joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41b5b0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe4
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0xe4]
mov ecx, 0x39
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax + 0x11e0], 0xffffffff
je 0x41b5fe
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x11e0]
push ecx
push str.____Fail_to_Connect_to_Server._Another_SocketId__d__Exists___n
call fcn.0054b370
add esp, 8
or eax, 0xffffffff
jmp 0x41b776
mov ecx, dword [ebp - 8]
call fcn.0041ae40
cmp eax, 0xffffffff
jne 0x41b61b
mov ecx, dword [ebp - 8]
call fcn.0041b180
or eax, 0xffffffff
jmp 0x41b776
mov esi, esp
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
cmp esi, esp
call fcn.00544880
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x11e0], eax
mov eax, dword [ebp - 8]
cmp dword [eax + 0x11e0], 0xffffffff
jne 0x41b685
call fcn.0054cb70
mov eax, dword [eax]
push eax
call fcn.0054c750
add esp, 4
push eax
call fcn.0054cb70
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x11e0]
push eax
push str.____Fail_to_Create_Socket__d__socket__return__1._errno__d__errstr__s_n
call fcn.0054b370
add esp, 0x10
mov ecx, dword [ebp - 8]
call fcn.0041b180
or eax, 0xffffffff
jmp 0x41b776
mov dword [ebp - 0x14], 8
mov dword [ebp - 0x20], 4
mov esi, esp
mov eax, dword [ebp - 0x20]
push eax
lea ecx, [ebp - 0x14]
push ecx
push 0x80
push 0xffff
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x11e0]
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp esi, esp
call fcn.00544880
cmp eax, 0xffffffff
jne 0x41b700
call fcn.0054cb70
mov eax, dword [eax]
push eax
call fcn.0054c750
add esp, 4
push eax
call fcn.0054cb70
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x11e0]
push eax
push str.____Fail_to_Create_Socket__d__setsockopt__return__1._errno__d__errstr__s_n
call fcn.0054b370
add esp, 0x10
mov ecx, dword [ebp - 8]
call fcn.0041b180
or eax, 0xffffffff
jmp 0x41b776
mov esi, esp
push 0x10
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x11e0]
push edx
call dword [sym.imp.WS2_32.dll_connect]
cmp esi, esp
call fcn.00544880
cmp eax, 0xffffffff
jne 0x41b731
mov ecx, dword [ebp - 8]
call fcn.0041b180
or eax, 0xffffffff
jmp 0x41b776
push 0x40
push 0
mov eax, dword [ebp - 8]
add eax, 0x9c
push eax
call fcn.00545490
add esp, 0xc
mov eax, dword [ebp + 0xc]
push eax
push 0x5c158c
mov ecx, dword [ebp - 8]
add ecx, 0x9c
push ecx
call fcn.00544ff0
add esp, 0xc
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0x10]
mov dword [eax + 0x98], ecx
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x11e0]
push edx
mov ecx, ebp
push eax
lea edx, [0x41b7a0]
call fcn.005448b0
pop eax
pop edx
pop edi
pop esi
pop ebx
add esp, 0xe4
cmp ebp, esp
call fcn.00544880
mov esp, ebp
pop ebp
ret 0xc
Function at 0x41bb00
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x110]
mov ecx, 0x44
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 8], ecx
cmp dword [ebp + 0x10], 0xffffffff
jne 0x41bb35
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x11e0]
mov dword [ebp + 0x10], ecx
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x20], 0
lea eax, [ebp - 0x30]
push eax
call fcn.0041c7e0
add esp, 4
mov eax, dword [ebp - 0x30]
add eax, 5
mov ecx, dword [ebp - 0x2c]
adc ecx, 0
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x4c], 0
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp + 0xc]
jge 0x41bc7a
mov esi, esp
push 0
mov eax, dword [ebp + 0xc]
sub eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
call dword [sym.imp.WS2_32.dll_send]
cmp esi, esp
call fcn.00544880
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xffffffff
jne 0x41bbf5
mov esi, esp
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp esi, esp
call fcn.00544880
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0x2733
jne 0x41bbce
mov esi, esp
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, esp
call fcn.00544880
jmp 0x41bbf3
mov eax, dword [ebp - 0x4c]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x11e0]
push edx
push str.____Error_Send_SocketId__d__iError__d__n
call fcn.0054b370
add esp, 0xc
mov eax, dword [ebp - 0x4c]
neg eax
jmp 0x41bc7d
jmp 0x41bc1b
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp + 0xc]
jl 0x41bc0a
jmp 0x41bc7a
mov esi, esp
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, esp
call fcn.00544880
mov eax, dword [ebp - 0x3c]
cmp eax, dword [ebp - 0x2c]
jg 0x41bc62
jl 0x41bc2d
mov ecx, dword [ebp - 0x40]
cmp ecx, dword [ebp - 0x30]
jae 0x41bc62
mov eax, dword [ebp - 0x4c]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
push 5
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x11e0]
push eax
push str.____Send_Time_Over_SocketId__d___WaitTime__d___Sent__d___iError__d__n
call fcn.0054b370
add esp, 0x14
cmp dword [ebp - 0x14], 0
jle 0x41bc5b
or eax, 0xffffffff
jmp 0x41bc7d
mov eax, dword [ebp - 0x4c]
neg eax
jmp 0x41bc7d
lea eax, [ebp - 0x30]
push eax
call fcn.0041c7e0
add esp, 4
mov dword [ebp - 0x4c], 0
jmp 0x41bb68
mov eax, dword [ebp - 0x14]
push edx
mov ecx, ebp
push eax
lea edx, [0x41bca4]
call fcn.005448b0
pop eax
pop edx
pop edi
pop esi
pop ebx
add esp, 0x110
cmp ebp, esp
call fcn.00544880
mov esp, ebp
pop ebp
ret 0xc
Function at 0x42adb0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xfc
push ebx
push esi
push edi
lea edi, [ebp - 0xfc]
mov ecx, 0x3f
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov esi, esp
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp esi, esp
call fcn.00544880
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jne 0x42adf5
xor eax, eax
jmp 0x42ae87
mov esi, esp
mov eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp esi, esp
call fcn.00544880
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x42ae15
xor eax, eax
jmp 0x42ae87
mov esi, esp
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
cmp esi, esp
call fcn.00544880
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x10]
and eax, 0xf
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jbe 0x42ae6a
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x14]
jae 0x42ae6a
mov eax, dword [ebp - 8]
movzx ecx, word [eax]
mov edx, dword [ebp - 8]
lea eax, [edx + ecx*2 + 2]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x38]
sub eax, 1
mov dword [ebp - 0x38], eax
jmp 0x42ae41
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x14]
jb 0x42ae76
xor eax, eax
jmp 0x42ae87
mov eax, dword [ebp - 8]
movzx ecx, word [eax]
test ecx, ecx
jne 0x42ae84
xor eax, eax
jmp 0x42ae87
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
add esp, 0xfc
cmp ebp, esp
call fcn.00544880
mov esp, ebp
pop ebp
ret
Function at 0x439080
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b3f20
mov eax, dword fs:[0]
push eax
sub esp, 0x144
push ebx
push esi
push edi
lea edi, [ebp - 0x150]
mov ecx, 0x51
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x616870]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x58]
call fcn.004207e0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x58]
call fcn.00439290
mov byte [ebp - 4], 1
mov esi, esp
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x2c]
push ecx
lea edx, [ebp - 0x20]
push edx
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x64]
call fcn.004088a0
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
cmp esi, esp
call fcn.00544880
test eax, eax
jne 0x439171
lea eax, [ebp - 0x64]
push eax
call fcn.00426750
add esp, 4
mov esi, esp
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x2c]
push ecx
lea edx, [ebp - 0x20]
push edx
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x64]
call fcn.004088a0
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
cmp esi, esp
call fcn.00544880
test eax, eax
jne 0x439171
mov dword [ebp - 0x14c], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x64]
call fcn.00408860
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x58]
call fcn.0043ea40
mov eax, dword [ebp - 0x14c]
jmp 0x4391ae
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x20]
imul eax, dword [ebp - 0x2c]
xor ecx, ecx
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x70], ecx
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x140], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x64]
call fcn.00408860
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x58]
call fcn.0043ea40
mov eax, dword [ebp - 0x140]
push edx
mov ecx, ebp
push eax
lea edx, [0x4391e0]
call fcn.005448b0
pop eax
pop edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x150
cmp ebp, esp
call fcn.00544880
mov esp, ebp
pop ebp
ret

Function at 0x439300
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
push ebx
push esi
push edi
lea edi, [ebp - 0xd8]
mov ecx, 0x36
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov esi, esp
push 0
push 0
push 3
push 0
push 1
push OleUIInsertObjectA
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp esi, esp
call fcn.00544880
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x43934d
xor al, al
jmp 0x43938c
mov esi, esp
push 0
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp esi, esp
call fcn.00544880
mov dword [ebp - 0x14], eax
mov esi, esp
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.00544880
cmp dword [ebp - 0x14], 0xffffffff
jne 0x439382
xor al, al
jmp 0x43938c
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x14]
mov dword [eax], ecx
mov al, 1
pop edi
pop esi
pop ebx
add esp, 0xd8
cmp ebp, esp
call fcn.00544880
mov esp, ebp
pop ebp
ret
Function at 0x439660
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xfc
push ebx
push esi
push edi
lea edi, [ebp - 0xfc]
mov ecx, 0x3f
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov esi, esp
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
cmp esi, esp
call fcn.00544880
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x43969e
xor al, al
jmp 0x439705
mov eax, dword [ebp - 8]
push eax
call fcn.00447820
add esp, 4
mov dword [ebp - 0xf8], eax
mov ecx, dword [ebp - 0xf8]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 0x1d], 1
mov esi, esp
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
cmp esi, esp
call fcn.00544880
test eax, eax
jne 0x4396de
mov byte [ebp - 0x1d], 0
jmp 0x4396ea
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp + 8]
call fcn.00429bd0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xec], eax
mov ecx, dword [ebp - 0xec]
push ecx
call fcn.00447840
add esp, 4
mov al, byte [ebp - 0x1d]
pop edi
pop esi
pop ebx
add esp, 0xfc
cmp ebp, esp
call fcn.00544880
mov esp, ebp
pop ebp
ret

Function at 0x439720
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc0
push ebx
push esi
push edi
lea edi, [ebp - 0xc0]
mov ecx, 0x30
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov esi, esp
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
cmp esi, esp
call fcn.00544880
neg eax
sbb eax, eax
neg eax
pop edi
pop esi
pop ebx
add esp, 0xc0
cmp ebp, esp
call fcn.00544880
mov esp, ebp
pop ebp
ret

Function at 0x439770
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
push ebx
push esi
push edi
lea edi, [ebp - 0xcc]
mov ecx, 0x33
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov esi, esp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp esi, esp
call fcn.00544880
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x4397ae
xor al, al
jmp 0x4397b8
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
mov al, 1
pop edi
pop esi
pop ebx
add esp, 0xcc
cmp ebp, esp
call fcn.00544880
mov esp, ebp
pop ebp
ret
Function at 0x439ab0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b3f78
mov eax, dword fs:[0]
push eax
sub esp, 0xfc
push ebx
push esi
push edi
lea edi, [ebp - 0x108]
mov ecx, 0x3f
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x616870]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x28]
call fcn.004207e0
mov dword [ebp - 4], 0
lea eax, [ebp - 0xf4]
push eax
lea ecx, [ebp - 0x28]
call fcn.00439290
mov dword [ebp - 0x108], eax
mov ecx, dword [ebp - 0x108]
call fcn.004088a0
mov esi, esp
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp esi, esp
call fcn.00544880
xor ecx, ecx
cmp eax, 2
sete cl
mov byte [ebp - 0xfd], cl
lea ecx, [ebp - 0xf4]
call fcn.00408860
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.0043ea40
mov al, byte [ebp - 0xfd]
push edx
mov ecx, ebp
push eax
lea edx, [0x439b90]
call fcn.005448b0
pop eax
pop edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x108
cmp ebp, esp
call fcn.00544880
mov esp, ebp
pop ebp
ret

Function at 0x439d60
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc0
push ebx
push esi
push edi
lea edi, [ebp - 0xc0]
mov ecx, 0x30
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov esi, esp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp esi, esp
call fcn.00544880
test eax, eax
jne 0x439db1
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x439dad
mov eax, dword [ebp + 8]
push eax
push 0x71
call fcn.0041d9f0
add esp, 8
jmp 0x439db1
xor al, al
jmp 0x439db3
mov al, 1
pop edi
pop esi
pop ebx
add esp, 0xc0
cmp ebp, esp
call fcn.00544880
mov esp, ebp
pop ebp
ret

Function at 0x439dd0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc0
push ebx
push esi
push edi
lea edi, [ebp - 0xc0]
mov ecx, 0x30
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov esi, esp
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
cmp esi, esp
call fcn.00544880
test eax, eax
jne 0x439e25
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x439e21
mov eax, dword [ebp + 8]
push eax
push 0x72
call fcn.0041d9f0
add esp, 8
jmp 0x439e25
xor al, al
jmp 0x439e27
mov al, 1
pop edi
pop esi
pop ebx
add esp, 0xc0
cmp ebp, esp
call fcn.00544880
mov esp, ebp
pop ebp
ret

Function at 0x439e80
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc0
push ebx
push esi
push edi
lea edi, [ebp - 0xc0]
mov ecx, 0x30
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov esi, esp
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
cmp esi, esp
call fcn.00544880
neg eax
sbb eax, eax
neg eax
pop edi
pop esi
pop ebx
add esp, 0xc0
cmp ebp, esp
call fcn.00544880
mov esp, ebp
pop ebp
ret
Function at 0x43c0c0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc0
push ebx
push esi
push edi
lea edi, [ebp - 0xc0]
mov ecx, 0x30
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
cmp dword [ebp + 0xc], 0
jne 0x43c0eb
xor eax, eax
jmp 0x43c28b
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
mov dword [ebp + 8], eax
cmp dword [ebp + 0x10], 8
jb 0x43c24c
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax]
xor ecx, dword [ebp + 8]
and ecx, 0xff
mov edx, dword [ebp + 8]
shr edx, 8
xor edx, dword [ecx*4 + 0x5c6008]
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax]
xor ecx, dword [ebp + 8]
and ecx, 0xff
mov edx, dword [ebp + 8]
shr edx, 8
xor edx, dword [ecx*4 + 0x5c6008]
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax]
xor ecx, dword [ebp + 8]
and ecx, 0xff
mov edx, dword [ebp + 8]
shr edx, 8
xor edx, dword [ecx*4 + 0x5c6008]
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax]
xor ecx, dword [ebp + 8]
and ecx, 0xff
mov edx, dword [ebp + 8]
shr edx, 8
xor edx, dword [ecx*4 + 0x5c6008]
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax]
xor ecx, dword [ebp + 8]
and ecx, 0xff
mov edx, dword [ebp + 8]
shr edx, 8
xor edx, dword [ecx*4 + 0x5c6008]
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax]
xor ecx, dword [ebp + 8]
and ecx, 0xff
mov edx, dword [ebp + 8]
shr edx, 8
xor edx, dword [ecx*4 + 0x5c6008]
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax]
xor ecx, dword [ebp + 8]
and ecx, 0xff
mov edx, dword [ebp + 8]
shr edx, 8
xor edx, dword [ecx*4 + 0x5c6008]
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax]
xor ecx, dword [ebp + 8]
and ecx, 0xff
mov edx, dword [ebp + 8]
shr edx, 8
xor edx, dword [ecx*4 + 0x5c6008]
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 0x10]
sub eax, 8
mov dword [ebp + 0x10], eax
jmp 0x43c0f4
cmp dword [ebp + 0x10], 0
je 0x43c285
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax]
xor ecx, dword [ebp + 8]
and ecx, 0xff
mov edx, dword [ebp + 8]
shr edx, 8
xor edx, dword [ecx*4 + 0x5c6008]
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 0x10]
sub eax, 1
mov dword [ebp + 0x10], eax
jne 0x43c252
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4576f0
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x20]
push ecx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x457720
push 0x45d
push 0x5c93f8
call fcn.0049c040
test eax, eax
je 0x457720
int3
mov eax, dword [ebp - 8]
cmp dword [eax + 0x50], 0
jne 0x457766
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x20]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
add eax, 1
push eax
mov ecx, dword [ebp - 4]
push ecx
mov ecx, dword [ebp + 8]
call fcn.004625e0
push eax
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x20]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0xffffffffffffffff
mov ecx, dword [ebp + 8]
call fcn.0042a660
jmp 0x457780
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x50]
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx + 0x50]
mov edx, dword [eax]
mov eax, dword [edx + 0x94]
call eax
mov esp, ebp
pop ebp
ret 4

Function at 0x45ef40
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
cmp dword [ebp + 8], 0
je 0x45efc5
call fcn.0047d240
mov dword [ebp - 0x10], eax
push pe_nt_image_headers32
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x45efc5
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x45ef9e
xor eax, eax
jmp 0x45eff6
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x45efc5
push 0x1047
push 0x5c93f8
call fcn.0049c040
test eax, eax
je 0x45efc5
int3
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0x18]
call fcn.0045f010
mov dword [ebp - 8], eax
cmp dword [ebp - 4], 0
je 0x45eff3
cmp dword [ebp - 0xc], 0
je 0x45eff3
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.0045f000
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 4
Function at 0x46e390
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b5998
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x616870]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x20]
push ecx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x46e3e8
mov edx, dword [ebp - 0x18]
cmp dword [edx + 0x50], 0
jne 0x46e3e8
push 0x100
push str.f:dd_vctools_vc7libs_ship_atlmfc_srcmfcwinocc.cpp
call fcn.0049c040
test eax, eax
je 0x46e3e8
int3
mov ecx, dword [ebp - 0x18]
cmp dword [ecx + 0x50], 0
jne 0x46e40a
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0x20]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x46e46d
lea ecx, [ebp - 0x10]
call fcn.0040bb90
mov dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0x50]
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x50]
mov edx, dword [edx]
mov eax, dword [edx + 0x94]
call eax
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.004088a0
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0046e480
add esp, 0x10
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00408860
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 8

Function at 0x47bcc0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
call fcn.0047d240
mov dword [ebp - 8], eax
push 5
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x47bd18
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x47bd32
push 0xdf
push str.f:dd_vctools_vc7libs_ship_atlmfc_srcmfcdlgcore.cpp
call fcn.0049c040
test eax, eax
je 0x47bd32
int3
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x10]
push edx
mov ecx, dword [ebp - 0x18]
call fcn.0047bd70
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x14]
push eax
call fcn.0045f000
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8