x412d4c]
jmp 0x40cd47
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40d36a
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
je 0x40d398
add al, 0x40
mov byte [ebp + 8], al
lea eax, [ebp + 8]
push eax
mov byte [ebp + 9], 0x3a
mov byte [ebp + 0xa], 0x5c
mov byte [ebp + 0xb], 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
test eax, eax
je 0x40d39d
cmp eax, 1
je 0x40d39d
xor eax, eax
inc eax
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x40d3a1
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x412100]
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
mov dword [ebp - 4], eax
je 0x40d419
push ebx
call fcn.0040d36a
test eax, eax
pop ecx
jne 0x40d3e8
call fcn.004092fb
mov dword [eax], 0xf
call fcn.004092f2
mov dword [eax], 0xd
xor eax, eax
mov ecx, dword [ebp - 4]
pop ebx
call fcn.00404b17
leave
ret
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x108]
push eax
push 0x104
lea eax, [ebp + 8]
add bl, 0x40
push eax
mov byte [ebp + 8], bl
mov byte [ebp + 9], 0x3a
mov byte [ebp + 0xa], 0x2e
mov byte [ebp + 0xb], 0
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
jmp 0x40d42b
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x40d3db
inc eax
cmp eax, 0x104
ja 0x40d3db
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jne 0x40d463
cmp eax, dword [ebp + 0x10]
jg 0x40d446
mov eax, dword [ebp + 0x10]
push eax
call fcn.00406516
pop ecx
mov ecx, eax
test ecx, ecx
jne 0x40d478
call fcn.004092f2
mov dword [eax], 0xc
jmp 0x40d3db
cmp eax, dword [ebp + 0x10]
jle 0x40d478
call fcn.004092f2
mov dword [eax], 0x22
jmp 0x40d3db
lea eax, [ebp - 0x108]
push eax
push ecx
call fcn.0040adb0
pop ecx
pop ecx
jmp 0x40d3dd
Function at 0x40dd7c
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x100c
call fcn.00404b30
mov eax, dword [0x412100]
push ebx
push esi
push 1
xor esi, esi
push esi
push dword [ebp + 8]
mov dword [ebp - 4], eax
call fcn.0040a0ca
or ebx, 0xffffffff
add esp, 0xc
cmp eax, ebx
mov dword [ebp - 0x1008], eax
je 0x40deaf
push 2
push esi
push dword [ebp + 8]
call fcn.0040a0ca
add esp, 0xc
cmp eax, ebx
je 0x40deaf
push edi
mov edi, dword [ebp + 0xc]
sub edi, eax
test edi, edi
jle 0x40de4f
mov ebx, 0x1000
push ebx
lea eax, [ebp - 0x1004]
push esi
push eax
call fcn.0040bd50
push 0x8000
push dword [ebp + 8]
call fcn.0040e001
add esp, 0x14
mov dword [ebp - 0x100c], eax
cmp edi, ebx
mov eax, ebx
jge 0x40de05
mov eax, edi
push eax
lea eax, [ebp - 0x1004]
push eax
push dword [ebp + 8]
call fcn.0040973c
add esp, 0xc
cmp eax, 0xffffffff
je 0x40de25
sub edi, eax
test edi, edi
jg 0x40ddfd
jmp 0x40de3d
call fcn.004092fb
cmp dword [eax], 5
jne 0x40de3a
call fcn.004092f2
mov dword [eax], 0xd
or esi, 0xffffffff
push dword [ebp - 0x100c]
push dword [ebp + 8]
call fcn.0040e001
pop ecx
pop ecx
jmp 0x40de97
jge 0x40de97
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040a0ca
push dword [ebp + 8]
call fcn.0040d050
add esp, 0x10
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov esi, eax
neg esi
sbb esi, esi
neg esi
dec esi
cmp esi, ebx
jne 0x40de97
call fcn.004092f2
mov dword [eax], 0xd
call fcn.004092fb
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi], eax
push 0
push dword [ebp - 0x1008]
push dword [ebp + 8]
call fcn.0040a0ca
add esp, 0xc
mov eax, esi
pop edi
jmp 0x40deb1
mov eax, ebx
mov ecx, dword [ebp - 4]
pop esi
pop ebx
call fcn.00404b17
leave
ret
Function at 0x40e4bb
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
cmp eax, ebx
push edi
mov dword [ebp - 0x10], ebx
jne 0x40e4d4
or eax, 0xffffffff
jmp 0x40e535
push esi
mov esi, dword [eax]
cmp esi, ebx
mov dword [ebp - 4], esi
je 0x40e531
push 0x3d
push esi
call fcn.004051df
cmp eax, ebx
pop ecx
pop ecx
mov dword [ebp - 0xc], eax
je 0x40e531
cmp esi, eax
je 0x40e531
xor ecx, ecx
cmp byte [eax + 1], bl
mov eax, dword [0x412d6c]
sete cl
cmp eax, dword [0x412d70]
mov dword [ebp - 8], ecx
jne 0x40e517
mov edi, eax
call fcn.0040e45a
mov dword [0x412d6c], eax
cmp eax, ebx
jne 0x40e570
cmp dword [ebp + 0xc], ebx
je 0x40e539
cmp dword [0x412d74], ebx
je 0x40e539
call fcn.0040df0b
test eax, eax
je 0x40e570
or eax, 0xffffffff
pop esi
pop edi
pop ebx
leave
ret
cmp dword [ebp - 8], ebx
je 0x40e542
xor eax, eax
jmp 0x40e534
push 4
call fcn.00406516
cmp eax, ebx
pop ecx
mov dword [0x412d6c], eax
je 0x40e531
mov dword [eax], ebx
cmp dword [0x412d74], ebx
jne 0x40e570
push 4
call fcn.00406516
cmp eax, ebx
pop ecx
mov dword [0x412d74], eax
je 0x40e531
mov dword [eax], ebx
mov edi, dword [ebp - 0xc]
sub edi, dword [ebp - 4]
push dword [ebp - 4]
mov esi, dword [0x412d6c]
call fcn.0040e40d
mov edi, eax
cmp edi, ebx
pop ecx
jl 0x40e5d1
cmp dword [esi], ebx
je 0x40e5d1
lea esi, [esi + edi*4]
push dword [esi]
call fcn.00405fe9
cmp dword [ebp - 8], ebx
pop ecx
jne 0x40e5b4
mov eax, dword [ebp - 4]
mov dword [esi], eax
mov eax, dword [ebp + 8]
mov dword [eax], ebx
jmp 0x40e612
mov eax, dword [esi + 4]
mov dword [esi], eax
inc edi
add esi, 4
cmp dword [esi], ebx
jne 0x40e5ab
mov eax, edi
shl eax, 2
push eax
push dword [0x412d6c]
call fcn.0040756c
cmp eax, ebx
pop ecx
pop ecx
je 0x40e612
jmp 0x40e60d
cmp dword [ebp - 8], ebx
jne 0x40e67d
cmp edi, ebx
jge 0x40e5e0
neg edi
lea eax, [edi*4 + 8]
push eax
push dword [0x412d6c]
call fcn.0040756c
cmp eax, ebx
pop ecx
pop ecx
je 0x40e531
mov edx, dword [ebp - 4]
lea ecx, [eax + edi*4]
mov dword [ecx], edx
mov dword [ecx + 4], ebx
mov ecx, dword [ebp + 8]
mov dword [ecx], ebx
mov dword [0x412d6c], eax
cmp dword [ebp + 0xc], ebx
je 0x40e667
push dword [ebp - 4]
call fcn.00406550
inc eax
inc eax
push eax
call fcn.00406516
mov esi, eax
cmp esi, ebx
pop ecx
pop ecx
je 0x40e667
push dword [ebp - 4]
push esi
call fcn.0040adb0
mov eax, esi
sub eax, dword [ebp - 4]
pop ecx
add eax, dword [ebp - 0xc]
pop ecx
mov ecx, dword [ebp - 8]
mov byte [eax], bl
inc eax
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test eax, eax
jne 0x40e660
or dword [ebp - 0x10], 0xffffffff
push esi
call fcn.00405fe9
pop ecx
cmp dword [ebp - 8], ebx
je 0x40e675
push dword [ebp - 4]
call fcn.00405fe9
pop ecx
mov eax, dword [ebp - 0x10]
jmp 0x40e534
push dword [ebp - 4]
call fcn.00405fe9
mov eax, dword [ebp + 8]
pop ecx
mov dword [eax], ebx
jmp 0x40e53e
Function at 0x402a30
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
push 0x4e34
mov ecx, ebp
call fcn.00403c60
mov esi, dword [ebp + 4]
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + 4]
push 0
push 0x4e33
push esi
push ecx
call dword [sym.imp.WS2_32.dll_recv]
mov ebx, eax
test ebx, ebx
jle 0x402ac8
xor edx, edx
mov dx, word [esi + 2]
push edx
call dword [sym.imp.WS2_32.dll_ntohs]
movzx esi, ax
cmp ebx, esi
mov dword [esp + 0x18], esi
jg 0x402ac8
lea eax, [esi + 1]
push eax
mov ecx, ebp
call fcn.00403c60
cmp ebx, esi
jge 0x402ab7
mov edi, dword [ebp + 4]
sub esi, ebx
add edi, ebx
test esi, esi
jle 0x402ab3
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx + 4]
push 0
push esi
push edi
push edx
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x402ac8
sub esi, eax
add edi, eax
test esi, esi
jg 0x402a95
mov esi, dword [esp + 0x18]
mov eax, dword [ebp + 4]
pop edi
mov byte [esi + eax], 0
pop esi
pop ebp
mov eax, 1
pop ebx
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret

Function at 0x402d00
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4106c0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebp
push esi
push edi
push 0x41145f
lea ecx, [esp + 0x18]
call fcn.00405d10
mov esi, dword [esp + 0x38]
mov edi, dword [esp + 0x34]
lea eax, [esp + 0x14]
push eax
push esi
push edi
mov dword [esp + 0x30], 0
call fcn.00402ca0
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x38]
mov ebp, dword [sym.imp.USER32.dll_SetWindowTextA]
add esp, 0xc
push ecx
push edx
call ebp
push 0x41145f
lea ecx, [esp + 0x10]
call fcn.00405d10
lea eax, [esp + 0xc]
push eax
push esi
push edi
mov byte [esp + 0x30], 1
call fcn.00402bd0
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x3c]
add esp, 0xc
push ecx
push edx
call ebp
lea ecx, [esp + 0xc]
mov byte [esp + 0x24], 0
call fcn.00405b60
lea ecx, [esp + 0x14]
mov dword [esp + 0x24], 0xffffffff
call fcn.00405b60
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x1c
ret
Function at 0x403aa0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x41085f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
mov eax, dword [0x4144a0]
xor eax, dword [esp + 0x50]
push ebp
push esi
mov esi, ecx
mov dword [esp + 0x48], eax
push edi
mov dword [esp + 0xc], esi
call fcn.00401770
lea edi, [esi + 0x10]
xor ebp, ebp
mov ecx, edi
mov dword [esp + 0x58], ebp
mov dword [esi], 0x4114e8
call fcn.00401770
mov dword [edi], 0x41142c
lea ecx, [esi + 0x20]
mov byte [esp + 0x58], 1
call fcn.004046a0
lea ecx, [esi + 0x7c]
mov byte [esp + 0x58], 2
call fcn.00404090
lea ecx, [esi + 0xf0]
mov byte [esp + 0x58], 3
call fcn.00404f00
lea ecx, [esi + 0x124]
mov byte [esp + 0x58], 4
call fcn.00401d40
mov dword [esi + 0x128], 0x411460
mov dword [esi + 0x12c], 0xffffffff
lea edi, [esi + 0x134]
mov ecx, edi
call fcn.00402f40
mov dword [edi], 0x4115d0
lea eax, [esi + 0x14c]
push eax
call dword [sym.imp.KERNEL32.DLL_InitializeCriticalSection]
lea ecx, [esi + 0x164]
mov byte [esp + 0x58], 8
call fcn.00401a20
xor eax, eax
mov ecx, 0xf
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
push 0x411654
lea eax, [esp + 0x30]
mov dword [esi + 0x130], ebp
mov dword [esi + 0x144], ebp
push eax
mov dword [esi + 0x78], ebp
mov dword [esi + 0x148], ebp
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
lea ecx, [esp + 0x10]
push ecx
mov dword [esp + 0x24], 0x190
mov dword [esp + 0x14], 0xfffffff4
mov byte [esp + 0x2b], 0x86
mov byte [esp + 0x2c], 1
mov byte [esp + 0x2d], 2
mov byte [esp + 0x2e], 1
mov byte [esp + 0x2f], 0x31
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
push 1
push 1
mov dword [esi + 0xec], eax
call fcn.004042a0
add esp, 8
call fcn.00402310
mov dword [0x415338], eax
pop edi
mov eax, esi
pop esi
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x44]
xor ecx, dword [esp + 0x54]
pop ebp
add esp, 0x50
jmp fcn.00406097

Function at 0x4042a0
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x194
mov eax, dword [0x4144a0]
xor eax, dword [esp + 0x194]
xor ecx, ecx
mov ch, byte [esp + 0x19c]
push ebx
mov ebx, dword [esp + 0x19c]
mov dword [esp + 0x194], eax
lea eax, [esp + 4]
push eax
mov cl, bl
push ecx
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x404318
mov ax, word [esp + 4]
movzx edx, al
cmp edx, ebx
jne 0x404312
mov ecx, dword [esp + 0x1a0]
movzx eax, ah
cmp eax, ecx
jne 0x404312
mov al, 1
pop ebx
mov ecx, dword [esp + 0x190]
xor ecx, dword [esp + 0x194]
add esp, 0x194
jmp fcn.00406097
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [esp + 0x194]
xor al, al
xor ecx, dword [esp + 0x198]
pop ebx
add esp, 0x194
jmp fcn.00406097
Function at 0x404340
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
mov eax, dword [esp + 0x114]
push esi
xor edx, edx
mov esi, 0x3e8
div esi
mov dword [esp + 0xc], 1
pop esi
imul edx, edx, 0x3e8
mov dword [esp], eax
mov eax, dword [ecx + 4]
mov dword [esp + 0xc], eax
mov al, byte [esp + 0x110]
test al, al
mov dword [esp + 4], edx
je 0x404390
lea ecx, [esp]
push ecx
push 0
push 0
lea edx, [esp + 0x14]
push edx
jmp 0x40439e
lea edx, [esp]
push edx
push 0
lea eax, [esp + 0x10]
push eax
push 0
push 0
call dword [sym.imp.WS2_32.dll_select]
xor ecx, ecx
test eax, eax
setg cl
mov al, cl
add esp, 0x10c
ret 8

Function at 0x404530
Capabilities:
Get hostname
Resolve dns

Disassembly:
sub esp, 0x84
mov eax, dword [0x4144a0]
xor eax, dword [esp + 0x84]
push 0x80
mov dword [esp + 0x84], eax
lea eax, [esp + 4]
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
jne 0x40457e
lea ecx, [esp]
push ecx
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x40457e
mov edx, dword [eax + 0xc]
mov eax, dword [edx]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.WS2_32.dll_inet_ntoa]
test eax, eax
jne 0x404599
xor al, al
mov ecx, dword [esp + 0x80]
xor ecx, dword [esp + 0x84]
add esp, 0x84
jmp fcn.00406097
mov edx, dword [esp + 0x8c]
push edx
push eax
mov eax, dword [esp + 0x90]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcpynA]
mov ecx, dword [esp + 0x80]
xor ecx, dword [esp + 0x84]
mov al, 1
add esp, 0x84
jmp fcn.00406097
Function at 0x4051a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_LoadResource]
test eax, eax
mov dword [esp + 4], eax
jne 0x4051c1
add esp, 8
ret 0xc
push ebp
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov esi, eax
test esi, esi
mov dword [esp + 0x18], esi
jne 0x4051e0
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 8
ret 0xc
mov edi, dword [esi]
add edi, 0x40
push edi
call fcn.00406c2b
mov ebp, eax
add esp, 4
test ebp, ebp
je 0x4051d5
mov ecx, edi
mov edx, ecx
shr ecx, 2
mov edi, ebp
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp]
add edi, ebp
xor eax, eax
mov dword [esp + 0x1c], eax
push ebx
mov ecx, dword [edi + eax*4]
xor esi, esi
cmp ecx, dword [esi*8 + 0x411750]
je 0x405228
inc esi
cmp esi, 4
jb 0x405217
jmp 0x405286
mov ecx, dword [esp + 0x24]
test ecx, ecx
je 0x405243
cmp dword [esi*8 + 0x411754], 0x12
je 0x405286
mov dword [edi + eax*4], 0xffffff
jmp 0x405286
mov eax, dword [esi*8 + 0x411754]
push eax
call dword [sym.imp.USER32.dll_GetSysColor]
mov ecx, dword [esi*8 + 0x411754]
push ecx
movzx ebx, ah
call dword [sym.imp.USER32.dll_GetSysColor]
mov edx, dword [esi*8 + 0x411754]
mov bh, al
push edx
shl ebx, 8
call dword [sym.imp.USER32.dll_GetSysColor]
mov ecx, dword [esp + 0x20]
shr eax, 0x10
movzx eax, al
or ebx, eax
mov dword [edi + ecx*4], ebx
mov eax, ecx
inc eax
cmp eax, 0x10
mov dword [esp + 0x20], eax
jl 0x405212
mov edi, dword [ebp + 4]
mov ebx, dword [ebp + 8]
push 0
call dword [sym.imp.USER32.dll_GetDC]
push ebx
mov esi, eax
push edi
push esi
mov dword [esp + 0x1c], esi
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
test eax, eax
mov dword [esp + 0x20], eax
je 0x40531c
push esi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov edx, dword [esp + 0x20]
mov esi, eax
push edx
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
mov cx, word [ebp + 0xe]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x1c]
add eax, 0x28
cmp cx, 0x18
jae 0x4052e9
mov edx, 1
shl edx, cl
lea eax, [eax + edx*4]
push 0xcc0020
push 0
push ebp
push eax
push ebx
push edi
push 0
push 0
push ebx
push edi
push 0
push 0
push esi
call dword [sym.imp.GDI32.dll_StretchDIBits]
mov eax, dword [esp + 0x24]
push eax
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
push esi
call dword [sym.imp.GDI32.dll_DeleteDC]
mov esi, dword [esp + 0x10]
push esi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
push ebp
call fcn.00405d6e
mov ecx, dword [esp + 0x18]
add esp, 4
push ecx
call dword [sym.imp.KERNEL32.DLL_FreeResource]
mov eax, dword [esp + 0x20]
pop ebx
pop edi
pop esi
pop ebp
add esp, 8
ret 0xc
Function at 0x405640
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 0x11c
mov eax, dword [0x4144a0]
xor eax, dword [esp + 0x11c]
push esi
push 0
mov dword [esp + 0x120], eax
mov dword [esp + 0xc], ecx
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
mov esi, eax
mov eax, dword [esp + 0x124]
push 0xf1
push eax
push esi
mov dword [esp + 0x1c], esi
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
test eax, eax
je 0x405694
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_LoadResource]
test eax, eax
mov dword [esp + 0x14], eax
jne 0x40569b
xor eax, eax
jmp 0x405841
push ebx
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov ebx, eax
test ebx, ebx
je 0x405840
movzx ecx, word [ebx + 6]
shl ecx, 2
push edi
push ecx
call fcn.00405f90
mov edi, eax
xor eax, eax
add esp, 4
cmp word [ebx + 6], ax
mov dword [esp + 0x20], edi
jbe 0x4056e2
lea ecx, [ebx + 8]
nop
movzx edx, word [ecx]
mov dword [edi + eax*4], edx
movzx edx, word [ebx + 6]
inc eax
add ecx, 2
cmp eax, edx
jl 0x4056d0
mov eax, dword [esp + 0x130]
push ebp
xor ebp, ebp
test eax, eax
je 0x4057b9
movzx eax, word [ebx + 6]
shl eax, 8
inc eax
push eax
call fcn.00405f90
xor ecx, ecx
add esp, 4
cmp word [ebx + 6], cx
mov ebp, eax
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], ecx
jbe 0x4057b1
jmp 0x405720
mov eax, dword [edi + ecx*4]
test eax, eax
je 0x4057a0
push 0x100
lea ecx, [esp + 0x2c]
push ecx
push eax
push esi
call dword [sym.imp.USER32.dll_LoadStringA]
test eax, eax
jg 0x40574d
push 0x411790
lea edx, [esp + 0x2c]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
lea eax, [esp + 0x28]
push 0xa
push eax
call fcn.00406b09
add esp, 8
test eax, eax
je 0x405763
mov byte [eax], 0
lea ecx, [esp + 0x28]
push ecx
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
mov edx, dword [esp + 0x10]
inc eax
mov ecx, eax
lea edi, [edx + ebp]
mov edx, ecx
shr ecx, 2
lea esi, [esp + 0x28]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x10]
mov esi, dword [esp + 0x1c]
mov edi, dword [esp + 0x24]
add ecx, eax
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x18]
movzx eax, word [ebx + 6]
inc ecx
cmp ecx, eax
mov dword [esp + 0x18], ecx
jl 0x405720
mov ecx, dword [esp + 0x10]
mov byte [ecx + ebp], 0
movzx edx, word [ebx + 6]
mov ecx, dword [esp + 0x14]
push ebp
push edx
push edi
call fcn.00405050
push edi
mov esi, eax
call fcn.00405d60
add esp, 4
test ebp, ebp
je 0x4057e1
push ebp
call fcn.00405d60
add esp, 4
test esi, esi
mov edi, dword [esp + 0x14]
pop ebp
je 0x405814
movzx ecx, word [ebx + 4]
movzx eax, word [ebx + 2]
push ecx
lea esi, [ecx + 7]
push eax
lea edx, [eax + 7]
push esi
push edx
mov ecx, edi
call fcn.00405400
mov eax, dword [esp + 0x12c]
push eax
mov ecx, edi
call fcn.004055e0
mov esi, eax
mov ecx, dword [esp + 0x1c]
push ecx
call dword [sym.imp.KERNEL32.DLL_FreeResource]
mov eax, dword [esp + 0x130]
test eax, eax
je 0x40583d
mov edx, dword [edi + 4]
push 0
push 1
push 0x43c
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, esi
pop edi
pop ebx
mov ecx, dword [esp + 0x11c]
xor ecx, dword [esp + 0x120]
pop esi
call fcn.00406097
add esp, 0x11c
ret 8