joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408dd8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
and al, 0xc7
inc esp
and al, 4
add byte [eax], al
add byte [eax], al
invalid
call eax
sub esp, 8
mov dword [ebp - 0x1a0], eax
pushal
invalid
invalid
dec dword [ebx + 0x4589b445]
inc ebp
in al, dx
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x64]

Function at 0x408e90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x84]
invalid
invalid
cmp eax, dword [ecx + 0x18]
jae 0x408fc9
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x218]
call 0x8c408e9a
push ebp
movsb byte es:[edi], byte [esi]
add eax, dword [ecx + edx*4]
mov dword [ebp - 0x20c], eax
jmp 0x408e81

Function at 0x408e98
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call 0x8c408e9a
push ebp
movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0xd4]
cmp eax, dword [ebp - 0x224]
jne 0x408fbb
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x214]
mov edx, dword [ebp - 0x210]
xchg ebp, eax
invalid
std
invalid
invalid
mov esi, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x5c]
add eax, 1
mov dword [ebp - 0x5c], eax

Function at 0x408ec0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [ebp - 0xd4], 0
mov ecx, dword [ebp - 0x16c]

Function at 0x408fc4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x84]
invalid
invalid
cmp eax, dword [ecx + 0x18]
jae 0x408fc9
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x218]
call 0x8c408e9a
push ebp
movsb byte es:[edi], byte [esi]
add eax, dword [ecx + edx*4]
mov dword [ebp - 0x20c], eax
jmp 0x408e81

Function at 0x409004
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor ebx, ebx
mov dword [esp], esi
mov dword [esp + 4], edx
add al, 0x89
dec esp
and al, 8

Function at 0x40902c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add eax, dword [ebp - 0x124]
mov dword [ebp - 0xc0], eax
inc eax
invalid
invalid
dec dword [ebx + 0x408bf045]
inc eax
pop esp
add eax, dword [ebp - 0x14]
mov dword [ebp - 0x14], eax

Function at 0x409044
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
call 0x85c990dc
push 0x8bfffffe
dec dword [ebx - 0x3f7c17bb]
add al, 0x89

Function at 0x4090ac
Capabilities:
Resolve function by parsing pe exports

Disassembly:
rol byte [ecx + ecx*4], 0x45
call 0x45cc5c9e
invalid
inc ebp
loopne 0x4090aa
dec ebp

Function at 0x4090b4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [eax + 0x58]
add eax, dword [ebp - 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x64]
mov ecx, dword [ebp - 0x10]
dec ebp
invalid
mov ecx, dword [ecx + 0x24]
mov edx, dword [ebp - 0x3c]
Function at 0x409124
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [ebp - 0x1f4], eax
mov eax, dword [ebp - 0x20]
loopne 0x4090b9
dec ebp
add byte [ebx], 0x41
and al, 0x89
test dword [eax], edx
invalid
invalid
inc edi
inc ebp
test al, 0
add byte [eax], al
add byte [eax], al

Function at 0x40914c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
dec ebp
cmp byte [ebx], 0x41
sbb byte [edi], cl
xor dword [esi], 1
add dword [eax], eax
invalid

Function at 0x409234
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [ebp - 0xac]
cmp eax, dword [ebp - 0x2d4]
jae 0x409248
mov eax, dword [ebp - 0xac]
add eax, 1
add dword [ecx - 0xab7b], ecx
invalid
invalid

Function at 0x4092d4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1dc]
dec dword [ebx - 0x1df6b]
inc dword [ebx]
inc esp
sar dword [eax - 0x77], 1
inc ebp
invalid
invalid
inc ebp

Function at 0x40bd14
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x40bdbd
test eax, edx
je 0x40bdc0
push 0
push 0
cmp word [eax - 0xa], 2
je 0x40bd3d
push edx
mov edx, eax
mov eax, esp
call fcn.00405fe4
pop edx
mov eax, dword [esp]
cmp word [edx - 0xa], 2
je 0x40bd53
push eax
lea eax, [esp + 8]
call fcn.00405fe4
pop eax
mov edx, dword [esp + 4]
movzx ecx, word [edx]
cmp cx, word [eax]
je 0x40bd62
movzx eax, word [eax]
sub eax, ecx
jmp 0x40bd89
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
shl ecx, 1
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x40bda3
add ecx, 4
js 0x40bd7a
pop eax
pop ebx
mov ecx, esp
mov edx, dword [ecx]
or edx, dword [ecx + 4]
je 0x40bda0
push eax
mov eax, ecx
mov edx, 2
call fcn.00405084
pop eax
pop edx
pop edx
ret
bsf ebx, ebx
shr ebx, 4
add ebx, ebx
add ecx, ebx
jns 0x40bd87
movzx eax, word [ecx + eax]
movzx edx, word [ecx + edx]
sub eax, edx
pop ebx
pop ebx
jmp 0x40bd89
xor eax, eax
ret
test eax, eax
je 0x40bdd0
test edx, edx
jne 0x40bd24
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x42e9c0
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
add eax, 0x18
xor ecx, ecx
mov edx, 0x40
call fcn.0040369c
ret
Function at 0x436f84
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
push edi
push ecx
mov dword [esp], eax
mov eax, 0xedb88320
xor esi, esi
mov ebx, dword [esp]
mov edx, esi
mov ecx, 0xfffffff8
mov edi, edx
and edi, 1
dec edi
jne 0x436faa
shr edx, 1
xor edx, eax
jmp 0x436fac
shr edx, 1
inc ecx
jne 0x436f9c
mov dword [ebx], edx
inc esi
add ebx, 4
cmp esi, 0x100
jne 0x436f95
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x436fc4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0x436fcd
mov eax, dword [ebp - 4]
add esp, 0xfffff7f0
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00427e28
mov dword [ebp - 0x14], eax
xor ecx, ecx
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0x14]
or esi, 0xffffffff
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx]
sub eax, dword [ebp + 8]
sub eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jle 0x43707a
cmp dword [ebp - 0xc], 0x2800
jl 0x437028
mov dword [ebp - 8], 0x2800
jmp 0x43702e
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
lea edx, [ebp - 0x2814]
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov dword [ebp - 0x10], eax
xor ebx, ebx
cmp ebx, dword [ebp - 0x10]
jge 0x437072
mov eax, esi
shr eax, 8
and eax, 0xffffff
movzx edx, byte [ebp + ebx - 0x2814]
xor esi, edx
and esi, 0xff
xor eax, dword [esi*4 + 0x546e9c]
mov esi, eax
inc ebx
cmp ebx, dword [ebp - 0x10]
jl 0x437049
mov eax, dword [ebp - 8]
sub dword [ebp - 0xc], eax
jmp 0x437010
mov ebx, esi
xor ebx, 0xffffffff
xor ecx, ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
mov esi, dword [eax]
call dword [esi + 0x14]
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x441e40
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
movzx ebx, dl
dec ebx
test ebx, ebx
jb 0x441e94
inc ebx
xor edx, edx
mov ecx, edx
add ecx, ecx
add ecx, ecx
movzx esi, byte [eax + ecx]
lea esi, [esi*4 + 0x5357d8]
mov esi, dword [esi]
movzx edi, byte [eax + ecx + 1]
lea edi, [edi*4 + 0x535bd8]
xor esi, dword [edi]
movzx edi, byte [eax + ecx + 2]
lea edi, [edi*4 + 0x535fd8]
xor esi, dword [edi]
movzx edi, byte [eax + ecx + 3]
lea edi, [edi*4 + 0x5363d8]
xor esi, dword [edi]
lea ecx, [eax + ecx]
mov dword [ecx], esi
inc edx
dec ebx
jne 0x441e4e
pop edi
pop esi
pop ebx
ret

Function at 0x448314
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x44831a
ret

Function at 0x455138
Capabilities:
Log keystrokes

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov ebx, edx
mov esi, eax
mov eax, ebx
xor edx, edx
call fcn.00405de0
push 0
mov eax, esi
movzx eax, al
push eax
call sub.user32.dll_MapVirtualKeyW
shl eax, 0x10
test eax, eax
je 0x45517f
push pe_nt_image_headers32
lea edx, [esp + 4]
push edx
push eax
call fcn.004094f4
mov eax, ebx
mov edx, esp
mov ecx, pe_nt_image_headers32
call fcn.00405fc8
add esp, 0x200
pop esi
pop ebx
ret
Function at 0x477b0c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push ecx
mov byte [esp], cl
mov ebx, edx
mov esi, eax
push 0xffffffffffffffec
push esi
call fcn.004095dc
mov edi, eax
test bl, bl
je 0x477b2d
test edi, 0x40000
je 0x477b47
test bl, bl
jne 0x477bc8
mov eax, edi
and eax, 0x40000
cmp eax, 0x40000
jne 0x477bc8
push esi
call sub.user32.dll_IsIconic
cmp eax, 1
sbb eax, eax
inc eax
mov byte [esp + 2], al
push esi
call sub.user32.dll_IsWindowVisible
cmp eax, 1
sbb eax, eax
inc eax
mov byte [esp + 1], al
movzx eax, byte [esp + 1]
or al, byte [esp + 2]
je 0x477b7a
push 0
push esi
call sub.user32.dll_ShowWindow
test bl, bl
je 0x477b8f
or edi, 0x40000
push edi
push 0xffffffffffffffec
push esi
call sub.user32.dll_SetWindowLongW
jmp 0x477b9e
and edi, 0xfffbffff
push edi
push 0xffffffffffffffec
push esi
call sub.user32.dll_SetWindowLongW
movzx eax, byte [esp]
and al, byte [esp + 1]
jne 0x477baf
cmp byte [esp + 2], 0
je 0x477bc8
cmp byte [esp + 2], 0
je 0x477bc0
push 6
push esi
call sub.user32.dll_ShowWindow
jmp 0x477bc8
push 5
push esi
call sub.user32.dll_ShowWindow
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x484204
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x80]
test esi, esi
je 0x484272
mov eax, esi
call fcn.0046b2dc
test al, al
je 0x484272
mov eax, dword [ebx + 0x80]
call fcn.0046afd4
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x484272
mov eax, dword [ebx + 0x80]
mov edx, dword [eax]
call dword [edx + 0xec]
test al, al
je 0x484266
push 0
mov eax, dword [ebx + 0x80]
call fcn.0046afd4
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x80]
call fcn.00462754
jmp 0x484272
mov cl, 1
mov edx, dword [ebx + 0x70]
mov eax, ebx
call fcn.00484050
pop esi
pop ebx
ret

Function at 0x48781c
Capabilities:
Hash data with md5

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.004883d4
mov dword [ebx], 0x67452301
mov dword [ebx + 4], 0xefcdab89
mov dword [ebx + 8], 0x98badcfe
mov dword [ebx + 0xc], 0x10325476
pop ebx
ret
Function at 0x4882d0
Capabilities:
Authenticate hmac

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff20
push ebx
push esi
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0x40
jle 0x488315
lea eax, [ebp - 0x60]
call fcn.0048781c
mov edx, ebx
lea eax, [ebp - 0x60]
mov ecx, dword [ebp + 0xc]
call fcn.00487844
lea edx, [ebp - 0x60]
mov eax, dword [ebp + 8]
call fcn.00487918
mov dword [ebp + 0xc], 0x10
mov esi, dword [ebp + 8]
jmp 0x488317
mov esi, ebx
xor ecx, ecx
lea eax, [ebp - 0xa0]
lea edx, [ebp - 0xe0]
lea ebx, [ecx + 1]
cmp ebx, dword [ebp + 0xc]
jg 0x488340
movzx ebx, byte [esi]
xor bl, 0x36
mov byte [eax], bl
movzx ebx, byte [esi]
xor bl, 0x5c
mov byte [edx], bl
inc esi
jmp 0x488346
mov byte [eax], 0x36
mov byte [edx], 0x5c
inc ecx
inc edx
inc eax
cmp ecx, 0x40
jne 0x488325
lea eax, [ebp - 0x60]
call fcn.0048781c
lea edx, [ebp - 0xa0]
lea eax, [ebp - 0x60]
mov ecx, 0x40
call fcn.00487844
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x60]
mov ecx, dword [ebp - 8]
call fcn.004881b8
lea edx, [ebp - 0x60]
mov eax, dword [ebp + 8]
call fcn.00487918
lea eax, [ebp - 0x60]
call fcn.0048781c
lea edx, [ebp - 0xe0]
lea eax, [ebp - 0x60]
mov ecx, 0x40
call fcn.00487844
mov edx, dword [ebp + 8]
lea eax, [ebp - 0x60]
mov ecx, 0x10
call fcn.00487844
lea edx, [ebp - 0x60]
mov eax, dword [ebp + 8]
call fcn.00487918
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4dba94
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffddc
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x220], edx
mov dword [ebp - 0x224], edx
mov dword [ebp - 0x21c], edx
mov dword [ebp - 0x218], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4dbbf7
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4dbb12
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x23
lea eax, [ebp - 0x212]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.shell32.dll_SHGetSpecialFolderPathW
mov eax, dword [ebp - 4]
add eax, 8
lea edx, [ebp - 0x212]
mov ecx, 0x105
call fcn.00405fc8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4dbb3d
xor eax, eax
push ebp
push 0x4dbb7f
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x1a
lea eax, [ebp - 0x212]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.shell32.dll_SHGetSpecialFolderPathW
mov eax, dword [ebp - 4]
add eax, 4
lea edx, [ebp - 0x212]
mov ecx, 0x105
call fcn.00405fc8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4dbbaa
lea edx, [ebp - 0x224]
xor eax, eax
call fcn.00403408
mov eax, dword [ebp - 0x224]
lea edx, [ebp - 0x220]
call fcn.0040d474
mov edx, dword [ebp - 0x220]
mov eax, dword [ebp - 4]
add eax, 0xc
call fcn.00405de0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dbbfe
lea eax, [ebp - 0x224]
mov edx, 4
call fcn.00405dd8
ret

Function at 0x4dc254
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4dc2fe
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
je 0x4dc28d
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx]
cmp edx, 0
jne 0x4dc297
cmp eax, 0
jne 0x4dc297
mov eax, dword [ebp - 8]
call fcn.00405060
jmp 0x4dc2e8
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx]
mov ecx, eax
dec ecx
test ecx, ecx
jl 0x4dc2c6
inc ecx
xor esi, esi
mov eax, esi
mov edi, 0x16
cdq
idiv edi
movzx eax, byte [edx + str.vkj8ze67dpa9wx3my2h5gu]
xor byte [ebx], al
inc ebx
inc esi
dec ecx
jne 0x4dc2ae
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx]
mov edx, eax
lea ecx, [ebp - 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
call fcn.00495078
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.0040841c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dc305
lea eax, [ebp - 0xc]
call fcn.00405060
ret
Function at 0x4dc3e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405dc8
xor eax, eax
push ebp
push 0x4dc4d8
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 4]
mov ecx, 0
call fcn.0040600c
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 8]
call fcn.004da024
mov ebx, dword [ebp - 8]
mov eax, dword [ebp - 8]
call fcn.0040770c
mov ecx, eax
dec ecx
test ecx, ecx
jl 0x4dc452
inc ecx
xor esi, esi
mov eax, esi
mov edi, 0x16
cdq
idiv edi
movzx eax, byte [edx + str.vkj8ze67dpa9wx3my2h5gu]
xor byte [ebx], al
inc ebx
inc esi
dec ecx
jne 0x4dc43a
mov eax, dword [ebp - 8]
call fcn.0040770c
mov edx, eax
lea eax, [ebp - 0xc]
mov ecx, 0xfde9
call fcn.00405904
lea eax, [ebp - 0xc]
call fcn.00405898
mov ebx, eax
mov eax, dword [ebp - 8]
call fcn.0040770c
mov edx, ebx
mov ecx, dword [ebp - 8]
xchg ecx, eax
call fcn.0040324c
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.00408520
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
call fcn.00405de0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dc4df
lea eax, [ebp - 0x18]
call fcn.00405060
lea eax, [ebp - 0x10]
call fcn.00405dd0
lea eax, [ebp - 0xc]
call fcn.00405060
lea eax, [ebp - 8]
mov edx, dword [0x40a4e0]
call fcn.004078e0
lea eax, [ebp - 4]
call fcn.00405dd0
ret
Function at 0x4021b0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x43ff7f
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4558d0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
xor edi, edi
lea ecx, [esi + 0x34]
mov dword [esi], vtable.CIDMHTMLParser.2.0
mov dword [esi + 4], vtable.CIDMHTMLParser.1.0
mov dword [esi + 8], vtable.CIDMHTMLParser.0
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], 1
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], 0x80040202
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
call fcn.00401ac0
mov dword [esp + 0x18], edi
lea ecx, [esi + 0x50]
call fcn.0040d890
mov byte [esp + 0x18], 1
lea ecx, [esi + 0x7c]
mov dword [esi + 0x78], edi
call fcn.004020b0
mov byte [esp + 0x18], 2
mov dword [esi + 0x80], edi
mov byte [esp + 0x18], 3
mov dword [esi + 0x90], edi
mov dword [esi + 0x8c], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x88], edi
mov dword [esi + 0x84], 1
mov dword [esi + 0xc], edi
mov dword [esp + 0x18], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret
Function at 0x403020
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4401b0
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4558d0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 4], 0
mov ecx, dword [0x456c80]
test ecx, ecx
je 0x403070
call fcn.00408df0
mov ecx, dword [0x456c80]
test ecx, ecx
je 0x403070
push 1
call fcn.00402bb0
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 4], 2
push 0
push 0
push 0x12
mov eax, dword [0x456cb0]
push eax
call dword [sym.imp.USER32.dll_PostThreadMessageA]
test eax, eax
jne 0x4030a8
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4050f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x405109
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x405144
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x405140
lea ebx, [ebx]
cmp esi, eax
jae 0x405144
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x405130
cmp esi, eax
jb 0x40514a
pop esi
pop edi
xor eax, eax
pop ebx
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret
Function at 0x4174e1
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x417528
call fcn.0041afe2
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x417528
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x417544
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.0041705b
mov esi, eax
test edi, edi
je 0x417542
test ebx, ebx
je 0x417542
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x41834f
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x441dd5
call fcn.0042e120
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x418374
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x4183ba
lea ecx, [ebp - 0x10]
call fcn.004020b0
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040fcb2
add esp, 0x10
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00401270
mov eax, esi
call fcn.0042e1f8
ret 8

Function at 0x41a614
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x58], ebx
test ebx, 0xffff0000
jne 0x41a638
cmp dword [edi + 0x54], 0
jne 0x41a638
movzx eax, bx
mov dword [edi + 0x54], eax
call fcn.0041afe2
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.0041a5d5
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x41d3d2
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
cmp dword [ebp + 0xc], ebx
je 0x41d41a
call fcn.0041afe2
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x41d41a
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
test eax, eax
je 0x41d45d
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
test ebx, ebx
je 0x41d446
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x41d446
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x41d45a
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x42cc02
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4558d0]
jne 0x42cc0c
repz ret
jmp fcn.0043267c