joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42b985
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0042b901
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x42bafd
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x42bafd
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x42baac
jg 0x42b9de
test eax, eax
je 0x42baa2
push 1
push 0x1000
call fcn.0041bf5d
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x42ba04
mov eax, dword [ebp + 0x14]
push 0xc
pop edi
mov byte [eax + 0x1c], 1
mov dword [eax + 0x18], edi
jmp 0x42ba99
push 0x8000
push ebx
call fcn.00418a54
mov edi, dword [ebp + 0x14]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x42ba30
jg 0x42ba2b
cmp ecx, 0x1000
jb 0x42ba30
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.0041d7be
add esp, 0x10
cmp eax, 0xffffffff
je 0x42ba75
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x42ba2b
jl 0x42ba5c
test ecx, ecx
jne 0x42ba1d
push dword [ebp - 0xc]
push ebx
call fcn.00418a54
push esi
call fcn.0041b344
add esp, 0xc
xor edi, edi
jmp 0x42bb0e
cmp byte [edi + 0x24], 0
je 0x42ba8c
cmp dword [edi + 0x20], 5
jne 0x42ba8c
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x42ba97
mov edi, dword [edi + 0x18]
jmp 0x42ba99
xor edi, edi
push esi
call fcn.0041b344
pop ecx
jmp 0x42bb0e
test ecx, ecx
jg 0x42ba6e
jl 0x42baac
test eax, eax
jae 0x42ba6e
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0041ef42
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x42bacf
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x42ba6e
jmp 0x42bb06
push ebx
call fcn.004248f9
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x42ba6e
mov esi, dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [esi + 0x24], 1
mov dword [esi + 0x20], eax
pop edi
mov byte [esi + 0x1c], 1
mov dword [esi + 0x18], edi
jmp 0x42bb0e
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x42bb0b
mov edi, dword [edi + 0x18]
jmp 0x42bb0e
push 0x16
pop edi
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.0041ef42
add esp, 0x10
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x42bf10
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42bf3d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42bf3d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x40563b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x40a020]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00402fd6
and dword [ebp - 0x14], 0
cmp dword [0x40b7d8], 0
mov dword [ebp - 0x18], eax
jne 0x4056ee
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x405796
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x405796
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x40b7d8], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x40b7dc], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x40b7e0], eax
call edi
push eax
call esi
mov dword [0x40b7e8], eax
test eax, eax
je 0x4056ee
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x40b7e4], eax
mov eax, dword [0x40b7e4]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x405747
cmp dword [0x40b7e8], ecx
je 0x405747
push eax
call esi
push dword [0x40b7e8]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x405747
test ebx, ebx
je 0x405747
call edi
test eax, eax
je 0x40573e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40573e
test byte [ebp - 8], 1
jne 0x405747
or dword [ebp + 0x10], 0x200000
jmp 0x40577a
mov eax, dword [0x40b7dc]
cmp eax, dword [ebp - 0x18]
je 0x40577a
push eax
call esi
test eax, eax
je 0x40577a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40577a
mov eax, dword [0x40b7e0]
cmp eax, dword [ebp - 0x18]
je 0x40577a
push eax
call esi
test eax, eax
je 0x40577a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x40b7d8]
call esi
test eax, eax
je 0x405796
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x405798
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040239a
leave
ret

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40915c
nop
nop
mov ecx, 0xa0d0ae2
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x43104e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x431024
nop
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42f3f8
mov ecx, 0x14214338
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x431084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x40af74
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
cmp dword [ebp + 0xc], 0
je 0x40b073
call fcn.004f0972
mov dword [ebp - 0x10], eax
push pe_nt_image_headers32
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x40b01b
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x40afec
push str.DLGINIT_resource_was_found__but_could_not_be_loaded._n
push 0x5f8b00
call fcn.0045e185
add esp, 8
xor eax, eax
jmp 0x40b0bc
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40b013
push 0x146
push str.occmgr.cpp
call fcn.004e7650
test eax, eax
je 0x40b013
int3
xor edx, edx
test edx, edx
jne 0x40aff9
jmp 0x40b073
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], 0
jne 0x40b03e
push 0x14e
push str.occmgr.cpp
call fcn.004e7650
test eax, eax
je 0x40b03e
int3
xor edx, edx
test edx, edx
jne 0x40b024
mov eax, dword [ebp - 0x18]
cmp dword [eax], 0xffffffff
je 0x40b073
mov ecx, dword [ebp - 0x18]
cmp dword [ecx], 0
je 0x40b068
push str.Dialog_has_OLE_controls__but_no_matching_DLGINIT_resource._n
push 0x5f8b40
call fcn.0045e185
add esp, 8
jmp 0x40b073
mov edx, dword [ebp - 0x18]
add edx, 4
mov dword [ebp - 0x18], edx
jmp 0x40b044
mov dword [ebp - 0xc], 1
cmp dword [ebp - 4], 0
je 0x40b09a
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x1c]
call dword [edx + 0x1c]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 4], 0
je 0x40b0b9
cmp dword [ebp - 8], 0
je 0x40b0b9
mov eax, dword [ebp - 8]
push eax
call fcn.00409f60
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x446cf0
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0x40
xor eax, eax
push ebx
push ebp
push esi
mov ebx, ecx
push edi
mov ecx, 0x10
lea edi, [esp + 0x10]
push dword [0x606fd8]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x58]
lea eax, [esp + 0x14]
push eax
push ecx
mov ecx, ebx
call fcn.00446e10
lea edx, [esp + 0x10]
push dword [0x606fdc]
push edx
push eax
mov ecx, ebx
call fcn.00446e10
lea ecx, [esp + 0x10]
push dword [0x606fe0]
push ecx
push eax
mov ecx, ebx
call fcn.00446e10
lea edx, [esp + 0x10]
push dword [0x606fe4]
push edx
push eax
mov ecx, ebx
call fcn.00446e10
mov ecx, 0xe
lea esi, [esp + 0x10]
lea edi, [esp + 0x10]
mov ebp, ebx
rep movsd dword es:[edi], dword [esi]
mov edx, dword [0x606670]
mov al, byte [esp + 0x10]
mov ecx, 0x1b
lea esi, [esp + 0x11]
lea edi, [esp + 0x10]
rep movsb byte es:[edi], byte [esi]
mov byte [esp + 0x2b], al
mov al, byte [esp + 0x2c]
mov ecx, 0x1b
lea esi, [esp + 0x2d]
lea edi, [esp + 0x2c]
rep movsb byte es:[edi], byte [esi]
mov byte [esp + 0x47], al
mov eax, dword [edx]
cmp eax, 2
jne 0x446dd0
mov al, byte [esp + 0x10]
mov ecx, 0x1b
lea esi, [esp + 0x11]
lea edi, [esp + 0x10]
rep movsb byte es:[edi], byte [esi]
mov byte [esp + 0x2b], al
mov al, byte [esp + 0x2c]
mov ecx, 0x1b
lea esi, [esp + 0x2d]
lea edi, [esp + 0x2c]
rep movsb byte es:[edi], byte [esi]
mov byte [esp + 0x47], al
xor eax, eax
xor ecx, ecx
mov cl, byte [eax + 0x606674]
inc eax
cmp eax, 0x30
mov cl, byte [esp + ecx + 0xf]
mov byte [eax + ebp - 1], cl
jl 0x446dd2
add edx, 4
add ebp, 0x30
cmp edx, dword [0x60666c]
jl 0x446d6d
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x40
ret 4
Function at 0x446e10
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0x3c
push ebx
mov ebx, dword [esp + 0x44]
mov dword [esp + 4], ecx
push ebp
mov ecx, dword [esp + 0x4c]
push esi
or esi, 0xffffffff
push edi
lea eax, [ecx + 1]
sub esi, ecx
movsx ecx, byte [ebx]
test ecx, ecx
je 0x446e33
inc ebx
mov edx, ecx
add eax, 8
sar edx, 7
and dl, 1
xor byte [eax - 9], dl
mov edx, ecx
sar edx, 6
and dl, 1
xor byte [eax - 8], dl
mov edx, ecx
sar edx, 5
and dl, 1
xor byte [eax - 7], dl
mov edx, ecx
sar edx, 4
and dl, 1
xor byte [eax - 6], dl
mov edx, ecx
sar edx, 3
and dl, 1
xor byte [eax - 5], dl
mov edx, ecx
sar edx, 2
and dl, 1
xor byte [eax - 4], dl
mov edx, ecx
sar edx, 1
and dl, 1
and cl, 1
xor byte [eax - 3], dl
mov dl, byte [eax - 2]
xor dl, cl
lea ecx, [esi + eax]
mov byte [eax - 2], dl
cmp ecx, 0x40
jl 0x446e2b
mov esi, dword [esp + 0x58]
mov ebp, dword [esp + 0x10]
mov ecx, 0xe
lea edi, [esp + 0x14]
rep movsd dword es:[edi], dword [esi]
mov edx, dword [0x606670]
mov al, byte [esp + 0x14]
mov ecx, 0x1b
lea esi, [esp + 0x15]
lea edi, [esp + 0x14]
rep movsb byte es:[edi], byte [esi]
mov byte [esp + 0x2f], al
mov al, byte [esp + 0x30]
mov ecx, 0x1b
lea esi, [esp + 0x31]
lea edi, [esp + 0x30]
rep movsb byte es:[edi], byte [esi]
mov byte [esp + 0x4b], al
mov eax, dword [edx]
cmp eax, 2
jne 0x446f16
mov al, byte [esp + 0x14]
mov ecx, 0x1b
lea esi, [esp + 0x15]
lea edi, [esp + 0x14]
rep movsb byte es:[edi], byte [esi]
mov byte [esp + 0x2f], al
mov al, byte [esp + 0x30]
mov ecx, 0x1b
lea esi, [esp + 0x31]
lea edi, [esp + 0x30]
rep movsb byte es:[edi], byte [esi]
mov byte [esp + 0x4b], al
xor eax, eax
xor ecx, ecx
mov cl, byte [eax + 0x606674]
inc eax
cmp eax, 0x30
mov cl, byte [esp + ecx + 0x13]
mov byte [eax + ebp - 1], cl
jl 0x446f18
add edx, 4
add ebp, 0x30
cmp edx, dword [0x60666c]
jl 0x446eaf
mov edx, dword [esp + 0x54]
mov ecx, dword [esp + 0x10]
push 1
push edx
call fcn.00446f60
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x3c
ret 0xc
Function at 0x4472e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x100
push ebx
push esi
mov esi, 0x16
mov eax, 5
mov dword [esp + 0x78], esi
mov dword [esp + 0xa0], esi
mov esi, dword [esp + 0x10c]
push edi
mov dword [esp + 0x88], eax
mov dword [esp + 0xcc], eax
mov ebx, 3
mov edi, 7
mov edx, 1
mov ecx, 0x19
xor eax, eax
mov dword [esp + 0xc], 0x1a
test esi, esi
mov dword [esp + 0x10], 0x1f
mov dword [esp + 0x14], 0x11
mov dword [esp + 0x18], 0xa
mov dword [esp + 0x1c], 0x1e
mov dword [esp + 0x20], 0x10
mov dword [esp + 0x24], 0x18
mov dword [esp + 0x28], 2
mov dword [esp + 0x2c], 0x1d
mov dword [esp + 0x30], 8
mov dword [esp + 0x34], 0x14
mov dword [esp + 0x38], 0xf
mov dword [esp + 0x3c], 0x1c
mov dword [esp + 0x40], 0xb
mov dword [esp + 0x44], 0xd
mov dword [esp + 0x48], 4
mov dword [esp + 0x4c], 0x13
mov dword [esp + 0x50], 0x17
mov dword [esp + 0x54], 0
mov dword [esp + 0x58], 0xc
mov dword [esp + 0x5c], 0xe
mov dword [esp + 0x60], 0x1b
mov dword [esp + 0x64], 6
mov dword [esp + 0x68], 0x12
mov dword [esp + 0x6c], 0x15
mov dword [esp + 0x70], ebx
mov dword [esp + 0x74], 9
mov dword [esp + 0x78], edi
mov dword [esp + 0x80], edx
mov dword [esp + 0x84], ecx
mov dword [esp + 0x8c], 0x12
mov dword [esp + 0x90], 0x1d
mov dword [esp + 0x94], edi
mov dword [esp + 0x98], ecx
mov dword [esp + 0x9c], 0xf
mov dword [esp + 0xa0], 0x1f
mov dword [esp + 0xa8], 0x1b
mov dword [esp + 0xac], 9
mov dword [esp + 0xb0], 0x1a
mov dword [esp + 0xb4], ebx
mov dword [esp + 0xb8], 0xd
mov dword [esp + 0xbc], 0x13
mov dword [esp + 0xc0], 0xe
mov dword [esp + 0xc4], 0x14
mov dword [esp + 0xc8], 0xb
mov dword [esp + 0xd0], 2
mov dword [esp + 0xd4], 0x17
mov dword [esp + 0xd8], 0x10
mov dword [esp + 0xdc], 0xa
mov dword [esp + 0xe0], 0x18
mov dword [esp + 0xe4], 0x1c
mov dword [esp + 0xe8], 0x11
mov dword [esp + 0xec], 6
mov dword [esp + 0xf0], 0x1e
mov dword [esp + 0xf4], 0
mov dword [esp + 0xf8], 0x15
mov dword [esp + 0xfc], 0xc
mov dword [esp + 0x100], 8
mov dword [esp + 0x104], 4
mov dword [esp + 0x108], edx
jbe 0x447581
mov bl, byte [esp + 0x114]
xor edi, edi
mov ecx, esi
mov edx, esi
and ecx, 0xfffffffe
sub edx, ecx
shr esi, 1
test edx, edx
je 0x44757a
test bl, bl
je 0x44756f
mov ecx, dword [esp + edi + 0xc]
jmp 0x447576
mov ecx, dword [esp + edi + 0x8c]
shl edx, cl
add eax, edx
add edi, 4
test esi, esi
ja 0x447556
pop edi
pop esi
pop ebx
add esp, 0x100
ret 8
Function at 0x44aa20
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
push 0xf00021
mov edx, dword [esi + 4]
mov ecx, dword [esi]
mov eax, dword [esi + 0xc]
sub eax, edx
push eax
mov eax, dword [esi + 8]
sub eax, ecx
push eax
push edx
push ecx
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.GDI32.dll_PatBlt]
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov ebx, eax
lea eax, [eax + 5]
add eax, 3
and eax, 0xfffffffc
call fcn.00426550
mov dword [ebp - 4], esp
cmp dword [ebp - 4], 0
je 0x44aaeb
add ebx, 2
mov eax, dword [ebp - 4]
push ebx
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
je 0x44aaeb
mov bx, 0x140
mov edi, dword [ebp + 0x14]
mov eax, edi
and al, 0xf
cmp al, 0xc
je 0x44aa9e
mov ebx, edi
and bx, 0xf
or bx, 0x150
test edi, 0x80
je 0x44aaa9
or bh, 8
and edi, 0x8000000
je 0x44aac4
mov eax, dword [0x60f4bc]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
movzx eax, bx
push eax
push esi
push 0xffffffffffffffff
push ecx
push edx
call dword [sym.imp.USER32.dll_DrawTextA]
test edi, edi
je 0x44aaeb
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44aec0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
sub esp, 4
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
push ebp
push 2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x44aeeb
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
jne 0x44af0f
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push ebx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
test ebp, ebp
jne 0x44af2a
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
mov edi, ebp
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x20]
xor ecx, ecx
mov cl, ah
mov edx, eax
mov dword [esp + 0x10], 0
shl ecx, 8
shr edx, 0x10
mov byte [esp + 0x10], dl
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x28]
or ecx, edx
mov edx, eax
shr edx, 0x10
mov dword [ebp + 0x28], ecx
mov dword [esp + 0x10], 0
xor ecx, ecx
mov byte [esp + 0x10], dl
mov cl, ah
xor edx, edx
shl ecx, 8
mov dl, al
shl edx, 0x10
or ecx, dword [esp + 0x10]
or ecx, edx
mov eax, dword [esp + 0x24]
mov edx, eax
mov dword [ebp + 0x44], ecx
shr edx, 0x10
xor ecx, ecx
mov dword [esp + 0x10], 0
mov cl, ah
mov byte [esp + 0x10], dl
shl ecx, 8
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x2c]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x48], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x30]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x64], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x34]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x54], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
push 0
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
or ecx, edx
mov dword [ebp + 0x50], ecx
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
push 0
push ebp
lea ecx, [ebp + 0x68]
push ecx
push 4
push ebp
push edi
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
mov esi, eax
push edi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
Function at 0x48851d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], 0
mov dword [ebp - 0xc], 0
call fcn.004f0972
mov dword [ebp - 4], eax
push 5
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x488576
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x488590
push 0xeb
push str.dlgcore.cpp
call fcn.004e7650
test eax, eax
je 0x488590
int3
xor edx, edx
test edx, edx
jne 0x488576
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x14]
push edx
mov ecx, dword [ebp - 0x18]
call fcn.004885eb
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0xc]
push eax
call fcn.00409f60
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x48933e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0x48]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + 0x44]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x24]
cmp dword [ecx + 0x40], 0
je 0x489391
call fcn.004f0972
mov dword [ebp - 0x10], eax
push 5
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + 0x40]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4893a4
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 1
cmp dword [ebp - 0xc], 0
je 0x489438
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0xc]
xor edx, edx
mov dx, word [ecx + 2]
cmp edx, 0xffff
jne 0x4893ef
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0xc]
mov ax, word [edx + 0x12]
mov word [ebp - 0x18], ax
mov ecx, dword [ebp - 0xc]
mov dx, word [ecx + 0x14]
mov word [ebp - 0x1c], dx
jmp 0x489405
mov eax, dword [ebp - 0xc]
mov cx, word [eax + 0xa]
mov word [ebp - 0x18], cx
mov edx, dword [ebp - 0xc]
mov ax, word [edx + 0xc]
mov word [ebp - 0x1c], ax
mov ecx, dword [ebp - 0x20]
and ecx, 0x1801
test ecx, ecx
jne 0x48942b
movsx edx, word [ebp - 0x18]
test edx, edx
jne 0x48942b
movsx eax, word [ebp - 0x1c]
test eax, eax
jne 0x48942b
mov dword [ebp - 0x28], 1
jmp 0x489432
mov dword [ebp - 0x28], 0
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x24]
cmp dword [edx + 0x40], 0
jne 0x48944a
mov eax, dword [ebp - 0x24]
cmp dword [eax + 0x44], 0
je 0x489453
mov ecx, dword [ebp - 4]
push ecx
call fcn.00409f60
mov edx, dword [ebp - 0x24]
cmp dword [edx + 0x40], 0
je 0x489466
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret