joyce8/EMBER2024-capa huggingface dataset:
Function at 0x54f0c0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xf8000]
push edi
jmp 0x54f0da
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x54f0e1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x54f0d0
mov eax, 1
add ebx, ebx
jne 0x54f0f3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x54f104
jne 0x54f123
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x54f123
dec eax
add ebx, ebx
jne 0x54f110
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x54f0e8
add ebx, ebx
jne 0x54f11f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x54f175
xor ecx, ecx
sub eax, 3
jb 0x54f13b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x54f1aa
sar eax, 1
mov ebp, eax
jmp 0x54f146
add ebx, ebx
jne 0x54f146
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x54f114
inc ecx
add ebx, ebx
jne 0x54f154
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x54f114
add ebx, ebx
jne 0x54f161
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x54f156
jne 0x54f172
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x54f156
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x54f194
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x54f186
jmp 0x54f0d6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x54f194
add edi, ecx
jmp 0x54f0d6
pop esi
mov edi, esi
mov ecx, 0x3ea9
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x54f1b2
cmp byte [edi], 0x11
jne 0x54f1b2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x54f1b7
lea edi, [esi + 0x148000]
mov eax, dword [edi]
or eax, eax
je 0x54f22f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1c5d10]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1c5e8c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x54f1e4
mov ecx, edi
jns 0x54f213
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1c5e90]
or eax, eax
je 0x54f229
mov dword [ebx], eax
add ebx, 4
jmp 0x54f201
call dword [esi + 0x1c5ea0]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x54f260
cmp al, 0xef
ja 0x54f253
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x54f235
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x54f242
mov ebp, dword [esi + 0x1c5e94]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x54f294
sub esp, 0xffffff80
jmp 0x42800a
Function at 0x2a837262
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x2a837271
pop dword [ebp - 0x50]
mov eax, 0x2a837271
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0xe8209c43
sub dword [ebp - 0x60], 0x99ce56f8
mov dword [ebp - 0x5c], 0xdc400fc5
sub dword [ebp - 0x5c], 0xaa0cc380
mov dword [ebp - 0x58], 0x3c104da1
add dword [ebp - 0x58], 0x103bf68d
mov dword [ebp - 0x54], 0x4d269fc9
add dword [ebp - 0x54], 0xb2d96037
lea eax, [ebp - 0x60]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0xa3b9175b
sub dword [ebp - 0x60], 0x2f46ae05
mov dword [ebp - 0x5c], 0xa020a5c0
add dword [ebp - 0x5c], 0xa14bbbb5
mov dword [ebp - 0x58], 0x308723fc
add dword [ebp - 0x58], 0x32e84870
mov dword [ebp - 0x54], 0xe85cc31b
sub dword [ebp - 0x54], 0xe85cc31b
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, 0xbd069988
sub eax, 0x9281784c
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x49e78
push 0
call eax
mov ecx, 0xfb0c8e26
add ecx, 0x4f3b8be
mov edx, eax
mov edi, 0x2a87ea00
add edi, dword [ebp - 0x50]
mov esi, 0xc6fd172d
xor dword [ebp - 0x30], esi
mov ebx, dword [edi]
sub dword [ebp - 0x28], ecx
xor ebx, esi
add dword [ebp - 0x44], esi
mov dword [edx], ebx
xor dword [ebp - 0x40], 0x4e1cb1b2
add edx, 4
add edi, 0x97b55524
sub edi, 0x97b55520
loop 0x2a83737d
add eax, 0x39033ade
sub eax, 0x39022c7b
xor ebx, ebx
add ebx, eax
add eax, 0x83e68dd8
sub eax, 0x83e68dd3
mov ecx, 0x8288458a
add ecx, 0xa7f7ba76
add ecx, dword [ebp - 0x50]
call ebx
leave
ret
Function at 0x406b40
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
call fcn.00406b49

Function at 0x4138e0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0x20c
mov eax, dword [0x520014]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov eax, dword [0x524ff0]
test eax, eax
jne 0x4139d6
lea esi, [ebp - 0x214]
push 0x208
push 0
push esi
call fcn.004926b0
add esp, 0xc
push 0x104
push esi
push 0x505770
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
add eax, 0xfffffefb
cmp eax, 0xfffffefc
jae 0x41393c
mov eax, dword [0x524ff0]
jmp 0x41394c
push 8
push 0
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [0x524ff0], eax
test eax, eax
jne 0x4139d6
mov word [ebp - 0x214], 0
push 0x104
push esi
push str._SYSTEMROOT__system32cabinet.dll
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
add eax, 0xfffffefb
cmp eax, 0xfffffefc
jae 0x413981
mov eax, dword [0x524ff0]
jmp 0x413991
push 8
push 0
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [0x524ff0], eax
test eax, eax
jne 0x4139d6
mov word [ebp - 0x214], 0
push 0x104
push esi
push str.C:Windows_system32cabinet.dll
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
add eax, 0xfffffefb
cmp eax, 0xfffffefc
jae 0x4139c2
mov eax, dword [0x524ff0]
jmp 0x4139d2
push 8
push 0
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [0x524ff0], eax
test eax, eax
je 0x413a0d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.FDICreate
push eax
call esi
mov dword [0x524fe4], eax
push str.FDIDestroy
push dword [0x524ff0]
call esi
mov dword [0x524fe8], eax
push str.FDICopy
push dword [0x524ff0]
call esi
mov dword [0x524fec], eax
xor ebx, ebx
cmp dword [0x524fe4], 0
je 0x413a2b
cmp dword [0x524fe8], 0
je 0x413a2b
cmp dword [0x524fec], 0
setne bl
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0048f468
mov eax, ebx
add esp, 0x20c
pop esi
pop ebx
pop ebp
ret
Function at 0x4143b0
Capabilities:
Check if file exists
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x70
mov edi, ecx
mov eax, dword [0x520014]
xor eax, ebp
mov dword [esp + 0x68], eax
xor eax, eax
push eax
push eax
push ecx
push 0x414930
push eax
push eax
call fcn.0049d5d0
add esp, 0x18
mov esi, eax
cmp dword [edi + 0x3c], eax
je 0x414413
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, dword [edi + 0x3c]
inc eax
cmp eax, 2
jae 0x41448e
lea eax, [esi + 1]
cmp eax, 2
jb 0x414409
mov dword [edi + 0x3c], esi
call fcn.0046dd90
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov esi, dword [edi + 0x3c]
inc esi
cmp esi, 1
jbe 0x414434
cmp esi, 2
setae bl
mov ecx, dword [esp + 0x68]
xor ecx, ebp
call fcn.0048f468
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ebx, [esp + 4]
push eax
push ebx
call fcn.004bcc70
add esp, 8
lea edi, [esp + 0x10]
mov ecx, edi
push ebx
push 0xa0
push str.InitializeThread
push 1
call fcn.004bca70
lea ecx, [esp + 0x4c]
push 0x5058c6
push str.Failed_to_create_thread_for_async_install_tasks
call fcn.004b9460
mov ecx, edi
call fcn.004bcab0
cmp byte [ebx + 0xb], 0
jns 0x414419
push dword [esp + 4]
call fcn.0048e90d
add esp, 4
jmp 0x414419
call fcn.0046dd90
push dword [edi + 0x3c]
call fcn.00470d70
add esp, 4
mov dword [edi + 0x3c], 0
jmp 0x4143f9
Function at 0x41afc0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x70
mov esi, ecx
mov eax, dword [0x520014]
xor eax, ebp
mov dword [esp + 0x68], eax
mov dword [ecx], fcn.00422b40
cmp dword [ecx + 0xc4], 0
je 0x41b010
push dword [esi + 0xc8]
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0xea60
push dword [esi + 0xc4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x41b124
cmp byte [esi + 0x137], 0
jns 0x41b027
push dword [esi + 0x12c]
call fcn.0048e90d
add esp, 4
cmp byte [esi + 0x12b], 0
jns 0x41b03e
push dword [esi + 0x120]
call fcn.0048e90d
add esp, 4
mov ecx, dword [esi + 0x118]
mov dword [esi + 0x118], 0
test ecx, ecx
je 0x41b059
push 1
call fcn.00422b70
cmp byte [esi + 0x113], 0
jns 0x41b070
push dword [esi + 0x108]
call fcn.0048e90d
add esp, 4
cmp byte [esi + 0xbf], 0
jns 0x41b087
push dword [esi + 0xb4]
call fcn.0048e90d
add esp, 4
cmp byte [esi + 0xb3], 0
jns 0x41b09e
push dword [esi + 0xa8]
call fcn.0048e90d
add esp, 4
cmp byte [esi + 0xa7], 0
jns 0x41b0b5
push dword [esi + 0x9c]
call fcn.0048e90d
add esp, 4
cmp byte [esi + 0x9b], 0
jns 0x41b0cc
push dword [esi + 0x90]
call fcn.0048e90d
add esp, 4
cmp byte [esi + 0x8f], 0
jns 0x41b0e3
push dword [esi + 0x84]
call fcn.0048e90d
add esp, 4
cmp byte [esi + 0x83], 0
jns 0x41b0f7
push dword [esi + 0x78]
call fcn.0048e90d
add esp, 4
lea ecx, [esi + 0x64]
call fcn.004d7a90
cmp byte [esi + 8], 0
je 0x41b111
lea ecx, [esi + 0xc]
call fcn.004144b0
mov byte [esi + 8], 0
mov ecx, dword [esp + 0x68]
xor ecx, ebp
call fcn.0048f468
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ebx, [esp + 4]
push eax
push ebx
call fcn.004bcc70
add esp, 8
lea edi, [esp + 0x10]
mov ecx, edi
push ebx
push 0x1d4
push str.Installer
push 1
call fcn.004bca70
lea ecx, [esp + 0x4c]
push 0x5065fd
push str.Failed_to_wait_for_install_async_exit._Terminate_install_thread_
call fcn.004b9460
mov ecx, edi
call fcn.004bcab0
cmp byte [ebx + 0xb], 0
jns 0x41b17c
push dword [esp + 4]
call fcn.0048e90d
add esp, 4
push 0
push dword [esi + 0xc4]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
jmp 0x41b010

Function at 0x41b1d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, ecx
mov edi, dword [sym.imp.KERNEL32.dll_ResetEvent]
push dword [ecx + 0xc8]
call edi
push dword [esi + 0xcc]
call edi
xor eax, eax
push eax
push eax
push esi
push 0x41b210
push eax
push eax
call fcn.0049d5d0
add esp, 0x18
mov dword [esi + 0xc4], eax
pop esi
pop edi
pop ebp
ret
Function at 0x421c90
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x78
mov eax, dword [0x520014]
xor eax, ebp
mov dword [esp + 0x70], eax
call fcn.00410430
test al, al
je 0x421d19
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
push 0x507430
push str.BROWSER_SETUP_RESOURCE
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x421d19
mov ebx, eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
xor ebx, ebx
test edi, edi
je 0x421d1b
mov esi, eax
test eax, eax
je 0x421d1b
mov eax, dword [ebp + 8]
lea ebx, [esp + 0x6c]
mov dword [ebx], 0xffffffff
push edi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push 0
push ebx
push esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [ebx], esi
jne 0x421d32
mov bl, 1
jmp 0x421d1b
xor ebx, ebx
mov ecx, dword [esp + 0x70]
xor ecx, ebp
call fcn.0048f468
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edi, [esp + 4]
push eax
push edi
call fcn.004bcc70
add esp, 8
lea esi, [esp + 0x10]
mov ecx, esi
push edi
push 0x508
push str.ExtractBrowserSetupResource
push 1
call fcn.004bca70
lea ecx, [esp + 0x4c]
push 0x506c36
push str.Write_failed._Roll_back_write_operation.
call fcn.004b9460
mov ecx, esi
call fcn.004bcab0
cmp byte [edi + 0xb], 0
jns 0x421d8a
push dword [esp + 4]
call fcn.0048e90d
add esp, 4
xor ebx, ebx
push ebx
push ebx
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x421d1b

Function at 0x4222b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov dword [ecx], fcn.00422320
cmp dword [ecx + 4], 0
je 0x4222da
cmp byte [esi + 0x14], 0
jne 0x4222d1
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, esi
pop esi
pop ebp
jmp fcn.00422340
mov eax, dword [esi + 0xc]
test eax, eax
je 0x4222ef
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0xc], 0
mov eax, dword [esi + 0x10]
test eax, eax
je 0x422304
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x10], 0
mov eax, dword [esi + 8]
test eax, eax
je 0x422319
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [esi + 8], 0
pop esi
pop ebp
ret
Function at 0x422340
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x70
mov esi, ecx
mov eax, dword [0x520014]
xor eax, ebp
mov dword [esp + 0x68], eax
push 0x7530
push dword [ecx + 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x4223d5
mov eax, dword [esi + 4]
test eax, eax
je 0x422383
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 4], 0
mov eax, dword [esi + 0xc]
test eax, eax
je 0x422398
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0xc], 0
mov eax, dword [esi + 0x10]
test eax, eax
je 0x4223ad
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x10], 0
mov eax, dword [esi + 8]
test eax, eax
je 0x4223c2
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [esi + 8], 0
mov ecx, dword [esp + 0x68]
xor ecx, ebp
call fcn.0048f468
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov byte [esi + 0x15], 1
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ebx, [esp + 4]
push eax
push ebx
call fcn.004bcc70
add esp, 8
lea edi, [esp + 0x10]
mov ecx, edi
push ebx
push 0x6c0
push str.EnsureProcessFinished
push 1
call fcn.004bca70
lea ecx, [esp + 0x4c]
push 0x506fad
push str.The_elevated_installer_hangs_and_must_be_forcibly_terminated.
call fcn.004b9460
mov ecx, edi
call fcn.004bcab0
cmp byte [ebx + 0xb], 0
jns 0x422431
push dword [esp + 4]
call fcn.0048e90d
add esp, 4
push 0
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x42236e
Function at 0x4232f0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
call fcn.00470800
xor eax, eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
lea ecx, [esi + 0x10]
call fcn.00470800
lea ecx, [esi + 0x14]
mov eax, dword [ebp + 0x18]
cmp byte [eax + 0xb], 0
js 0x42332c
mov edx, dword [eax + 8]
mov dword [ecx + 8], edx
movsd xmm0, qword [eax]
movsd qword [ecx], xmm0
jmp 0x423336
push dword [eax + 4]
push dword [eax]
call fcn.0046b840
lea edi, [ebp + 8]
mov byte [esi + 0x20], 1
mov ebx, dword [esi + 8]
cmp ebx, dword [esi + 0xc]
je 0x423355
mov ecx, ebx
push edi
call fcn.004268f0
add ebx, 0x10
mov dword [esi + 8], ebx
jmp 0x42335e
lea ecx, [esi + 4]
push edi
call fcn.00423ac0
xor eax, eax
push eax
push eax
push esi
push 0x423470
push eax
push eax
call fcn.0049d5d0
add esp, 0x18
mov ecx, edi
call fcn.004268b0
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret 0x14

Function at 0x4239e0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x80
mov esi, ecx
mov ebx, dword [ebp + 8]
mov eax, dword [0x520014]
xor eax, ebp
mov dword [esp + 0x78], eax
xor eax, eax
dec eax
lea edi, [esp + 0x10]
mov dword [edi + 0x64], eax
mov dword [edi + 0x60], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [edi + 0x50], xmm0
movdqa xmmword [edi + 0x40], xmm0
movdqa xmmword [edi + 0x30], xmm0
movdqa xmmword [edi + 0x20], xmm0
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi], xmm0
mov ecx, edi
call fcn.004d6800
cmp byte [ebx + 0xb], 0
jns 0x423a3c
mov ebx, dword [ebx]
mov eax, dword [ebp + 0xc]
mov ecx, edi
push eax
push ebx
call fcn.004d6b20
test al, al
je 0x423a9a
mov edi, dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 0xc], eax
lea ecx, [esp + 0x10]
call fcn.004d6f90
mov ebx, eax
test edi, edi
je 0x423a7a
test ebx, ebx
je 0x423a7a
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esp + 0xc]
cmp eax, edi
ja 0x423a9a
mov al, byte [esi + 0x20]
test ebx, ebx
je 0x423a87
test al, al
jne 0x423a59
jmp 0x423a9a
test al, al
je 0x423a9a
lea ecx, [esp + 0x10]
push 0
call fcn.004d7210
mov ebx, eax
jmp 0x423a9c
xor ebx, ebx
lea ecx, [esp + 0x10]
call fcn.0044bc10
mov ecx, dword [esp + 0x78]
xor ecx, ebp
call fcn.0048f468
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x426b00
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [0x520014]
xor eax, ebp
mov dword [ebp - 0x10], eax
movzx esi, cx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
push 0xa
push esi
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
xor esi, esi
test eax, eax
je 0x426b9f
mov ebx, eax
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x426b9d
mov esi, eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
push ebx
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
test eax, eax
je 0x426b9d
mov edi, eax
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x426b96
push ebx
push esi
push eax
call fcn.00491bb0
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea esi, [ebp - 0x14]
mov dword [esi], 0xffffffff
push esi
push 1
push edi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
mov esi, dword [esi]
jmp 0x426b9f
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
xor esi, esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048f468
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4272b0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov eax, dword [0x520014]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
dec eax
lea edi, [ebp - 0x1c]
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
inc eax
mov ecx, edi
push eax
call fcn.004b9e90
mov eax, dword [edi]
mov ecx, dword [edi + 4]
sub ecx, eax
sar ecx, 1
push ecx
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [edi]
mov edi, dword [edi + 4]
add edi, 0xfffffffe
mov eax, edi
mov dword [ebp - 0x20], ecx
sub eax, ecx
js 0x427385
mov ebx, eax
sar ebx, 1
cmp eax, 9
ja 0x42731a
mov byte [esi + 0xb], bl
mov eax, esi
jmp 0x427341
lea esi, [ebx + 8]
and esi, 0xfffffff8
js 0x42738c
lea eax, [esi + esi]
push eax
call fcn.0048e8dd
add esp, 4
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
or esi, 0x80000000
mov dword [ecx + 8], esi
mov esi, ecx
mov dword [ecx + 4], ebx
mov ebx, dword [ebp - 0x20]
cmp ebx, edi
je 0x42735a
mov ecx, ebx
movzx edx, word [ecx]
mov word [eax], dx
add ecx, 2
add eax, 2
cmp ecx, edi
jne 0x42734a
mov word [eax], 0
test ebx, ebx
je 0x427371
mov dword [ebp - 0x18], ebx
push dword [ebp - 0x1c]
call fcn.0048e90d
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048f468
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, esi
call fcn.004d0930
call fcn.004a2770
int3
Function at 0x429d40
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
movzx ebx, word [ebp + 0x10]
mov esi, dword [ebp + 0xc]
shr esi, 4
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
inc esi
movzx eax, si
push ebx
push eax
push 6
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
test eax, eax
je 0x429dad
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x429dad
mov edi, eax
mov ecx, dword [ebp + 0xc]
and ecx, 0xf
xor eax, eax
mov esi, dword [ebp + 8]
movzx ebx, word [edi]
test ebx, ebx
je 0x429da0
cmp ecx, eax
je 0x429dc1
add edi, 2
lea edi, [edi + ebx*2]
jmp 0x429da3
add edi, 2
inc eax
cmp eax, 0x10
jne 0x429d8d
xor eax, eax
jmp 0x429db2
xor eax, eax
mov esi, dword [ebp + 8]
mov dword [esi + 4], eax
mov dword [esi], eax
mov dword [esi + 8], eax
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
cmp bx, 4
ja 0x429dce
mov byte [esi + 0xb], bl
mov eax, esi
jmp 0x429df7
lea esi, [ebx + 8]
and esi, 0xfffffff8
lea eax, [esi + esi]
push eax
call fcn.0048e8dd
add esp, 4
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
or esi, 0x80000000
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], esi
mov esi, dword [ebp + 8]
mov dword [esi + 4], ebx
add ebx, ebx
xor ecx, ecx
movzx edx, word [edi + ecx + 2]
mov word [eax + ecx], dx
add ecx, 2
cmp ebx, ecx
jne 0x429dfb
mov word [eax + ecx], 0
jmp 0x429dba

Function at 0x429e20
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, dword [ebp + 0xc]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ebx, eax
push 0x507430
push esi
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x429e7d
mov esi, eax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x429e7d
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
je 0x429e7d
mov ebx, eax
cmp eax, 0xfffffff0
jae 0x429ec6
cmp ebx, 0xa
ja 0x429e8c
mov esi, dword [ebp + 8]
mov byte [esi + 0xb], bl
mov eax, esi
jmp 0x429eae
xor eax, eax
mov esi, dword [ebp + 8]
mov dword [esi + 4], eax
mov dword [esi], eax
mov dword [esi + 8], eax
jmp 0x429ebf
lea esi, [ebx + 0x10]
and esi, 0xfffffff0
push esi
call fcn.0048e8dd
add esp, 4
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
or esi, 0x80000000
mov dword [ecx + 8], esi
mov esi, ecx
mov dword [ecx + 4], ebx
xor ecx, ecx
mov dl, byte [edi + ecx]
mov byte [eax + ecx], dl
inc ecx
cmp ebx, ecx
jne 0x429eb0
mov byte [eax + ecx], 0
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, dword [ebp + 8]
call fcn.004d0930
int3