joyce8/EMBER2024-capa huggingface dataset:
Function at 0x72926c
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x188]
test eax, eax
je 0x72930e
cmp dword [ebx + 0xac], 0
jne 0x729308
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x7291a8
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0xa8]
cmp dword [eax + 8], 0
je 0x729308
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x7292ce
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0xa8]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x729308
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov eax, dword [ebx + 0xa8]
mov edx, esi
call fcn.0061c704
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x7292dd
inc dword [ebx + 0xac]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x7295c8
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov ebx, edx
mov esi, eax
mov eax, dword [0x756160]
cmp dword [eax + 0x188], 0
je 0x729742
test bl, bl
jne 0x72968d
cmp dword [esi + 0xb4], 0
jne 0x729682
mov eax, esi
call fcn.0072c644
push eax
push 0x7294bc
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x58], 0
je 0x729653
mov eax, dword [0x756160]
cmp byte [eax + 0xeb], 0
je 0x729653
mov eax, dword [esi + 0xf0]
mov dword [esp], eax
mov eax, dword [esp]
test eax, eax
je 0x729634
sub eax, 4
mov eax, dword [eax]
mov edi, eax
dec edi
cmp edi, 0
jl 0x729653
push 0
mov eax, dword [esi + 0xf0]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x72963c
mov eax, dword [esi + 0xb0]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x729682
cmp bl, 1
cmc
sbb eax, eax
push eax
mov eax, dword [esi + 0xb0]
mov edx, edi
call fcn.0061c704
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x729662
inc dword [esi + 0xb4]
jmp 0x729742
cmp dword [esi + 0xb4], 0
jle 0x729742
dec dword [esi + 0xb4]
cmp dword [esi + 0xb4], 0
jne 0x729742
cmp dword [esi + 0x58], 0
je 0x7296f7
mov eax, dword [0x756160]
cmp byte [eax + 0xeb], 0
je 0x7296f7
mov eax, dword [esi + 0xf0]
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
test eax, eax
je 0x7296d8
sub eax, 4
mov eax, dword [eax]
mov edi, eax
dec edi
cmp edi, 0
jl 0x7296f7
push 5
mov eax, dword [esi + 0xf0]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x7296e0
mov eax, dword [esi + 0xb0]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x729726
cmp bl, 1
cmc
sbb eax, eax
push eax
mov eax, dword [esi + 0xb0]
mov edx, edi
call fcn.0061c704
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x729706
mov eax, dword [esi + 0xb0]
mov edx, dword [eax]
call dword [edx + 8]
lea eax, [esi + 0xf0]
mov edx, dword [0x71abe4]
call fcn.0040c298
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x72a3e0
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xc4], 0
je 0x72a43d
cmp byte [ebx + 0xeb], 0
jne 0x72a43d
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x188]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00409e20
mov eax, dword [esi]
test eax, eax
je 0x72a42a
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x72a44a
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.0040a078
jmp 0x72a44a
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.0040a078
add esp, 0x200
pop esi
pop ebx
ret

Function at 0x72bd80
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x98]
test esi, esi
je 0x72bdf1
mov eax, esi
call fcn.0069619c
test al, al
je 0x72bdf1
mov eax, dword [ebx + 0x98]
call fcn.00695dc8
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x72bdf1
mov eax, dword [ebx + 0x98]
mov edx, dword [eax]
call dword [edx + 0x134]
test al, al
je 0x72bde2
push 0
mov eax, dword [ebx + 0x98]
call fcn.00695dc8
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [ebx + 0x98]
xor edx, edx
call fcn.0068c880
jmp 0x72bdf1
mov edx, dword [ebx + 0x88]
mov cl, 1
mov eax, ebx
call fcn.0072bb8c
pop esi
pop ebx
ret
Function at 0x73c6c8
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00409d7c
xor eax, eax
push ebp
push 0x73c805
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x73c7d8
xor edx, edx
push ebp
push 0x73c7d1
push dword fs:[edx]
mov dword fs:[edx], esp
mov ebx, dword [ebp - 4]
mov eax, ebx
test eax, eax
je 0x73c715
sub eax, 4
mov eax, dword [eax]
add eax, eax
add eax, 2
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x73c7a6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalLock
mov esi, eax
xor eax, eax
push ebp
push 0x73c795
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
je 0x73c758
sub ebx, 4
mov ebx, dword [ebx]
mov eax, dword [ebp - 4]
call fcn.0040a970
mov ecx, ebx
add ecx, ecx
add ecx, 2
mov edx, esi
call fcn.00407034
call sub.user32.dll_EmptyClipboard
mov eax, dword [ebp - 8]
push eax
push 0xd
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x73c79c
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
mov ecx, dword [0x74ea84]
mov dl, 1
mov eax, dword [0x41b750]
call fcn.00428a38
call fcn.00409394
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x73c80c
lea eax, [ebp - 4]
call fcn.00409c98
ret
Function at 0x5117a0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x99000]
push edi
or ebp, 0xffffffff
jmp 0x5117c2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x5117c9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5117b8
mov eax, 1
add ebx, ebx
jne 0x5117db
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x5117ec
jne 0x51180b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x51180b
dec eax
add ebx, ebx
jne 0x5117f8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x5117d0
add ebx, ebx
jne 0x511807
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x51185d
xor ecx, ecx
sub eax, 3
jb 0x511823
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x511892
sar eax, 1
mov ebp, eax
jmp 0x51182e
add ebx, ebx
jne 0x51182e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5117fc
inc ecx
add ebx, ebx
jne 0x51183c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5117fc
add ebx, ebx
jne 0x511849
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x51183e
jne 0x51185a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x51183e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x51187c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x51186e
jmp 0x5117be
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x51187c
add edi, ecx
jmp 0x5117be
pop esi
mov edi, esi
mov ecx, 0x5c65
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x51189a
cmp byte [edi], 0x16
jne 0x51189a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x51189f
lea edi, [esi + 0x10e000]
mov eax, dword [edi]
or eax, eax
je 0x511917
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x11f620]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x11f74c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x5118cc
mov ecx, edi
jns 0x5118fb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x11f750]
or eax, eax
je 0x511911
mov dword [ebx], eax
add ebx, 4
jmp 0x5118e9
call dword [esi + 0x11f760]
mov ebp, dword [esi + 0x11f754]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x51194b
sub esp, 0xffffff80
jmp 0x4937c2
Function at 0x402d20
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov eax, edi
shr eax, 4
inc eax
push 6
movzx eax, ax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp + 0xc], eax
test eax, eax
jne 0x402d49
pop edi
pop ebx
pop ebp
ret
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x402d5f
xor esi, esi
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x402d56
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [esi + eax]
and edi, 0xf
jbe 0x402d92
nop
cmp esi, ecx
jae 0x402d56
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edi, 1
jne 0x402d80
cmp esi, ecx
jae 0x402d56
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x402e00
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
mov edi, dword [ebp + 0xc]
mov eax, edi
shr eax, 4
inc eax
push 6
movzx eax, ax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp + 0xc], eax
test eax, eax
je 0x402ef1
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x402ef1
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x402ef1
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [esi + eax]
and edi, 0xf
jbe 0x402e77
cmp esi, ecx
jae 0x402ef1
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edi, 1
jne 0x402e61
cmp esi, ecx
jae 0x402ef1
movzx eax, word [esi]
test ax, ax
je 0x402ef1
push 0
push 0
push 0
push 0
push eax
lea ecx, [esi + 2]
push ecx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
test edi, edi
js 0x402efa
mov eax, dword [ebx]
mov edx, 1
mov ecx, dword [eax - 8]
sub edx, dword [eax - 4]
sub ecx, edi
or edx, ecx
jge 0x402ebd
push edi
mov ecx, ebx
call fcn.004032d0
mov eax, dword [ebx]
push 0
push 0
push edi
push eax
movzx eax, word [esi]
push eax
lea eax, [esi + 2]
push eax
push 0
push 3
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ecx, dword [ebx]
cmp edi, dword [ecx - 8]
jg 0x402efa
mov dword [ecx - 0xc], edi
mov eax, 1
mov ecx, dword [ebx]
mov byte [edi + ecx], 0
pop edi
pop esi
pop ebx
pop ebp
ret 8
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 8
push 0x80070057
call fcn.00403b90
int3
Function at 0x402f10
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov edi, dword [ebp + 8]
push edi
mov dword [ebp - 4], ecx
call fcn.0040a974
mov ebx, eax
test ebx, ebx
jne 0x402f30
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, edi
shr eax, 4
push esi
inc eax
push 6
movzx eax, ax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp + 8], eax
test eax, eax
je 0x403017
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x403017
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x403017
push dword [ebp + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [esi + eax]
and edi, 0xf
jbe 0x402f98
cmp esi, ecx
jae 0x403017
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edi, 1
jne 0x402f82
cmp esi, ecx
jae 0x403017
movzx eax, word [esi]
test ax, ax
je 0x403017
push 0
push 0
push 0
push 0
push eax
lea ecx, [esi + 2]
push ecx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
test edi, edi
js 0x403022
mov ebx, dword [ebp - 4]
mov edx, 1
mov eax, dword [ebx]
mov ecx, dword [eax - 8]
sub edx, dword [eax - 4]
sub ecx, edi
or edx, ecx
jge 0x402fe1
push edi
mov ecx, ebx
call fcn.004032d0
mov eax, dword [ebx]
push 0
push 0
push edi
push eax
movzx eax, word [esi]
push eax
lea eax, [esi + 2]
push eax
push 0
push 3
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, dword [ebx]
cmp edi, dword [eax - 8]
jg 0x403022
mov dword [eax - 0xc], edi
mov eax, dword [ebx]
pop esi
mov byte [edi + eax], 0
mov eax, 1
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop esi
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.00403b90
int3
Function at 0x403030
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
xor dl, dl
mov dword [ebp - 4], ecx
test eax, eax
je 0x40313f
test eax, 0xffff0000
jne 0x40313f
push ebx
push edi
movzx edi, ax
push edi
call fcn.0040a974
mov ebx, eax
test ebx, ebx
je 0x40313b
mov eax, edi
shr eax, 4
push 6
inc eax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp + 8], eax
test eax, eax
je 0x40313b
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40313b
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x40313a
push dword [ebp + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [esi + eax]
and edi, 0xf
jbe 0x4030c9
cmp esi, ecx
jae 0x40313a
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edi, 1
jne 0x4030b3
cmp esi, ecx
jae 0x40313a
movzx eax, word [esi]
test ax, ax
je 0x40313a
push 0
push 0
push 0
push 0
push eax
lea ecx, [esi + 2]
push ecx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
test edi, edi
js 0x403147
mov ebx, dword [ebp - 4]
mov ecx, 1
mov edx, dword [ebx]
mov eax, dword [edx - 8]
sub ecx, dword [edx - 4]
sub eax, edi
or ecx, eax
jge 0x403112
push edi
mov ecx, ebx
call fcn.004032d0
mov edx, dword [ebx]
movzx eax, word [esi]
push 0
push 0
push edi
push edx
push eax
lea eax, [esi + 2]
push eax
push 0
push 3
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, dword [ebx]
cmp edi, dword [eax - 8]
jg 0x403147
mov dword [eax - 0xc], edi
mov eax, dword [ebx]
mov byte [edi + eax], 0
pop esi
pop edi
mov dl, 1
pop ebx
mov al, dl
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.00403b90
int3

Function at 0x403ed0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
movzx eax, word [ebp + 8]
mov dword [ebp + 8], eax
pop ebp
jmp fcn.0040f906
Function at 0x40cf2d
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
push edi
cmp dword [ecx + 0x58], esi
je 0x40cf80
push esi
push dword [ebp + 8]
call fcn.0040d119
mov edi, eax
test edi, edi
je 0x40cf7b
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp + 0xc]
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x40cf7b
mov eax, dword [ebp - 8]
jmp 0x40cf92
mov eax, dword [ebp + 0x10]
jmp 0x40cf92
push dword [ecx + 0x6c]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
pop edi
pop esi
leave
ret 0xc

Function at 0x40cf98
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6279d5
mov eax, dword fs:[0]
push eax
mov eax, 0x1018
call fcn.005d0a10
mov eax, dword [0x6c3e44]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ecx + 0x58], 0
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x14]
mov dword [ebp - 0x101c], edi
mov dword [ebp - 0x1024], eax
je 0x40d0cc
push 0
push edx
call fcn.0040d119
mov ebx, eax
test ebx, ebx
jne 0x40d000
push esi
jmp 0x40d0f4
call fcn.00408618
push eax
lea ecx, [ebp - 0x1014]
call fcn.00403bd0
xor ecx, ecx
lea eax, [ebp - 0x1018]
push eax
push ecx
lea eax, [ebp - 0x1020]
mov dword [ebp - 4], ecx
push eax
push ecx
push dword [ebp - 0x1024]
mov dword [ebp - 0x1020], ecx
push ebx
mov dword [ebp - 0x1018], ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x101c], eax
test eax, eax
jne 0x40d08b
push dword [ebp - 0x1018]
lea ecx, [ebp - 0x1014]
call fcn.00403330
lea ecx, [ebp - 0x1018]
push ecx
push eax
lea eax, [ebp - 0x1020]
push eax
push 0
push dword [ebp - 0x1024]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 0xffffffffffffffff
lea ecx, [ebp - 0x1014]
mov dword [ebp - 0x101c], eax
call fcn.00402c50
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x101c], 0
jne 0x40d0b9
mov esi, dword [ebp - 0x1014]
add esi, 0xfffffff0
push esi
call fcn.0040632b
pop ecx
add eax, 0x10
mov ecx, esi
mov dword [edi], eax
call fcn.00403c20
jmp 0x40d0fb
push esi
mov ecx, edi
call fcn.00403af0
mov ecx, dword [ebp - 0x1014]
lea ecx, [ecx - 0x10]
jmp 0x40d0b2
test esi, esi
jne 0x40d0d5
mov esi, 0x68c6d0
push dword [ecx + 0x6c]
lea ecx, [ebp - 0x1010]
push 0x1000
push ecx
push esi
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x1010]
push eax
mov ecx, edi
call fcn.00403af0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005cfc46
leave
ret 0x10
Function at 0x40f906
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x84], ebx
test ebx, 0xffff0000
jne 0x40f931
cmp dword [edi + 0x80], 0
jne 0x40f931
movzx eax, bx
mov dword [edi + 0x80], eax
call fcn.0040f3f6
push 5
push ebx
mov esi, dword [eax + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ecx, edi
push eax
call fcn.0040fba5
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x40f95e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, ecx
xor esi, esi
call fcn.0040f3f6
push 5
push dword [ebp + 8]
mov edi, dword [eax + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40f991
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
push edi
push dword [ebp + 0xc]
mov ecx, ebx
push esi
call fcn.0040f9a4
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x415973
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
xor esi, esi
mov ebx, ecx
push edi
cmp dword [ebp + 8], esi
je 0x4159b2
call fcn.0040f3f6
push 0xf0
push dword [ebp + 8]
mov edi, dword [eax + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x4159b2
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4159ba
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
push esi
mov ecx, ebx
call fcn.00435f14
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x4169f9
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
je 0x416a85
cmp dword [esi + 0x20], 0
je 0x416a85
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x416a85
cmp dword [ebp + 8], 0
je 0x416a85
xor edi, edi
mov ebx, edi
call fcn.0040f3f6
push str.AFX_DIALOG_LAYOUT
push dword [ebp + 8]
mov eax, dword [eax + 0xc]
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 8], eax
test eax, eax
je 0x416a69
mov ebx, dword [ebp - 4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp - 8]
mov edi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x416a85
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
push edi
push ebx
push esi
call fcn.00451241
mov edi, eax
add esp, 0xc
test edi, edi
je 0x416a81
mov ecx, esi
call fcn.00416727
mov eax, edi
jmp 0x416a87
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x41bb1f
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x628823
call fcn.005d0532
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x74], ebx
jne 0x41bb45
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x41bba5
call fcn.00408618
push eax
lea ecx, [ebp - 0x10]
call fcn.00403bd0
mov edi, dword [edi + 0x74]
lea ecx, [ebp - 0x10]
push ecx
mov dword [ebp - 4], ebx
mov eax, dword [edi]
mov esi, dword [eax + 0x8c]
mov ecx, esi
call dword [0x644cac]
mov ecx, edi
call esi
mov esi, dword [ebp + 8]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push esi
call fcn.005f0711
push eax
call fcn.00405f83
add esp, 0x14
test esi, esi
je 0x41bb98
push esi
call fcn.005f02b0
pop ecx
mov ebx, eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00403c20
mov eax, ebx
call fcn.005d04fb
ret 8

Function at 0x41d50a
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push 0x10
mov eax, 0x628913
call fcn.005d059d
mov esi, ecx
mov dword [ebp - 0x14], esi
lea eax, [esi + 0x1c]
push eax
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [ebp + 8]
test ebx, ebx
jle 0x41d614
cmp ebx, dword [esi + 0xc]
jge 0x41d614
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
test edi, edi
je 0x41d561
cmp ebx, dword [edi + 8]
jl 0x41d602
cmp dword [ebp + 0xc], 0
je 0x41d602
xor ebx, ebx
jmp 0x41d59b
xor ebx, ebx
push 0x10
mov dword [ebp - 4], ebx
call fcn.0041cf13
mov edi, eax
test edi, edi
je 0x41d57b
mov dword [edi], vtable.CThreadData.0
jmp 0x41d57d
mov edi, ebx
or dword [ebp - 4], 0xffffffff
lea ecx, [esi + 0x14]
push edi
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
call fcn.0041d42d
mov ecx, dword [esi + 0x14]
mov dword [eax], ecx
mov dword [esi + 0x14], edi
mov esi, dword [ebp - 0x14]
cmp dword [edi + 0xc], ebx
jne 0x41d5b6
push 4
push dword [esi + 0xc]
call fcn.00408115
pop ecx
pop ecx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
jmp 0x41d5ce
push 2
push 4
push dword [esi + 0xc]
call fcn.00408115
pop ecx
pop ecx
push eax
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
mov edx, eax
test edx, edx
je 0x41d63b
mov ecx, dword [edi + 8]
mov dword [edi + 0xc], edx
mov eax, dword [esi + 0xc]
sub eax, ecx
shl eax, 2
push eax
lea eax, [edx + ecx*4]
push ebx
push eax
call fcn.005d3a20
mov eax, dword [esi + 0xc]
add esp, 0xc
mov dword [edi + 8], eax
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ebx, dword [ebp + 8]
mov ecx, dword [edi + 0xc]
test ecx, ecx
je 0x41d614
cmp ebx, dword [edi + 8]
jge 0x41d614
mov eax, dword [ebp + 0xc]
mov dword [ecx + ebx*4], eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.005d04fb
ret 8
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.0040a6d4
int3