joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405bf0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
push edi
call fcn.0041e4e0
mov esi, eax
mov dword [ebp - 4], esi
test esi, esi
je 0x405ce0
mov eax, edi
shr eax, 4
inc eax
push 6
movzx eax, ax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp + 8], eax
test eax, eax
je 0x405ce0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x405ce0
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x405ce0
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [esi + eax]
and edi, 0xf
jbe 0x405c74
cmp esi, ecx
jae 0x405ce0
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edi, 1
jne 0x405c62
cmp esi, ecx
jae 0x405ce0
cmp word [esi], 0
je 0x405ce0
mov eax, dword [ebx]
mov ecx, 1
movzx edi, word [esi]
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, edi
or ecx, eax
jge 0x405c9c
push edi
mov ecx, ebx
call fcn.00406500
movzx ecx, word [esi]
lea eax, [esi + 2]
push ecx
push eax
push edi
push dword [ebx]
call fcn.00563203
add esp, 0x10
cmp eax, 0x50
ja case.0x405cbb.1
movzx eax, byte [eax + 0x405d10]
jmp dword [eax*4 + 0x405d00]
mov eax, dword [ebx]
cmp edi, dword [eax - 8]
jg 0x405cf0
mov dword [eax - 0xc], edi
xor ecx, ecx
mov eax, dword [ebx]
mov word [eax + edi*2], cx
lea eax, [ecx + 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
call fcn.0041e5d9
push 0x80070057
call fcn.00403080
call fcn.0041e5bf
nop
ret 0x405c
Function at 0x406990
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x589300
mov eax, dword fs:[0]
push eax
mov eax, 0x1464
call fcn.0055dc40
push ebx
push esi
push edi
mov eax, dword [0x5f3040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov dword [ebp - 0x1470], ecx
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x146c], eax
mov esi, dword [ebp + 0x18]
xor eax, eax
mov dword [ebp - 4], 0
mov word [ebp - 0x1410], ax
mov byte [ebp - 0x410], al
mov ecx, dword [esi]
mov eax, dword [esi + 4]
push ecx
mov dword [ebp - 0x1460], ecx
mov dword [ebp - 0x145c], eax
call fcn.004038c0
xor ecx, ecx
mov dword [ebp - 0x1468], 3
add esp, 4
mov edi, eax
cmp byte [esi + 8], cl
mov eax, 8
cmovne ecx, eax
mov dword [ebp - 0x1464], ecx
mov ecx, 1
lock xadd dword [0x5fe4b0], ecx
inc ecx
mov dword [ebp - 0x1458], ecx
mov dword [ebp - 0x1454], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebp - 0x1450], eax
xorps xmm0, xmm0
mov eax, dword [ebp - 0x146c]
mov dword [ebp - 0x1418], eax
mov eax, dword [ebp - 0x1470]
mov dword [ebp - 0x1414], eax
mov eax, dword [0x5fe450]
mov dword [ebp - 0x1444], str.C:UsersMorenaDesktopPdfShield_srcPdfShield_srcpackagesMicrosoft.Windows.ImplementationLibrary.1.0.200902.2includewil_resource.h
mov dword [ebp - 0x1440], ebx
mov dword [ebp - 0x143c], edi
mov dword [ebp - 0x144c], 0
mov dword [ebp - 0x1448], 0
mov dword [ebp - 0x1438], 0
movq qword [ebp - 0x1428], xmm0
mov dword [ebp - 0x1420], 0
movq qword [ebp - 0x1434], xmm0
mov dword [ebp - 0x142c], 0
test eax, eax
je 0x406ad2
call eax
mov dword [ebp - 0x141c], eax
jmp 0x406adc
mov dword [ebp - 0x141c], 0
mov eax, dword [0x5fe42c]
test eax, eax
je 0x406afa
push 0x400
lea ecx, [ebp - 0x410]
push ecx
lea ecx, [ebp - 0x1468]
push ecx
call eax
mov eax, dword [0x5fe424]
test eax, eax
je 0x406b0c
lea ecx, [ebp - 0x1468]
push ecx
call eax
mov eax, dword [0x5fe43c]
test eax, eax
je 0x406b1e
lea ecx, [ebp - 0x1468]
push ecx
call eax
cmp dword [ebp - 0x1460], 0
jl 0x406b41
mov ecx, 0x8000ffff
mov dword [ebp - 0x1460], 0x8000ffff
call fcn.00403aa0
mov dword [ebp - 0x145c], eax
cmp byte [0x5fe408], 0
jne 0x406b8b
mov eax, dword [0x5fe400]
test eax, eax
je 0x406b5a
call eax
movzx eax, al
jmp 0x406b66
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
neg eax
sbb eax, eax
neg eax
test eax, eax
jne 0x406b8b
mov eax, dword [0x5fe40c]
test eax, eax
je 0x406be3
cmp byte [0x5fe418], 0
jne 0x406be3
push 0
push 0
lea ecx, [ebp - 0x1468]
push ecx
call eax
jmp 0x406be3
mov eax, dword [0x5fe40c]
test eax, eax
je 0x406bb2
cmp byte [0x5fe418], 0
jne 0x406bb2
push 0x800
lea ecx, [ebp - 0x1410]
push ecx
lea ecx, [ebp - 0x1468]
push ecx
call eax
cmp word [ebp - 0x1410], 0
jne 0x406bd6
lea eax, [ebp - 0x1468]
mov edx, 0x800
push eax
lea ecx, [ebp - 0x1410]
call fcn.004034f0
add esp, 4
lea eax, [ebp - 0x1410]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp byte [0x5fe410], 0
je 0x406bf7
mov eax, dword [0x5fe434]
test eax, eax
je 0x406bf7
call eax
lea ecx, [ebp - 0x1468]
mov dword [ebp - 4], 0xffffffff
call fcn.00404ba0
int3
Function at 0x406c10
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00407050

Function at 0x4075b0
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x589410
mov eax, dword fs:[0]
push eax
sub esp, 0xe8
mov eax, dword [0x5f3040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 8
push eax
mov dword [ebp - 0x14], 0xff
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov ecx, edi
call fcn.0042d9f0
push 0
call fcn.0042faf9
push 0xc
call fcn.0042f2b8
add esp, 8
mov dword [ebp - 0xf4], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x407639
xorps xmm0, xmm0
mov ecx, eax
movq qword [eax], xmm0
mov dword [eax + 8], 0
call fcn.0042f2f0
mov esi, eax
jmp 0x40763b
xor esi, esi
push 0x59d518
mov dword [ebp - 4], 0xffffffff
call fcn.00429f78
push 0xd8
lea eax, [ebp - 0xf0]
push 0
push eax
call fcn.0055fae0
add esp, 0xc
lea ecx, [ebp - 0xf0]
push 0
push 0x66
call fcn.0041ca5c
mov dword [ebp - 4], 1
mov dword [ebp - 0xf0], 0x5d14e4
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
mov byte [ebp - 4], 6
mov dword [ebp - 0x24], 0
call fcn.004333a0
call fcn.004333a0
push 0x80
mov eax, dword [eax + 0xc]
push eax
call dword [sym.imp.USER32.dll_LoadIconW]
push 0
mov dword [ebp - 0x48], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0xf0]
mov dword [ebp - 4], 7
mov ecx, eax
mov dword [edi + 0x20], eax
call fcn.0041d04b
test esi, esi
je 0x407710
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax + 4]
call fcn.00431039
lea ecx, [ebp - 0x30]
mov dword [ebp - 4], 0xffffffff
call fcn.00407860
mov ecx, dword [ebp - 0x34]
test ecx, ecx
je 0x407738
mov dword [ebp - 0x34], 0
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [ebp - 0x38]
test ecx, ecx
je 0x40774c
mov dword [ebp - 0x38], 0
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [ebp - 0x3c]
test ecx, ecx
je 0x407760
mov dword [ebp - 0x3c], 0
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [ebp - 0x40]
test ecx, ecx
je 0x407774
mov dword [ebp - 0x40], 0
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
lea ecx, [ebp - 0xf0]
call fcn.0041cabb
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0055d3df
mov esp, ebp
pop ebp
ret
Function at 0x40c290
Capabilities:
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x589856
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x5f3040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x2c], ebx
xorps xmm0, xmm0
mov dword [ebp - 0x28], 1
movq qword [ebx], xmm0
mov dword [ebx + 8], 0
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov ecx, str.processing_the_pdf_from_host_...__n
mov dword [ebp - 0x28], 1
call fcn.0040d4e0
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov esi, eax
mov dword [ebp - 0x30], esi
mov dword [ebp - 4], 1
mov dword [ebp - 0x14], 0
push 0
push 0
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 2
push eax
push 0x5f3b68
push 0
call dword [sym.imp.urlmon.dll_URLOpenBlockingStreamW]
test eax, eax
jns 0x40c341
mov dword [ebp - 0x28], 0
jmp 0x40c405
xorps xmm0, xmm0
mov dword [ebp - 0x18], 0
push 0x400
movq qword [ebp - 0x20], xmm0
call fcn.0042f2b8
mov edi, eax
push 0x400
push 0
push edi
lea eax, [edi + 0x400]
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x18], eax
call fcn.0055fae0
mov eax, dword [ebp - 0x18]
add esp, 0x10
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 3
mov eax, dword [ebx]
cmp eax, dword [ebx + 4]
je 0x40c38c
mov dword [ebx + 4], eax
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x24]
push edx
push 0x400
push edi
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
test eax, eax
js 0x40c3cd
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x40c3cd
push eax
push edi
push dword [ebx + 4]
mov ecx, ebx
call fcn.004138f0
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x24]
push edx
push 0x400
push edi
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
test eax, eax
jns 0x40c3a3
mov dword [ebp - 0x28], 0
mov byte [ebp - 4], 2
test edi, edi
je 0x40c405
mov ecx, dword [ebp - 0x18]
sub ecx, edi
cmp ecx, 0x1000
jb 0x40c3fb
mov edx, dword [edi - 4]
add ecx, 0x23
sub edi, edx
lea eax, [edi - 4]
cmp eax, 0x1f
ja 0x40c43e
mov edi, edx
push ecx
push edi
call fcn.0055da05
add esp, 8
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x40c416
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
test esi, esi
js 0x40c420
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0055d3df
mov esp, ebp
pop ebp
ret
call fcn.005677c1
int3
Function at 0x40cdb0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x589955
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x5f3040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
lea edi, [ebp + 8]
cmp dword [ebp + 0x1c], 0xf
mov eax, dword [ebp + 0x18]
cmova edi, dword [ebp + 8]
test eax, eax
je 0x40ce09
push eax
push 0x3d
push edi
call fcn.00561de0
mov esi, eax
add esp, 0xc
test esi, esi
je 0x40ce09
sub esi, edi
jmp 0x40ce0c
or esi, 0xffffffff
cmp esi, 0xffffffff
je 0x40cf71
cmp dword [ebp + 0x18], esi
lea eax, [ebp + 8]
mov ecx, esi
mov dword [ebp - 0x30], 0
cmovb ecx, dword [ebp + 0x18]
xorps xmm0, xmm0
cmp dword [ebp + 0x1c], 0xf
push ecx
cmova eax, dword [ebp + 8]
lea ecx, [ebp - 0x40]
push eax
movups xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x2c], 0
call fcn.0040b990
mov byte [ebp - 4], 1
inc esi
mov eax, dword [ebp + 0x18]
xorps xmm0, xmm0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
movups xmmword [ebp - 0x28], xmm0
cmp eax, esi
jb 0x40cf8d
sub eax, esi
or ecx, 0xffffffff
cmp eax, 0xffffffff
cmovb ecx, eax
cmp dword [ebp + 0x1c], 0xf
lea eax, [ebp + 8]
cmova eax, dword [ebp + 8]
push ecx
add eax, esi
lea ecx, [ebp - 0x28]
push eax
call fcn.0040b990
sub esp, 0x18
mov byte [ebp - 4], 2
lea eax, [ebp - 0x28]
mov dword [ebp - 0x44], esp
mov ecx, esp
push eax
call fcn.0040b890
sub esp, 0x18
mov byte [ebp - 4], 3
lea eax, [ebp - 0x40]
mov ecx, esp
push eax
call fcn.0040b890
mov byte [ebp - 4], 2
call fcn.0040c940
mov ecx, dword [ebp - 0x14]
add esp, 0x30
cmp ecx, 0xf
jbe 0x40cef6
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40ceec
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40cf92
push ecx
push edx
call fcn.0055da05
add esp, 8
mov ecx, dword [ebp - 0x2c]
cmp ecx, 0xf
jbe 0x40cf26
mov edx, dword [ebp - 0x40]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40cf1c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40cf92
push ecx
push edx
call fcn.0055da05
add esp, 8
mov ecx, dword [ebp + 0x1c]
cmp ecx, 0xf
jbe 0x40cf56
mov edx, dword [ebp + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40cf4c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40cf92
push ecx
push edx
call fcn.0055da05
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0055d3df
mov esp, ebp
pop ebp
ret
push 0x10
push str.Error
push str.An_error_occurred_during_config_parse_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.00409950
call fcn.005677c1
int3
Function at 0x40d4e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x5f3040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x5d1e14
lea eax, [ebp - 8]
mov esi, ecx
push str.PdfShield.log
push eax
call fcn.00568e10
mov edx, dword [ebp - 8]
add esp, 0xc
test edx, edx
jne 0x40d547
push 0x5d1dac
lea eax, [ebp - 8]
push str.PdfShield.log
push eax
call fcn.00568e10
mov edx, dword [ebp - 8]
add esp, 0xc
test edx, edx
jne 0x40d547
push edx
push str.Error_creating_log_file
push str.Error_creating_log_file_
push edx
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0xfffffffffffffffd
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, esi
push edi
lea edi, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40d550
push edx
sub ecx, edi
push ecx
push 1
push esi
call fcn.005688ed
push dword [ebp - 8]
call fcn.00568311
mov ecx, dword [ebp - 4]
add esp, 0x14
xor ecx, ebp
pop edi
pop esi
call fcn.0055d3df
mov esp, ebp
pop ebp
ret
Function at 0x40e8d0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [esp + 0xc], edi
test eax, eax
jg 0x40e902
jl 0x40e8f5
test ecx, ecx
jne 0x40e902
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x40e9c2
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], eax
mov ecx, ebx
call fcn.00410a30
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x40e96e
jg 0x40e92d
test esi, esi
je 0x40e96e
mov ecx, dword [esp + 0xc]
cmp ecx, eax
jg 0x40e945
mov eax, dword [esp + 0x10]
jl 0x40e93f
cmp eax, esi
jae 0x40e945
mov esi, eax
mov dword [esp + 0x14], ecx
mov eax, dword [ebx + 0x1c]
push esi
push dword [eax]
push edi
call fcn.0055fc40
mov eax, dword [ebx + 0x2c]
add esp, 0xc
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
sub ecx, esi
sbb edx, dword [esp + 0x14]
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
jmp 0x40e98f
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c]
mov edx, dword [esp + 0xc]
cmp eax, 0xffffffff
je 0x40e9ab
mov ecx, dword [esp + 0x10]
mov esi, 1
add ecx, 0xffffffff
mov byte [edi], al
adc edx, 0xffffffff
add edi, esi
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ecx
test edx, edx
jg 0x40e914
jl 0x40e9ab
test ecx, ecx
jne 0x40e914
mov eax, dword [ebp + 0xc]
sub eax, dword [esp + 0x10]
mov ecx, dword [ebp + 0x10]
sbb ecx, edx
mov edx, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
lea esi, [ebx + 0x2c]
mov edi, ecx
mov edx, dword [eax]
test edx, edx
je 0x40ea06
mov eax, dword [esi]
mov eax, dword [eax]
test eax, eax
je 0x40ea06
mov edi, dword [esp + 0xc]
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push edx
push edi
call fcn.0055fc40
mov eax, dword [ebx + 0x2c]
add edi, esi
mov dword [esp + 0x18], edi
add esp, 0xc
mov edi, dword [ebp + 0xc]
sub edi, esi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
lea esi, [ebx + 0x2c]
cmp dword [ebx + 0x4c], 0
je 0x40ea77
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x40ea2c
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi]
mov dword [eax], edx
mov esi, dword [esp + 0xc]
cmp edi, 0xfff
jbe 0x40ea62
nop dword [eax + eax]
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call fcn.0056a524
add esp, 0x10
add esi, eax
sub edi, eax
cmp eax, 0xfff
jne 0x40ea77
cmp edi, eax
ja 0x40ea40
test edi, edi
je 0x40ea77
push dword [ebx + 0x4c]
push edi
push 1
push esi
call fcn.0056a524
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x410ce0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x589d0d
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x5f3040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov eax, dword [edi]
mov eax, dword [eax + 4]
mov dword [edi + eax], vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov eax, dword [edi]
mov edx, dword [eax + 4]
lea eax, [edx - 0x18]
mov dword [edx + edi - 4], eax
mov eax, dword [edi]
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov esi, dword [eax + 4]
add esi, edi
mov ecx, esi
call fcn.0040ae20
mov eax, dword [ebp + 8]
mov dword [esi + 0x38], eax
mov eax, dword [esi + 0x30]
mov dword [esi + 0x3c], 0
mov ecx, dword [eax + 4]
mov dword [ebp - 0x18], ecx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], 1
push eax
call fcn.00411aa0
add esp, 4
mov ecx, eax
mov edx, dword [eax]
push 0x20
mov eax, dword [edx + 0x20]
call eax
mov byte [ebp - 4], 0
mov bl, al
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x410d98
mov edx, dword [ecx]
call dword [edx + 8]
test eax, eax
je 0x410d98
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
cmp dword [esi + 0x38], 0
mov byte [esi + 0x40], bl
jne 0x410db1
mov eax, dword [esi + 0xc]
mov ecx, esi
push 0
or eax, 4
push eax
call fcn.0040ada0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x416934
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
xor esi, esi
mov ebx, ecx
push edi
cmp dword [ebp + 8], esi
je 0x416973
call fcn.004333a0
push 0xf0
push dword [ebp + 8]
mov edi, dword [eax + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x416973
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x41697b
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
push esi
mov ecx, ebx
call fcn.00434bbb
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x4173d2
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
je 0x41745e
cmp dword [esi + 0x20], 0
je 0x41745e
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x41745e
cmp dword [ebp + 8], 0
je 0x41745e
xor edi, edi
mov ebx, edi
call fcn.004333a0
push 0x59c4a8
push dword [ebp + 8]
mov eax, dword [eax + 0xc]
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 8], eax
test eax, eax
je 0x417442
mov ebx, dword [ebp - 4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp - 8]
mov edi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x41745e
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
push edi
push ebx
push esi
call fcn.00435719
mov edi, eax
add esp, 0xc
test edi, edi
je 0x41745a
mov ecx, esi
call fcn.00417170
mov eax, edi
jmp 0x417460
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x41c3e4
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x58a5f0
call fcn.0055dabd
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x74], ebx
jne 0x41c40a
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x41c464
lea ecx, [ebp - 0x10]
call fcn.00405de0
mov edi, dword [edi + 0x74]
lea ecx, [ebp - 0x10]
push ecx
mov dword [ebp - 4], ebx
mov eax, dword [edi]
mov esi, dword [eax + 0x8c]
mov ecx, esi
call dword [0x59aa04]
mov ecx, edi
call esi
mov esi, dword [ebp + 8]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push esi
call fcn.0056b22e
push eax
call fcn.00402fc0
add esp, 0x14
test esi, esi
je 0x41c457
push esi
call fcn.0056aade
pop ecx
mov ebx, eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00403160
mov eax, ebx
call fcn.0055da8b
ret 8

Function at 0x41cc19
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x84], 0
mov esi, dword [ebx + 0x8c]
mov edi, dword [ebx + 0x88]
je 0x41cc61
call fcn.004333a0
push 5
push dword [ebx + 0x84]
mov eax, dword [eax + 0xc]
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x41cc61
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x41cc6e
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
xor eax, eax
inc eax
test esi, esi
je 0x41ccaa
mov edx, 0xffff
lea ecx, [esi + 0xc]
cmp word [esi + 2], dx
jne 0x41cc8d
movzx edi, word [esi + 0x12]
movzx edx, word [esi + 0x14]
jmp 0x41cc96
movzx edx, word [ecx]
mov ecx, esi
movzx edi, word [esi + 0xa]
test dword [ecx], 0x1801
jne 0x41cca8
test di, di
jne 0x41cca8
test dx, dx
je 0x41ccaa
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41cd13
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, ecx
call fcn.004333a0
push 5
push dword [ebp + 8]
mov esi, dword [eax + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x41cd53
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x41cd53
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push dword [ebp + 0xc]
mov ecx, edi
push eax
call fcn.0041cd5b
jmp 0x41cd55
xor eax, eax
pop edi
pop esi
pop ebp
ret 8