joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46fb20
Capabilities:
Capture screenshot

Disassembly:
sub esp, 0x10
lea eax, [esp]
push esi
mov esi, dword [esp + 0x18]
push eax
mov ecx, dword [esi]
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edx, dword [esi]
push edx
call dword [sym.imp.USER32.dll_GetWindowDC]
push eax
mov dword [esi + 4], eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push 1
push eax
mov dword [esi + 8], eax
call dword [sym.imp.GDI32.dll_SetBkMode]
mov eax, dword [esi + 0x10]
test eax, eax
je 0x46fb6a
push eax
mov eax, dword [esi + 8]
mov dword [esi + 0x18], 0
push eax
jmp 0x46fb99
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
sub ecx, eax
mov eax, dword [esi + 4]
push ecx
mov ecx, dword [esp + 8]
mov dword [esi + 0x18], 1
sub edx, ecx
push edx
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov ecx, dword [esi + 8]
push eax
mov dword [esi + 0x10], eax
push ecx
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [esi + 0x14], eax
mov eax, dword [esi + 0xc]
cmp eax, 1
jne 0x46fbdb
mov edx, dword [esi + 4]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
push 0xcc0020
push 0
push 0
push edx
mov edx, dword [esp + 0x18]
sub eax, edx
mov edx, dword [esp + 0x14]
sub ecx, edx
mov edx, dword [esi + 8]
push eax
push ecx
push 0
push 0
push edx
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [esi + 8]
pop esi
add esp, 0x10
ret 4
Function at 0x486453
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x48648b
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004844e0
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004844b8
jmp 0x486497
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x487b45
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x487b87
call fcn.0048d640
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
cmp eax, edi
je 0x487b87
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_LoadResource]
cmp eax, edi
jne 0x487b7e
xor eax, eax
jmp 0x487b8f
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00487b95
pop edi
pop esi
pop ebx
ret 4

Function at 0x48db70
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x48db9e
push dword [esi]
call dword [sym.imp.KERNEL32.DLL_TlsGetValue]
test eax, eax
je 0x48dbbc
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0048dad6
jmp 0x48dbbc
mov eax, dword [esi + 0x14]
test eax, eax
je 0x48dbbc
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0048dad6
test edi, edi
mov eax, edi
jne 0x48dba6
pop edi
push ebx
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x4018d0
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x43b171
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
mov eax, dword [0x44e5f0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, dword [esp + 0x30]
mov eax, dword [esp + 0x34]
mov dword [esp + 0xc], 0
mov eax, dword [eax]
push 0x40
push eax
lea ecx, [esp + 0x18]
call fcn.0040a8be
lea edx, [esp + 0x10]
mov ecx, esi
mov dword [esp + 0x28], 1
call fcn.00401950
lea ecx, [esp + 0x10]
mov dword [esp + 0xc], 1
mov byte [esp + 0x28], 0
call fcn.0040a364
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x24
ret

Function at 0x401950
Capabilities:
Hash data with md5

Disassembly:
push ebp
lea ebp, [esp - 0x460]
sub esp, 0x460
push 0xffffffffffffffff
push 0x43b128
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x44e5f0]
xor eax, ebp
mov dword [ebp + 0x45c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
xor edi, edi
push 0x40
lea eax, [ebp + 4]
push edi
mov dword [ebp - 4], edi
push eax
mov ebx, ecx
mov esi, edx
mov dword [ebp - 0x1c], edi
mov dword [ebp], vtable.CMD5Checksum.0
call fcn.00428620
add esp, 0xc
mov dword [ebp + 0x48], edi
mov dword [ebp + 0x44], edi
mov dword [ebp + 0x4c], 0x67452301
mov dword [ebp + 0x50], 0xefcdab89
mov dword [ebp + 0x54], 0x98badcfe
mov dword [ebp + 0x58], 0x10325476
mov byte [ebp - 4], 1
mov edx, dword [esi]
mov edx, dword [edx + 0x34]
push 0x400
lea eax, [ebp + 0x5c]
push eax
mov ecx, esi
call edx
cmp eax, edi
jle 0x4019f8
lea ecx, [ebp + 0x5c]
push ecx
lea ecx, [ebp]
call fcn.004023b0
jmp 0x4019d4
push ebx
lea ecx, [ebp]
call fcn.00402130
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x45c]
xor ecx, ebp
call fcn.00426e53
add ebp, 0x460
mov esp, ebp
pop ebp
ret

Function at 0x4025d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4025e9
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x402624
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x402620
lea ebx, [ebx]
cmp esi, eax
jae 0x402624
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x402610
cmp esi, eax
jb 0x40262a
pop esi
pop edi
xor eax, eax
pop ebx
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret
Function at 0x405100
Capabilities:
Extract resource via kernel32 functions

Disassembly:
movzx edx, word [esp + 4]
mov dword [esp + 4], edx
jmp fcn.004152a3

Function at 0x4059f0
Capabilities:
Check internet connectivity via wininet

Disassembly:
push 0xffffffffffffffff
push 0x43ac78
mov eax, dword fs:[0]
push eax
mov eax, dword [0x44e5f0]
xor eax, esp
push eax
lea eax, [esp + 4]
mov dword fs:[0], eax
mov eax, dword [esp + 0x14]
push 0
push 1
push eax
call dword [sym.imp.WININET.dll_InternetCheckConnectionW]
or edx, 0xffffffff
mov dword [esp + 0xc], 0xffffffff
test eax, eax
mov eax, dword [esp + 0x14]
jne 0x405a5d
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x405a4b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
pop ecx
add esp, 0xc
ret
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x405a76
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
pop ecx
add esp, 0xc
ret
Function at 0x405cf0
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x43b468
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
mov eax, dword [0x44e5f0]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
push 0x4437cc
lea ecx, [esp + 0xc]
mov dword [esp + 0x10], 0
call fcn.00403590
lea eax, [esp + 0xc]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftInternet_ExplorerMain_
push SysReAllocStringLen
mov dword [esp + 0x34], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x405d9b
push 0xff
call fcn.00409a7a
add esp, 4
lea ecx, [esp + 0x10]
push ecx
mov esi, eax
mov eax, dword [esp + 0x10]
push esi
lea edx, [esp + 0x1c]
push edx
push 0
push str.Start_Page
push eax
mov dword [esp + 0x2c], 1
mov dword [esp + 0x28], 0xff
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
test eax, eax
je 0x405dda
call fcn.00409a85
add esp, 4
mov dword [esp + 0x20], 0xffffffff
mov eax, dword [esp + 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x405ee5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x1c
ret
lea ecx, [esp + 0xc]
push 0x444290
push ecx
call fcn.004025b0
push esi
call fcn.00409a85
mov edx, dword [esp + 0x1c]
add esp, 0x10
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 8]
push str.baidu.com
push eax
call fcn.00427785
add esp, 8
test eax, eax
jne 0x405e30
mov ecx, dword [esp + 8]
push str.hao123.com
push ecx
call fcn.00427785
add esp, 8
mov byte [0x4528c0], 0
test eax, eax
je 0x405e37
mov byte [0x4528c0], 1
mov edx, dword [esp + 8]
push str.5566e.com
push edx
call fcn.00427785
add esp, 8
test eax, eax
je 0x405e8b
mov dword [esp + 0x20], 0xffffffff
mov eax, dword [esp + 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x405e75
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x1c
ret
mov ecx, dword [esp + 8]
push str.1155q.com
push ecx
call fcn.00427785
add esp, 8
test eax, eax
je 0x405ebf
mov dword [esp + 0x20], 0xffffffff
mov eax, dword [esp + 8]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jmp 0x405e69
mov ecx, dword [esp + 8]
push str.99danji.com
push ecx
call fcn.00427785
add esp, 8
lea ecx, [esp + 8]
test eax, eax
je 0x405ee0
call fcn.00402af0
jmp 0x405e75
call fcn.00402af0
xor eax, eax
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x1c
ret
Function at 0x405f00
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x43b218
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x44e5f0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov dword [esp + 0x18], 0
mov eax, dword [esp + 0x20]
mov ecx, 0x4437cc
mov dx, word [eax]
or edi, 0xffffffff
cmp dx, word [ecx]
jne 0x405f5d
test dx, dx
je 0x405f59
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x405f5d
add eax, 4
add ecx, 4
test dx, dx
jne 0x405f34
xor eax, eax
jmp 0x405f61
sbb eax, eax
sbb eax, edi
test eax, eax
setne al
test al, al
je 0x405f83
cmp byte [0x4528c0], 1
jne 0x405f83
push 0x18
push str.http:__www.5566e.com__99
lea ecx, [esp + 0x28]
call fcn.00401750
push 0xff
mov dword [esp + 0x10], 0
call fcn.00409a7a
add esp, 4
mov esi, eax
lea eax, [esp + 0xc]
push eax
push 0xf003f
push 0
push str.SoftwareMicrosoftInternet_ExplorerMain_
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x405ff8
push esi
call fcn.00409a85
add esp, 4
mov dword [esp + 0x18], edi
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edi
dec edi
test edi, edi
jg 0x405fe4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
push eax
call fcn.00402980
lea esi, [eax + 0x10]
lea eax, [esi - 0x10]
add esp, 4
lea ecx, [eax + 0xc]
mov edx, edi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x406026
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0xc]
push 0xff
push esi
push 1
push 0
push str.Start_Page
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x40605d
push esi
call fcn.00409a85
mov edx, dword [esp + 0x10]
add esp, 4
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x405fc3
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call fcn.00409a85
mov dword [esp + 0x1c], edi
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
add esp, 4
lea edx, [eax + 0xc]
lock xadd dword [edx], edi
dec edi
test edi, edi
jg 0x406092
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret
Function at 0x4071b0
Capabilities:
Create thread
Resume thread

Disassembly:
sub esp, 8
cmp dword [esi + 0x8c], 0
je 0x407213
cmp dword [esi + 0x80], 0
je 0x407219
mov ecx, dword [esi + 0xd0]
sub ecx, dword [esi + 0xcc]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 1
jbe 0x407219
lea ecx, [esp + 4]
push ecx
push 4
push esi
push 0x407730
push 0
push 0
call fcn.00427a69
add esp, 0x18
mov dword [esi + 0xa8], eax
test eax, eax
je 0x407213
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
xor eax, eax
add esp, 8
ret
mov eax, dword [esi + 0xb0]
test eax, eax
je 0x407213
mov edx, dword [eax]
mov edx, dword [edx + 0x18]
push edi
lea ecx, [esp + 8]
push ecx
push eax
call edx
mov eax, dword [esi + 0xb0]
mov ecx, dword [eax]
lea edx, [esp + 4]
push edx
push eax
mov eax, dword [ecx + 0x1c]
call eax
mov ecx, dword [esp + 4]
mov eax, dword [esi + 0xb0]
mov edx, dword [eax]
push 0
mov edx, dword [edx + 0x20]
mov edi, ecx
neg edi
push edi
mov edi, dword [esp + 0x10]
push edi
push ecx
mov ecx, dword [esi + 0x68]
push 0
push ecx
mov ecx, dword [esi + 0x64]
push ecx
mov ecx, dword [esi + 0x90]
push 0
push 0
push ecx
push eax
call edx
pop edi
test eax, eax
jne 0x407213
push eax
push eax
mov eax, dword [esi + 0x20]
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
mov eax, 1
add esp, 8
ret

Function at 0x4072a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
push esi
call fcn.0041725a
mov ecx, dword [esp + 0x10]
mov eax, dword [eax + 0xc]
push 0x443aec
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x40735f
call fcn.0041725a
mov eax, dword [eax + 0xc]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebp, eax
test ebp, ebp
je 0x40735f
push edi
call fcn.0041725a
mov eax, dword [eax + 0xc]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
push edi
push 0x22
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
jne 0x407307
pop edi
pop esi
pop ebp
ret 8
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push ebp
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x40734f
test ebx, ebx
je 0x40734f
push edi
push eax
push ebx
call fcn.0042c5f0
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [esp + 0x14]
push edi
push esi
call fcn.00406bb0
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop ebx
mov eax, edi
pop edi
pop esi
pop ebp
ret 8
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
ret 8
pop esi
xor eax, eax
pop ebp
ret 8
Function at 0x41172c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x411773
call fcn.0041725a
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x411773
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x41178f
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.004112a4
mov esi, eax
test edi, edi
je 0x41178d
test ebx, ebx
je 0x41178d
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x4125c7
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x43a95e
call fcn.004281c8
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x4125ec
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x412632
lea ecx, [ebp - 0x10]
call fcn.00402ac0
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00409b0a
add esp, 0x10
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00401590
mov eax, esi
call fcn.004282a0
ret 8

Function at 0x413bc9
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
cmp dword [ebp + 0xc], ebx
je 0x413c11
call fcn.0041725a
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x413c11
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
test eax, eax
je 0x413c54
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
test ebx, ebx
je 0x413c3d
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x413c3d
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x413c51
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x426e53
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x44e5f0]
jne 0x426e5d
repz ret
jmp fcn.0042c4de

Function at 0x4330ff
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0042be42
and dword [ebp - 4], 0
cmp dword [0x4527f8], 0
mov ebx, eax
jne 0x4331b0
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x433261
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x433261
push eax
call fcn.0042bdd0
mov dword [esp], 0x441930
push edi
mov dword [0x4527f8], eax
call esi
push eax
call fcn.0042bdd0
mov dword [esp], 0x44191c
push edi
mov dword [0x4527fc], eax
call esi
push eax
call fcn.0042bdd0
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x452800], eax
call esi
push eax
call fcn.0042bdd0
pop ecx
mov dword [0x452808], eax
test eax, eax
je 0x4331b0
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0042bdd0
pop ecx
mov dword [0x452804], eax
mov eax, dword [0x452804]
cmp eax, ebx
je 0x433208
cmp dword [0x452808], ebx
je 0x433208
push eax
call fcn.0042be4b
push dword [0x452808]
mov esi, eax
call fcn.0042be4b
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x433208
test edi, edi
je 0x433208
call esi
test eax, eax
je 0x4331ff
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4331ff
test byte [ebp - 0xc], 1
jne 0x433208
or dword [ebp + 0x10], 0x200000
jmp 0x433241
mov eax, dword [0x4527fc]
cmp eax, ebx
je 0x433241
push eax
call fcn.0042be4b
pop ecx
test eax, eax
je 0x433241
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x433241
mov eax, dword [0x452800]
cmp eax, ebx
je 0x433241
push eax
call fcn.0042be4b
pop ecx
test eax, eax
je 0x433241
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4527f8]
call fcn.0042be4b
pop ecx
test eax, eax
je 0x433261
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x433263
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x476d34
Capabilities:
Check for software breakpoints

Disassembly:
nop
and edi, dword [esi + 0x47]
cmp eax, dword [ecx]
retf 0x944f
int1
xchg edx, eax
invalid
stc
jmp 0x476d3d
pushal
clc
jae 0x476d4f
cmp eax, 0x9fa78917
scasb al, byte es:[edi]
shr bl, 1
invalid
call fcn.00476d77
jge 0x476ceb
aaa
jge 0x476daf
fsub st(6), st(0)
and al, 0xb3
and ch, byte [ebp - 0xb]
xchg edi, eax
mov al, 0x56
invalid
in al, dx
cmp dword [ecx], eax
push eax
arpl word [edx - 0x7d], bx
cmp eax, dword [eax]
stc
jb 0x476dc0
outsd dx, dword [esi]
sub al, 0xd7
pop ebp
cmpsb byte [esi], byte es:[edi]
je 0x476eec
jmp 0x476dd6
mov edi, ebx
jmp 0x476de1
add ebx, 4
jmp 0x476de8
mov eax, dword [ebx]
jmp 0x476dfe
add eax, ebx
stc
jb 0x476e14
push eax
daa
mov esi, 0xa5f07e12
xlatb
cld
dec ebp
dec ebp
in eax, 6
aad 1
and eax, 0x4538b6e
mov edx, dword [ebx + 4]
jmp 0x476e26
sub dword [eax], 0x983bdc92
jmp 0x476e5c
add eax, 4
jmp 0x476e64
sub edx, 1
clc
jmp 0x476e88
jne 0x476e17
jmp 0x476eb8
add ebx, 8
jmp 0x476ed6
sub dword [edi], 1
stc
jmp 0x476edd
jne 0x476de4
jmp 0x476ee7
call fcn.00476efb
jmp 0x476ef1
popal
stc
jb 0x476ef6
inc ecx
jmp 0x456f32

Function at 0x476d77
Capabilities:
Check for software breakpoints

Disassembly:
pop ebx
jae 0x476d90
fucompi st(5)
fsubp st(5)
mov gs, ebp
neg byte [ecx + 0x35a8fbeb]
cmp al, 0xcc
pop ds
push ecx
lodsb al, byte [esi]
jnp 0x476dec
in al, dx
add esi, dword [esi]
add ebx, 0xffffffb4
jmp 0x476db5
cmp dword [ebx], 0
pop es
adc byte [eax - 0x5a], bh
sbb al, 0x27
je 0x476e24
inc eax
mov edx, 0x94c9fc01
dec ebx
iretd
ftst