joyce8/EMBER2024-capa huggingface dataset:
Function at 0x437960
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x48db00
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x4ad650]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
push 0x499064
lea ecx, [esp + 0x1c]
call fcn.00406140
push 0x499064
lea ecx, [esp + 0x14]
mov dword [esp + 0x3c], 0
call fcn.00406140
lea ecx, [esp + 0x20]
mov byte [esp + 0x38], 1
call fcn.0045dff2
push 1
lea eax, [esp + 0x1c]
push 0x499300
push eax
mov byte [esp + 0x44], 2
call fcn.004065f0
mov eax, dword [0x4b2994]
mov ecx, dword [eax - 0xc]
add esp, 0xc
push ecx
push eax
lea ecx, [esp + 0x18]
call fcn.004059f0
push 4
push str..dll
lea ecx, [esp + 0x18]
call fcn.004059f0
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x437a49
push str.Fatal_error:_Cannot_find_the_specified_resources__
lea ecx, [esp + 0x18]
call fcn.00406140
mov byte [esp + 0x38], 3
mov eax, dword [esp + 0x10]
mov edx, dword [eax - 0xc]
push edx
push eax
lea ecx, [esp + 0x1c]
call fcn.004059f0
mov eax, dword [esp + 0x14]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x20], esp
mov esi, esp
push eax
call fcn.00405c40
add eax, 0x10
add esp, 4
mov dword [esi], eax
call fcn.00433b90
mov eax, dword [0x4b1e14]
test eax, eax
je 0x437a59
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x4b1e14], eax
test eax, eax
jne 0x437a7e
call fcn.0045cd18
mov eax, dword [eax + 0xc]
mov dword [0x4b1e14], eax
xor edi, edi
jmp 0x437a83
mov edi, 1
mov esi, eax
call fcn.0045cd18
lea ecx, [esp + 0x20]
mov dword [eax + 0xc], esi
mov byte [esp + 0x38], 1
call fcn.0045e0fa
mov byte [esp + 0x38], 0
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x437ac0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x38], 0xffffffff
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x437ae8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, edi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x30
ret
Function at 0x439a10
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x48af40
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4ad650]
xor eax, esp
push eax
lea eax, [esp + 0x44]
mov dword fs:[0], eax
mov esi, ecx
mov eax, esi
call fcn.00439be0
mov eax, esi
call fcn.0043a0a0
push 1
call fcn.0043abb0
xor edi, edi
lea ecx, [esp + 0x30]
mov dword [esp + 0x14], edi
call fcn.004607c4
lea ecx, [esp + 0x1c]
mov dword [esp + 0x4c], edi
call fcn.004607c4
mov ebx, dword [esp + 0x54]
lea eax, [esp + 0x30]
push 0x3b
push eax
mov byte [esp + 0x54], 1
call fcn.0043a330
mov eax, dword [esp + 0x40]
add esp, 8
mov dword [esp + 0x18], edi
test eax, eax
jle 0x439b9f
test edi, edi
jl 0x439bd8
cmp edi, eax
jge 0x439bd8
mov ecx, dword [esp + 0x34]
lea edx, [esp + 0x1c]
push 0x2c
lea ebx, [ecx + edi*4]
push edx
call fcn.0043a330
mov eax, dword [esp + 0x2c]
add esp, 8
test eax, eax
jle 0x439b8e
cmp eax, 1
jle 0x439adf
mov eax, dword [esp + 0x20]
mov eax, dword [eax + 4]
push eax
call fcn.00471007
add esp, 4
mov dword [esp + 0x54], eax
jmp 0x439ae7
mov dword [esp + 0x54], 0x64
mov ebx, 2
cmp dword [esp + 0x24], ebx
jle 0x439b12
mov ecx, dword [esp + 0x20]
mov eax, dword [ecx + 8]
push eax
call fcn.00471007
add esp, 4
cmp eax, 1
je 0x439b14
cmp eax, ebx
jne 0x439b12
mov ebx, 1
jmp 0x439b14
xor ebx, ebx
cmp dword [esp + 0x24], 0
jle 0x439bd8
mov edx, dword [esp + 0x20]
mov ebp, dword [edx]
test esi, esi
jne 0x439b2d
xor eax, eax
jmp 0x439b30
mov eax, dword [esi + 0x20]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x101f
push eax
call edi
push eax
call fcn.00457a8a
mov eax, dword [eax + 0x20]
push 0
push 0
push 0x1200
push eax
call edi
push 1
mov edi, eax
call fcn.0043abb0
mov ecx, dword [esp + 0x54]
push 0xffffffffffffffff
push ecx
push ebx
push ebp
push edi
mov ecx, esi
call fcn.0045d730
mov edi, eax
test edi, edi
jl 0x439b7f
push 1
push esi
call fcn.0043b2a0
xor edx, edx
test edi, edi
mov edi, dword [esp + 0x18]
setge dl
or dword [esp + 0x14], edx
mov eax, dword [esp + 0x38]
inc edi
cmp edi, eax
mov dword [esp + 0x18], edi
jl 0x439a92
lea ecx, [esp + 0x1c]
mov byte [esp + 0x4c], 0
call fcn.004609a1
lea ecx, [esp + 0x30]
mov dword [esp + 0x4c], 0xffffffff
call fcn.004609a1
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x44]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret 4
call fcn.004540a4
int3
Function at 0x43c650
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x48b7b8
mov eax, dword fs:[0]
push eax
push ecx
push edi
mov eax, dword [0x4ad650]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov dword [esp + 0x14], 0
mov eax, dword [esp + 0x2c]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0xc], esp
mov edi, esp
push eax
call fcn.00405c40
add eax, 0x10
mov dword [edi], eax
mov eax, dword [esp + 0x24]
add esp, 4
push eax
call fcn.0043d5d0
mov dword [esi + 0xbc], eax
mov eax, dword [esp + 0x2c]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x20], esp
mov edi, esp
push eax
call fcn.00405c40
mov ecx, dword [esp + 0x28]
add esp, 4
add eax, 0x10
push ecx
mov dword [edi], eax
call fcn.0043d5d0
mov dword [esi + 0xb0], eax
mov eax, dword [esp + 0x2c]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x20], esp
mov edi, esp
push eax
call fcn.00405c40
mov edx, dword [esp + 0x2c]
add esp, 4
add eax, 0x10
push edx
mov dword [edi], eax
call fcn.0043d5d0
mov dword [esi + 0xb4], eax
mov eax, dword [esp + 0x2c]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x20], esp
mov edi, esp
push eax
call fcn.00405c40
add eax, 0x10
mov dword [edi], eax
mov eax, dword [esp + 0x30]
add esp, 4
push eax
call fcn.0043d5d0
cmp dword [esi + 0xbc], 0
mov dword [esi + 0xb8], eax
mov byte [esi + 0x64], 0
je 0x43c78d
cmp dword [esi + 0xb0], 0
je 0x43c78d
cmp dword [esi + 0xb4], 0
je 0x43c78d
test eax, eax
je 0x43c78d
mov dword [esp + 0x14], 0xffffffff
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43c775
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
add esp, 0x10
ret 0x14
mov dword [esp + 0x14], 0xffffffff
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43c7b5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
add esp, 0x10
ret 0x14
Function at 0x43d670
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0xffffffffffffffff
push 0x48b758
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4ad650]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0x3c], ebx
mov esi, dword [esp + 0x4c]
call fcn.0045cd18
movzx ecx, word [esp + 0x48]
mov eax, dword [eax + 0xc]
push esi
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
call fcn.0045cd18
mov eax, dword [eax + 0xc]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebp, eax
call fcn.0045cd18
mov eax, dword [eax + 0xc]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
push ebp
push 2
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edx, dword [esp + 0x18]
push edx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [esp + 0x14], ebx
cmp edi, ebx
je 0x43d7e1
cmp dword [esp + 0x18], ebx
je 0x43d7e1
cmp eax, ebx
je 0x43d7e1
mov ecx, dword [esp + 0x1c]
push ebp
push ecx
push eax
call fcn.00476650
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea edx, [esp + 0x14]
push edx
push 1
push esi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x24]
push eax
mov edi, vtable.Gdiplus::Image.0
push ecx
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], ebx
call sub.gdiplus.dll_GdipLoadImageFromStream
mov dword [esp + 0x28], eax
mov byte [esp + 0x3c], 2
mov edx, dword [esp + 0x20]
mov eax, dword [edx + 4]
lea ecx, [esp + 0x20]
call eax
mov ecx, dword [esp + 0x44]
mov byte [esp + 0x3c], bl
mov edx, dword [esp + 0x24]
push edx
mov dword [ecx], eax
mov dword [esp + 0x24], edi
call sub.gdiplus.dll_GdipDisposeImage
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov dword [esp + 0x3c], 0xffffffff
mov eax, dword [esp + 0x4c]
add eax, 0xfffffff0
mov dword [esp + 0x14], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43d7cb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 0xc
call fcn.00454183
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x43d7fb
push 0x80004005
call fcn.00406520
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x44], eax
mov ecx, dword [esp + 0x48]
push ecx
lea edx, [esp + 0x48]
push 0x49b988
push edx
mov byte [esp + 0x48], 1
call fcn.004065f0
mov eax, dword [esp + 0x50]
add esp, 0xc
push ebx
push ebx
push eax
call fcn.00453d58
push 1
call fcn.00470f2d
int3
Function at 0x43e320
Capabilities:
Create thread
Resume thread

Disassembly:
sub esp, 8
cmp dword [esi + 0x8c], 0
je 0x43e383
cmp dword [esi + 0x80], 0
je 0x43e389
mov ecx, dword [esi + 0xd0]
sub ecx, dword [esi + 0xcc]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 1
jbe 0x43e389
lea ecx, [esp + 4]
push ecx
push 4
push esi
push 0x43e870
push 0
push 0
call fcn.00471f16
add esp, 0x18
mov dword [esi + 0xa8], eax
test eax, eax
je 0x43e383
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
xor eax, eax
add esp, 8
ret
mov eax, dword [esi + 0xb0]
test eax, eax
je 0x43e383
mov edx, dword [eax]
mov edx, dword [edx + 0x18]
push edi
lea ecx, [esp + 8]
push ecx
push eax
call edx
mov eax, dword [esi + 0xb0]
mov ecx, dword [eax]
lea edx, [esp + 4]
push edx
push eax
mov eax, dword [ecx + 0x1c]
call eax
mov ecx, dword [esp + 4]
mov eax, dword [esi + 0xb0]
mov edx, dword [eax]
push 0
mov edx, dword [edx + 0x20]
mov edi, ecx
neg edi
push edi
mov edi, dword [esp + 0x10]
push edi
push ecx
mov ecx, dword [esi + 0x68]
push 0
push ecx
mov ecx, dword [esi + 0x64]
push ecx
mov ecx, dword [esi + 0x90]
push 0
push 0
push ecx
push eax
call edx
pop edi
test eax, eax
jne 0x43e383
push eax
push eax
mov eax, dword [esi + 0x20]
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
mov eax, 1
add esp, 8
ret

Function at 0x43e410
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push esi
push edi
call fcn.0045cd18
mov ecx, dword [esp + 0x18]
mov eax, dword [eax + 0xc]
push 0x499640
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x43e4bc
call fcn.0045cd18
mov eax, dword [eax + 0xc]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebp, eax
test ebp, ebp
je 0x43e4bc
call fcn.0045cd18
mov eax, dword [eax + 0xc]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
push edi
push 0x22
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x43e4bc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push ebp
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x43e4b5
test ebx, ebx
je 0x43e4b5
push edi
push eax
push ebx
call fcn.00476650
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [esp + 0x14]
push edi
push esi
call fcn.0043dd20
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret 8
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 8
Function at 0x444080
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x48d8b6
mov eax, dword fs:[0]
push eax
mov eax, 0x19214
call fcn.004745e0
mov eax, dword [0x4ad650]
xor eax, esp
mov dword [esp + 0x19210], eax
push ebx
push esi
push edi
mov eax, dword [0x4ad650]
xor eax, esp
push eax
lea eax, [esp + 0x19224]
mov dword fs:[0], eax
mov esi, ecx
xor ecx, ecx
push 0x191fc
push ecx
lea edx, [esp + 0x2c]
xor eax, eax
push edx
mov word [esp + 0x2c], ax
mov word [esp + 0x2e], cx
call fcn.00472360
add esp, 0xc
push esi
push 0xc900
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesW]
push 0x49c970
lea ecx, [esp + 0x18]
mov esi, eax
lea edi, [esp + 0x24]
mov dword [0x4b275c], 0
call fcn.00406140
mov dword [esp + 0x1922c], 0
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx - 0xc]
lea esi, [esp + esi*2 + 0x20]
mov eax, edi
mov dword [esp + 0x18], edx
cmp eax, esi
jae 0x44425c
push edi
lea ecx, [esp + 0x14]
call fcn.00406140
mov ecx, dword [esp + 0x18]
push ecx
lea edx, [esp + 0x20]
push edx
lea ecx, [esp + 0x18]
mov byte [esp + 0x19234], 1
call fcn.00408950
mov ecx, dword [esp + 0x14]
xor edx, edx
test ecx, ecx
setne dl
test edx, edx
je 0x44422f
mov eax, dword [eax]
mov edi, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x444196
test dx, dx
je 0x444192
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x444196
add eax, 4
add ecx, 4
test dx, dx
jne 0x444170
xor eax, eax
jmp 0x44419b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
mov eax, dword [esp + 0x1c]
sete bl
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4441c0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
je 0x4441e7
mov eax, dword [0x4b275c]
cmp eax, 0xc8
jae 0x4441e1
lea edx, [esp + 0x10]
lea ecx, [eax*4 + 0x4b2aa0]
push edx
call fcn.00405ba0
inc dword [0x4b275c]
mov eax, dword [esp + 0x10]
mov ecx, dword [eax - 0xc]
lea edi, [edi + ecx*2]
xor ecx, ecx
cmp cx, word [edi]
jne 0x444202
add edi, 2
xor edx, edx
cmp dx, word [edi]
je 0x444239
add eax, 0xfffffff0
mov byte [esp + 0x1922c], cl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x444225
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp edi, esi
jb 0x444134
jmp 0x44425c
push 0x80004005
call fcn.00406520
add eax, 0xfffffff0
mov byte [esp + 0x1922c], cl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x44425c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x1922c], 0xffffffff
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x444287
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x19224]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x19210]
xor ecx, esp
call fcn.004705a7
add esp, 0x19220
ret
Function at 0x448230
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x48ffc8
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x4ad650]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, edx
mov eax, dword [ebx]
mov ecx, dword [ebx + 4]
mov edx, dword [ebx + 8]
mov dword [esp + 0x18], eax
mov eax, dword [ebx + 0xc]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], vtable.CBrush.0
cmp dword [esp + 0x38], 0
mov dword [esp + 0x30], 0
jne 0x4482aa
mov eax, dword [0x4b5108]
cmp eax, 1
je 0x4482a3
cmp eax, 3
jne 0x4482aa
mov eax, 0x16
jmp 0x4482af
mov eax, 4
mov edi, dword [sym.imp.USER32.dll_GetSysColor]
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
lea ecx, [esp + 0x14]
call fcn.00453840
mov ecx, dword [esp + 0x14]
mov eax, dword [esi + 4]
push ecx
lea edx, [esp + 0x1c]
push edx
push eax
call dword [sym.imp.USER32.dll_FillRect]
lea ecx, [esp + 0x10]
call fcn.00453898
mov eax, dword [0x4b5108]
cmp eax, 1
je 0x4482f5
cmp eax, 3
jne 0x448308
mov edx, dword [esi + 4]
push 0xf
push 2
lea ecx, [esp + 0x20]
push ecx
push edx
call dword [sym.imp.USER32.dll_DrawEdge]
push 7
call edi
cmp dword [esp + 0x3c], 0
jne 0x448327
mov edi, dword [ebx + 4]
mov edx, dword [ebx]
add edi, 4
add edx, 4
mov ecx, eax
call fcn.00447ed0
jmp 0x44833a
mov ecx, dword [ebx + 4]
mov ebx, dword [ebx]
add ecx, 4
push ecx
add ebx, 5
mov ecx, eax
call fcn.00447dc0
mov dword [esp + 0x30], 0xffffffff
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], vtable.CBrush.0
call fcn.00406620
mov eax, 1
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x24
ret 8
Function at 0x449380
Capabilities:
Check os version
Get system information on windows

Disassembly:
sub esp, 0x144
mov eax, dword [0x4ad650]
xor eax, esp
mov dword [esp + 0x140], eax
push ebx
push esi
xor ebx, ebx
push 0x114
lea eax, [esp + 0x30]
push ebx
push eax
mov dword [0x4b1e0c], ebx
mov dword [0x4b1e10], 5
call fcn.00472360
add esp, 0xc
push str.GetNativeSystemInfo
push str.kernel32.dll
mov dword [esp + 0x34], 0x114
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x4493e7
lea ecx, [esp + 8]
push ecx
call eax
jmp 0x4493f2
lea edx, [esp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx eax, word [esp + 8]
cmp eax, 9
jg 0x44941f
je 0x449413
cmp eax, ebx
je 0x449426
cmp eax, 6
jne 0x449426
mov dword [0x4b1e0c], 1
jmp 0x449438
mov dword [0x4b1e0c], 2
jmp 0x449438
cmp eax, 0xffff
je 0x44942e
mov dword [0x4b1e0c], ebx
jmp 0x449438
mov dword [0x4b1e0c], 3
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea eax, [esp + 0x2c]
push eax
call esi
test eax, eax
jne 0x449462
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x140]
xor ecx, esp
call fcn.004705a7
add esp, 0x144
ret
push 0x11c
lea ecx, [esp + 0x30]
push ebx
push ecx
call fcn.00472360
add esp, 0xc
lea edx, [esp + 0x2c]
push edx
mov dword [esp + 0x30], 0x11c
call esi
test al, al
jne 0x44949b
lea eax, [esp + 0x2c]
push eax
mov dword [esp + 0x30], 0x114
call esi
test eax, eax
je 0x449449
mov eax, dword [esp + 0x3c]
sub eax, 1
je 0x44953f
sub eax, 1
je 0x4494bc
mov dword [0x4b1e10], 9
jmp 0x449576
mov eax, dword [esp + 0x30]
cmp eax, 4
ja 0x4494cf
mov dword [0x4b1e10], 3
mov ecx, 5
cmp eax, ecx
jne 0x449515
mov eax, dword [esp + 0x34]
cmp eax, ebx
jne 0x4494ef
mov dword [0x4b1e10], 4
jmp 0x449576
cmp eax, 1
je 0x44950d
cmp eax, 2
jne 0x449576
cmp byte [esp + 0x146], 1
mov dword [0x4b1e10], 6
jne 0x449576
mov dword [0x4b1e10], ecx
jmp 0x449576
cmp eax, 6
jne 0x449576
mov eax, dword [esp + 0x34]
cmp eax, ebx
jne 0x44952e
mov dword [0x4b1e10], 7
jmp 0x449576
cmp eax, 1
jne 0x449576
mov dword [0x4b1e10], 8
jmp 0x449576
cmp dword [esp + 0x30], 4
jne 0x449576
mov eax, dword [esp + 0x34]
cmp eax, ebx
jne 0x449556
mov dword [0x4b1e10], ebx
jmp 0x449576
cmp eax, 0xa
jne 0x449567
mov dword [0x4b1e10], 1
jmp 0x449576
cmp eax, 0x5a
jne 0x449576
mov dword [0x4b1e10], 2
mov ecx, dword [esp + 0x148]
pop esi
pop ebx
xor ecx, esp
mov eax, 1
call fcn.004705a7
add esp, 0x144
ret
Function at 0x452690
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov eax, dword [0x4ad650]
xor eax, esp
mov dword [esp + 0x10], eax
push esi
mov esi, ecx
push esi
push 0x30
push edi
mov byte [esp + 0x10], 0x30
mov byte [esp + 0x11], 0x31
mov byte [esp + 0x12], 0x32
mov byte [esp + 0x13], 0x33
mov byte [esp + 0x14], 0x34
mov byte [esp + 0x15], 0x35
mov byte [esp + 0x16], 0x36
mov byte [esp + 0x17], 0x37
mov byte [esp + 0x18], 0x38
mov byte [esp + 0x19], 0x39
mov byte [esp + 0x1a], 0x41
mov byte [esp + 0x1b], 0x42
mov byte [esp + 0x1c], 0x43
mov byte [esp + 0x1d], 0x44
mov byte [esp + 0x1e], 0x45
mov byte [esp + 0x1f], 0x46
call fcn.00472360
mov eax, dword [esp + 0x28]
add esp, 0xc
add eax, 0xffffffff
mov byte [esi + edi], 0
js 0x452739
lea ebx, [ebx]
test esi, esi
jle 0x452739
movzx ecx, byte [eax + ebx]
and ecx, 0xf
movzx edx, byte [esp + ecx + 4]
dec esi
mov byte [edi + esi], dl
movzx ecx, byte [eax + ebx]
shr ecx, 4
movzx edx, byte [esp + ecx + 4]
dec esi
sub eax, 1
mov byte [edi + esi], dl
jns 0x452710
mov ecx, dword [esp + 0x14]
pop esi
xor ecx, esp
mov eax, edi
call fcn.004705a7
add esp, 0x14
ret

Function at 0x454ec9
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x58], ebx
test ebx, 0xffff0000
jne 0x454eed
cmp dword [edi + 0x54], 0
jne 0x454eed
movzx eax, bx
mov dword [edi + 0x54], eax
call fcn.0045cd18
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.00454e8a
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x45a8de
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x45a925
call fcn.0045cd18
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x45a925
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x45a941
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.0045a456
mov esi, eax
test edi, edi
je 0x45a93f
test ebx, ebx
je 0x45a93f
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4