joyce8/EMBER2024-capa huggingface dataset:
Function at 0x29a010be
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x29a010cd
pop dword [ebp - 8]
mov eax, 0xb1a5adb5
sub eax, 0x88059ce8
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0xf2cd4b65
sub dword [ebp - 0x18], 0xa47b061a
mov dword [ebp - 0x14], 0x63e82bc5
add dword [ebp - 0x14], 0xce4b2080
mov dword [ebp - 0x10], 0xf2b033ad
add dword [ebp - 0x10], 0x599c1081
mov dword [ebp - 0xc], 0x88724eb
sub dword [ebp - 0xc], 0x88724eb
lea eax, [ebp - 0x18]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0x776bb97c
sub dword [ebp - 0x18], 0x2f95026
mov dword [ebp - 0x14], 0x42273424
add dword [ebp - 0x14], 0xff452d51
mov dword [ebp - 0x10], 0x9bfde28b
add dword [ebp - 0x10], 0xc77189e1
mov dword [ebp - 0xc], 0x21393d1e
sub dword [ebp - 0xc], 0x21393d1e
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0x69976ab0
add eax, 0xc00995ec
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x3ca73
push 0
call eax
mov ecx, 0xfb54114b
add ecx, 0x4ac4391
mov ebx, eax
mov edi, 0xe1df6e8
sub edi, 0xe47c08e8
add edi, dword [ebp - 8]
mov edx, 0x6e0d031e
sub dword [ebp - 4], 0x57a747bd
mov esi, dword [edi]
add dword [ebp - 4], esi
add esi, edx
xor dword [ebp - 4], ecx
mov dword [ebx], esi
add dword [ebp - 4], 0x191e04c9
add ebx, 4
add edi, 0x5687adf8
sub edi, 0x5687adf4
loop 0x29a011e4
add eax, 0x55aa55b2
sub eax, 0x55a90f6f
mov ebx, eax
add eax, 0x318a7852
sub eax, 0x318a784d
mov ecx, 0x36b41523
add ecx, 0xf2ebeadd
add ecx, dword [ebp - 8]
call ebx
leave
ret

Function at 0x29a01815
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x29a169b8]
jne 0x29a0181f
repz ret
jmp fcn.29a0e56f
Function at 0x401750
Capabilities:
Terminate process

Disassembly:
inc eax
add bh, dh
adc byte [eax], al
sbb dl, byte [edx]
inc eax
add byte [0xd3006a3d], bh
adc dword [eax - 0x6c], eax
sub dword [edx], edx
inc eax
mov ebx, 0x401442
test dword [eax + eax*2], edx
add bh, bl
mov byte [eax + 0x59], 0xf3
adc al, 0x40
add byte [esi], dl
lea eax, [eax - 0x74]
add byte [ebx], bl
add dword [ebx], ebx
jns 0x401729
push es
add bl, byte [ebx]
sbb ebx, dword [ebx]
sbb ebx, dword [ebx]
int3
or byte [ecx], cl
or dh, byte [ecx + 0x1b]
or al, 0xd
push cs
xor al, 0xf
sub bl, byte [ebx]
adc byte [ebx], bl
adc dword [edx], edx
adc ebx, dword [ebx]
adc al, 0x76
push ss
pop ss
sbb byte [ecx], bl
sbb dl, byte [eax - 0x6f6f6f70]
nop
nop
nop
nop
nop
js 0x4016de
out dx, eax
nop
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [sym.imp.MSVCRT.dll__iob]
push eax
add ecx, 0xfffffff0
insb byte es:[edi], dx
je 0x401735
inc eax
add byte [ecx - 1], dl
mov dh, 0x80
rol dword [eax + 0x49], 0xa1
xor byte [edx], al
inc ecx
add byte [ebx - 0x3f7af33c], al
je 0x401787
push eax
add edx, dword [edx + edx*8 + 0x40]
add bh, bh
adc eax, 0x56a9c1af
add esp, 8
push 1
call dword [sym.imp.MSVCRT.dll_exit]
rol dword [eax - 0x137e1375], 0xb8
or byte [ebx - 0x47137e14], 0
add byte [eax], al
mov eax, dword [0x4102cc]
shl byte [ecx + 0x41404c], 0x74
adc al, 0x68
inc eax
cmp al, 0x9c
add byte [edx + 0x21], ch
sahf
inc esp
add byte [eax], al
mov cx, word [0x4c0278]
jmp 0x40181b
or al, 0xa1
adc al, 0xd0
inc eax
add byte [ebp + 0x4003b8c0], al
inc eax
add byte [ebp + 5], dh
mov eax, 0x405b7c
push eax
or eax, 0xb63b6c
sbb eax, 0xc80df1d6
rol byte [eax], 0x83
shl dword [eax], 0x51
call dword [sym.imp.MSVCRT.dll_fflush]
fadd st(4)
or al, 0xa5
adc eax, 0x40d018
loop 0x401887
pop eax
rol dword [eax], 0x68
pushal
xor al, 0
add byte [edx - 1], dl
salc
mov dword [0x410bb0], eax
mov eax, dword [0x40d010]
push 0x67
push eax
call esi
mov ecx, dword [0x419f4c]
mov edx, dword [0x40d018]
add esp, 0x10
mov dword [0x410bc8], eax
push 0
rcl byte [edx + 0x68], cl
clc
inc edx
inc ecx
add al, ch
add dword [edi], 0x74c0ee00
push cs
push eax
push str.apr_pollset_create_failed
cmpsb byte [esi], byte es:[edi]
mov byte [0x9a000005], al
push ebp
or byte [ecx + 0x41028d], ah
test eax, eax
jne 0x4018df
mov eax, dword [0x410bac]
mov ecx, dword [0x41999c]
mov edx, dword [0xc0324048]
fidiv word [edx]
push 0x8e40d16c
push eax
mov eax, dword [0x41404c]
push ecx
push str.Host:
add byte [eax - 0x18], dl
mov ebx, 0x6700003f
les ebx, [ebx]
dec eax
inc eax
inc ecx
add bl, ch
add eax, 0x414048a1
add byte [ebx - 0x49fd9f9f], cl
add byte [ebp - 0x5fed9b37], al
or eax, 0x36415e4c
push 0xffffffffffffffdd
mov eax, dword [0x414048]
mov esp, dword [ecx + 0x60]
add dh, byte [esi + 0x64c98500]
adc ah, byte [eax + 0x415e4c0d]
push 0xffffffffffffffdd
push 0x40d19c
push 0x40d444
push 0x40bd28
jmp 0x3fc5015b
Function at 0x408ac0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
nop
movzx ecx, word [edx + 0x26]
nop
jmp 0x40894c
xor edi, edi
jmp 0x40895f
mov esi, dword [edx + 0x28]
jmp 0x408971
xor eax, eax
nop
jmp 0x408981
lodsb al, byte [esi]
nop
cmp al, 0x61
jmp 0x408994
jl 0x4089b9
nop
jmp 0x4089a7
nop
sub al, 0x20
nop
jmp 0x4089b9
nop
jmp 0x4089c7
ror edi, 0xd
nop
jmp 0x4089dc
add edi, eax
nop
jmp 0x4089ee
dec ecx
nop
jne 0x408962
jmp 0x408a07
jmp 0x408a16
push edx
jmp 0x408a25
push edi
nop
jmp 0x408a37
mov edx, dword [edx + 0x10]
nop
mov eax, dword [edx + 0x3c]
nop
add eax, edx
nop
mov eax, dword [eax + 0x78]
nop
test eax, eax
jmp 0x408a54
je 0x408c92
nop
jmp 0x408a66
nop
jmp 0x408a73
add eax, edx
nop
jmp 0x408a80
push eax
nop
mov ecx, dword [eax + 0x18]
jmp 0x408a94
mov ebx, dword [eax + 0x20]
add ebx, edx
test ecx, ecx
jmp 0x408aa5
je 0x408c6c
nop
nop
xor edi, edi
jmp 0x408abf
dec ecx
nop
jmp 0x408ad1
mov esi, dword [ebx + ecx*4]
add esi, edx
nop
jmp 0x408ae6
nop
jmp 0x408afa
xor eax, eax
nop
jmp 0x408b10
lodsb al, byte [esi]
jmp 0x408b21
ror edi, 0xd
jmp 0x408b33
add edi, eax
nop
jmp 0x408b44
cmp al, ah
jmp 0x408b57
jne 0x408ae6
nop
jmp 0x408b70
add edi, dword [ebp - 8]
jmp 0x408b82
cmp edi, dword [ebp + 0x24]
jmp 0x408b95
jne 0x408a99
nop
pop eax
jmp 0x408bac
mov ebx, dword [eax + 0x24]
jmp 0x408bbd
add ebx, edx
mov cx, word [ebx + ecx*2]
mov ebx, dword [eax + 0x1c]
nop
jmp 0x408bd7
add ebx, edx
jmp 0x408be9
mov eax, dword [ebx + ecx*4]
nop
jmp 0x408bff
add eax, edx
jmp 0x408c0f
mov dword [esp + 0x24], eax
pop ebx
jmp 0x408c28
pop ebx
nop
popal
jmp 0x408c3a
pop ecx
nop
jmp 0x408c4b
pop edx
nop
push ecx
nop
jmp 0x408c5d
jmp eax
nop
jmp 0x408c81
pop eax
jmp 0x408c92
pop edi
jmp 0x408ca2
pop edx
nop
jmp 0x408cb4
mov edx, dword [edx]
jmp 0x408936

Function at 0x408e7b
Capabilities:
Encode data using xor

Disassembly:
inc ecx
pop esi
xor byte [esi + ecx + 7], cl
loop 0x408e7e
ljmp 0x8b6:0xda8d5821
Function at 0x401af0
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x562fde
mov eax, dword fs:[0]
push eax
sub esp, 0xb8
push esi
mov eax, dword [0x5c2ff4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 8
push eax
mov dword [ebp - 0x10], 0xff
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov ecx, esi
call fcn.004041b3
push 0
call fcn.00404d92
add esp, 4
mov ecx, esi
push 0x5a2bc0
call fcn.0040600a
push 0
push 0x66
lea ecx, [ebp - 0xc4]
call fcn.00406287
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x18]
push 0x5a3138
mov dword [ebp - 0xc4], 0x5a2dfc
call fcn.004031c0
mov byte [ebp - 4], 1
call fcn.0040a263
call fcn.0040a263
push 0x80
mov eax, dword [eax + 0xc]
push eax
call dword [sym.imp.USER32.dll_LoadIconW]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0xc4]
mov dword [ebp - 4], 2
mov ecx, eax
mov dword [esi + 0x20], eax
call fcn.00406881
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
mov edx, dword [ebp - 0x18]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x401bd6
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0xc4]
call fcn.004062ea
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x402150
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x563088
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5c2ff4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov ecx, esi
push 0x5a2d50
call fcn.00402890
mov ecx, dword [ebp + 0xc]
push 0x5a2d50
call fcn.00402890
lea eax, [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp dword [ebp + 8], 1
mov ebx, eax
jg 0x4021c1
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov edx, dword [ebx + 4]
test edx, edx
jne 0x4021cc
xor eax, eax
jmp 0x4021e0
mov eax, edx
lea edi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4021d1
sub eax, edi
sar eax, 1
push eax
push edx
mov ecx, esi
call fcn.00403080
mov eax, dword [ebp + 8]
cmp eax, 2
jle 0x40225b
mov edi, 2
call fcn.00409da7
test eax, eax
je 0x402271
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push dword [ebx + edi*4]
push str.__s_
push eax
call fcn.00402870
mov esi, dword [ebp - 0x10]
add esp, 0xc
mov ecx, dword [ebp + 0xc]
push dword [esi - 0xc]
push esi
call fcn.00402630
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x402255
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
inc edi
cmp edi, dword [ebp + 8]
jl 0x4021f6
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push 0x80004005
call fcn.00403030
int3
Function at 0x402310
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5630f0
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x5c2ff4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.00409da7
mov ecx, eax
test ecx, ecx
jne 0x40234c
push 0x80004005
call fcn.00403030
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
call fcn.00409da7
mov ecx, eax
test ecx, ecx
jne 0x402373
push 0x80004005
call fcn.00403030
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00402150
test al, al
jne 0x4023e5
mov byte [ebp - 4], al
or edi, 0xffffffff
mov edx, dword [ebp - 0x18]
mov eax, edi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4023b3
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
lea edx, [eax - 0x10]
lock xadd dword [edx + 0xc], edi
dec edi
test edi, edi
jg 0x4023d2
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 0x14]
mov ecx, 0x5a3138
mov eax, esi
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x402416
test dx, dx
je 0x402412
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x402416
add eax, 4
add ecx, 4
test dx, dx
jne 0x4023f0
xor eax, eax
jmp 0x40241b
sbb eax, eax
or eax, 1
test eax, eax
sete al
test al, al
je 0x402436
push 0x5be258
lea eax, [ebp - 0xd]
mov byte [ebp - 0xd], 0
push eax
call fcn.0054ab76
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.004032c0
mov edi, dword [ebp - 0x18]
test eax, eax
jne 0x40245d
push 1
push 0
push edi
push esi
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea edx, [edi - 0x10]
mov byte [ebp - 4], 0
or edi, 0xffffffff
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40247b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], edi
dec edi
test edi, edi
jg 0x402497
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x402700
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
movzx eax, word [ebp + 8]
mov dword [ebp + 8], eax
pop ebp
jmp fcn.004064e9
Function at 0x402af0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x402b05
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x402b46
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x402b42
nop word [eax + eax]
cmp esi, edx
jae 0x402b46
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x402b30
cmp esi, edx
jb 0x402b4b
xor eax, eax
pop esi
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop ebp
ret
Function at 0x4053eb
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor esi, esi
mov eax, ecx
push edi
mov edi, esi
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], esi
je 0x405435
call fcn.0040a263
push 0xf0
push dword [ebp + 0xc]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x405432
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x405483
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
mov eax, dword [ebp - 4]
xor ebx, ebx
inc ebx
test esi, esi
je 0x405461
mov ecx, dword [eax]
push dword [ebp + 0x10]
push esi
mov esi, dword [ecx + 0x20]
mov ecx, esi
push dword [ebp + 8]
call fcn.005462c3
mov ecx, dword [ebp - 4]
call esi
mov ebx, eax
test edi, edi
je 0x405461
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp + 8]
mov edi, dword [eax + 0x70]
test edi, edi
je 0x405481
mov eax, dword [edi]
push dword [ebp + 0x10]
mov esi, dword [eax + 0xa0]
mov ecx, esi
call fcn.005462c3
mov ecx, edi
call esi
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x405ca6
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
push edi
cmp dword [ecx + 0x58], esi
je 0x405cf9
push esi
push dword [ebp + 8]
call fcn.00405e99
mov edi, eax
test edi, edi
jne 0x405cc9
mov eax, dword [ebp + 0x10]
jmp 0x405d0b
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp + 0xc]
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x405cc4
mov eax, dword [ebp - 8]
jmp 0x405d0b
push dword [ecx + 0x6c]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x40654e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor esi, esi
call fcn.0040a263
push 5
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x406585
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
mov ecx, dword [ebp - 4]
push ebx
push dword [ebp + 0xc]
push esi
call fcn.004065a6
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x40a3aa
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
mov ecx, dword [esi + 4]
call fcn.00413b7a
push 0xfffffffffffffff0
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
push dword [ebp + 0xc]
and eax, 3
mov ecx, esi
cmp al, 3
je 0x40a3e6
call fcn.0040a5cc
mov dword [esi + 0xc], 1
jmp 0x40a3eb
call fcn.0040a5cc
cmp dword [esi], 0
je 0x40a434
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov esi, dword [ebp + 0x10]
test eax, eax
jle 0x40a40e
lea ecx, [eax + 1]
push ecx
push eax
mov ecx, esi
call fcn.00409a8c
jmp 0x40a41f
push 0xff
mov ecx, esi
call fcn.00402ec0
push 0x100
push eax
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0xffffffffffffffff
mov ecx, esi
call fcn.00403530
jmp 0x40a458
mov esi, dword [ebp + 0x10]
push dword [esi]
push 0xffffffffffffffff
push 0x14d
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
jne 0x40a458
push dword [esi]
push dword [ebp - 4]
call fcn.004169c4
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x40a521
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
push edi
push dword [ebp + 0xc]
call fcn.0040a5cc
cmp dword [esi], 0
mov edi, eax
mov dword [esi + 0xc], 1
je 0x40a569
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.00409a8c
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.00403530
jmp 0x40a574
mov eax, dword [ebp + 0x10]
push dword [eax]
push edi
call fcn.004169c4
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x40d40e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 4], ecx
mov esi, edi
cmp dword [ebp + 8], esi
je 0x40d453
call fcn.0040a263
push 0xf0
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x40d453
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x40d46f
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.00424153
mov ebx, eax
test edi, edi
je 0x40d46d
test esi, esi
je 0x40d46d
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40de50
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
je 0x40df0e
cmp dword [esi + 0x20], 0
je 0x40df0e
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x40df0e
cmp dword [ebp + 8], 0
je 0x40df0e
xor eax, eax
mov ebx, eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], ebx
mov edi, eax
call fcn.0040a263
push 0x5737e8
push dword [ebp + 8]
mov eax, dword [eax + 0xc]
push eax
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x40dedf
mov edi, dword [ebp - 0xc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp - 0x10]
mov dword [ebp - 4], eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x40df0e
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov dword [ebp - 8], eax
push dword [ebp - 4]
push ebx
push esi
call fcn.00427901
add esp, 0xc
mov ebx, eax
cmp dword [ebp - 8], 0
je 0x40deff
test edi, edi
je 0x40deff
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
test ebx, ebx
je 0x40df0a
mov ecx, esi
call fcn.0040dbf3
mov eax, ebx
jmp 0x40df10
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x413f86
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x565d44
call fcn.00546300
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x74], ebx
jne 0x413fac
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x41400b
call fcn.00409da7
push eax
lea ecx, [ebp - 0x10]
call fcn.00402ac0
mov edi, dword [edi + 0x74]
lea ecx, [ebp - 0x10]
push ecx
mov dword [ebp - 4], ebx
mov eax, dword [edi]
mov esi, dword [eax + 0x8c]
mov ecx, esi
call fcn.005462c3
mov ecx, edi
call esi
mov esi, dword [ebp + 8]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push esi
call fcn.0054e894
push eax
call fcn.00402b90
add esp, 0x14
test esi, esi
je 0x413ffe
push esi
call fcn.0054e422
pop ecx
mov ebx, eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00401d00
mov eax, ebx
call fcn.005462c9
ret 8
Function at 0x4293fc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
mov dword [ebp - 4], ebx
test byte [esi + 4], 1
je 0x429416
mov edi, dword [esi + 0xc]
jmp 0x429456
push 5
push dword [esi + 0xc]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x42942f
call fcn.00412b99
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x429444
call fcn.00412b99
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x429456
call fcn.00412b99
call fcn.0040a263
cmp dword [eax + 0x3c], 0
je 0x42946b
push edi
mov ecx, ebx
call fcn.00428a90
mov edi, eax
push dword [ebp + 0xc]
push edi
call fcn.00429648
mov ebx, eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x88]
test ecx, ecx
je 0x429494
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 4]
and dword [eax + 0x88], 0
test ebx, ebx
je 0x4294a0
mov edi, ebx
mov dword [eax + 0x88], ebx
or dword [esi + 4], 1
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x458bac
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
test esi, esi
jne 0x458bc5
call fcn.0040a263
mov esi, dword [eax + 0xc]
push 0x57cfe0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x458c1b
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x458c1a
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
test eax, eax
jne 0x458bfb
xor esi, esi
jmp 0x458c11
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 8]
push eax
push dword [ebp - 4]
call fcn.00458c23
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8