joyce8/EMBER2024-capa huggingface dataset:
Function at 0x62a6a9
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov cl, ch
setae bh
add esp, 0x28
xchg bx, ax
jmp 0x62a8ce
pushal
cmc
xchg ch, dl
add esp, 0x1e
push word [esp]
call fcn.0062a577
inc di
rdtsc
mov bp, word [esp + 0x28]
lea esp, [esp + 9]
cpuid
mov eax, dword [esp + 0x20]
jmp 0x62a682
mov dword [esp + 0x11], esi
bsf si, si
btc ecx, edi
xchg dword [esp + 7], edx
lea ecx, [eax + edi]
mov dword [esp + 0xc], ebp
call fcn.0062a6e0
mov edi, 0x45b6d343
xchg edi, eax
xchg byte [ecx], dh
xor byte [ebx], dh
sub al, byte [ebp - 0x73]
invalid
mov al, 0x67
invalid
lea esp, [esp + 2]
push word [esp + 1]
mov word [esp], sp
inc bl
xchg ebp, esi
neg ah
jmp 0x62a61c
mov cl, 0xea
cpuid
mov ebp, dword [esp + 8]
mov bx, di
mov dh, byte [esp]
add esp, 2
jmp 0x62a791

Function at 0x62a768
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp + 0x14]
jmp 0x62a772
xchg cx, di
mov si, word [esp + 0x18]
mov esi, 0xe92b81a4
mov esi, dword [esp + 6]
setne bh
mov dh, byte [esp + 6]
jmp 0x62a87d
mov word [esp + 0xf], sp
push dword [esp + 0xc]
clc
lea edx, [ecx + edi]
bswap edx
btr eax, edx
jmp 0x62a866
cpuid
xchg ecx, esi
xchg ah, bl
add esp, 0x1c
lea edx, [ebx*4]
shr bh, 3
jmp 0x62a7a9
inc edi
ror bh, 3
pop dword [esp + 8]
mov al, 0x56
lea esp, [esp + 7]
rdtsc
jmp 0x62a7ef
lea esp, [esp + 3]
add esp, 5
and ecx, ecx
mov di, bx
not bh
jmp 0x62a83e
mov edx, 0x802463c2
lea edi, [esi - 0x65]
mov byte [esp + 9], bh
mov dh, byte [esp + 0xa]
btr edi, edx
mov dl, dh
jmp 0x62a7d9
mov bx, word [esp]
mov ax, word [esp]
lea edx, [ebp + 0x15e7b85f]
lea esp, [esp + 1]
lea esp, [esp]
lea ebp, [edx*4]
jmp 0x62a8b0
btr ebp, esp
shr ah, 1
lea esi, [ecx + 0x33]
xchg bp, ax
lea edx, [ecx + 0xdb]
pop word [esp]
jmp 0x62a81c
cpuid
lea ecx, [edx + esi]
rdtsc
xchg dword [esp + 0x12], ebp
inc bp
jmp 0x62a805
pop dword [esp + 0x11]
push dword [esp + 0x2a]
mov eax, dword [esp + 0x25]
mov edx, 0x9cc0fc7c
mov si, 0xa41
rdtsc
jmp 0x62a7c4
mov cx, word [esp + 8]
lea esp, [esp + 9]
not eax
push dword [esp + 0x16]
jmp 0x62ad0b
mov bp, word [esp]
xchg bp, di
bsr di, cx
pushal
mov ebp, 0x7b741338
xor dl, ch
jmp 0x62a899
mov dword [esp], ebp
bsr cx, bp
xchg di, dx
lea eax, [edi*4]
mov al, 0xae
neg bx
jmp 0x62a938
shr eax, 0x17
cld
mov dword [esp + 0xd], esi
pop eax
lea esp, [esp + 0xd]
xchg dword [esp + 0xf], ebx
jmp 0x62a8e4
xchg byte [esp + 6], cl
btc ecx, edi
call fcn.0062a9af
mov ebx, 0x88e8f9
add byte [eax], al
jg 0x62a920
add dh, cl
adc dword [edi - 0x18], esp
jle 0x62a94a
call 0x27972e40
dec esi
fldenv [esi + 0x5e]
pop si
pop word [esp + 0xc]
neg ebp
mov bx, sp
pop word [esp + 7]
pop ebp
jmp 0x62a91b
sub esp, 0x10
mov bp, sp
mov ax, word [esp + 0xc]
pop word [esp + 0x21]
cpuid
clc
jmp 0x62a908
Function at 0x62ae61
Capabilities:
Execute anti-debugging instructions

Disassembly:
add esp, 0x11
xchg dword [esp + 3], edx
xchg ecx, edi
cld
mov word [esp + 3], dx
setge ch
jmp 0x62aebe
inc bp
push dword [esp + 0xc]
mov cl, ch
pop dword [esp + 0x22]
inc ax
xchg ch, dl
jmp 0x62ae27
jmp 0x62ae4a
mov word [esp + 4], di
cpuid
mov byte [esp + 5], ah
pop word [esp + 1]
xchg dword [esp], ebp
push word [esp + 3]
jmp 0x62af22
lea edx, [ebx + edi]
lea esp, [esp + 0x10]
mov ecx, ebp
mov edx, 0x6f9418
jmp 0x62ae63
mov dword [esp + 8], esi
mov bp, word [esp + 0xb]
add esp, 0
mov edx, 0x81e33d3c
xchg byte [esp + 0xc], al
xchg word [esp + 1], si
jmp 0x62ae82
xchg bp, bx
setl ch
setp ch
stc
lea edi, [ebp - 0x472d2069]
xchg byte [esp + 2], bl
jmp 0x62ae9a
pushal
xchg byte [esp + 0x26], bl
mov di, word [esp + 0x29]
not si
mov si, word [esp + 0xf]
pop word [esp + 0xf]
jmp 0x62aeed
xchg bh, cl
push dword [esp + 3]
xchg ah, bl
neg ebp
rdtsc
neg cx
jmp 0x62af04

Function at 0x62bac0
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
xor dl, ch
rol dx, cl
rdtsc
add al, dh
setns bh
jmp 0x62baf6
pop esi
mov bx, word [esp]
jmp 0x62ba9f
mov edx, dword [esp]
xchg bx, ax
call fcn.0062bac7
retf
inc esi
ror ch, 5
xchg edi, ebp
rcr ch, 5
mov ax, 0xebb9
rcr ch, 5
jmp 0x62badd

Function at 0x62bd49
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x62bf51
push edx
cmc
mov ax, word [esp + 0x10]
bsr bx, bp
popal
rdtsc
jmp 0x62be81
mov word [esp], bx
rdtsc
sub esp, 0xe
shr ecx, 0x1b
pop ebx
xchg byte [esp + 6], al
jmp 0x62bda4
bswap edi
mov word [esp + 2], sp
mov dl, 0x5c
lea ebp, [edx*4]
cmc
mov edi, 0xe1d742a4
jmp 0x62bdbd
xchg byte [esp + 2], bl
mov byte [esp + 1], dh
mov byte [esp + 7], ch
mov word [esp + 1], bx
pop dword [esp]
neg ch
jmp 0x62bdd7
mov word [esp + 2], di
sub esp, 8
add esp, 4
neg ah
inc cx
mov si, bx
jmp 0x62be04
mov word [esp + 0x21], di
xchg ebx, edx
xchg dword [esp + 9], ebp
pop dword [esp + 0x1c]
mov bx, word [esp + 7]
xchg bp, si
jmp 0x62bd4e
Function at 0x62c09d
Capabilities:
Execute anti-debugging instructions

Disassembly:
btc edi, ebx
mov al, 0xc6
pop ebp
jmp 0x62c10c
mov word [esp], sp
mov edx, esi
xchg bp, di
xchg word [esp], di
push word [esp]
push word [esp + 2]
jmp 0x62c13d
add esp, 0
pop bx
add esp, 0xe
xchg byte [esp], dl
stc
mov byte [esp + 1], bh
jmp 0x62c0e0
lea esp, [esp]
mov ch, byte [esp + 5]
push dword [esp + 3]
lea edx, [esp + edx]
pop dx
rdtsc
jmp 0x62c21d
xchg dword [esp], edx
mov dl, 0xd4
push dword [esp + 3]
pop dword [esp + 1]
push edx
mov ch, byte [esp + 8]
jmp 0x62c1e2
inc di
xchg byte [esp], al
mov esi, 0x5037b880
mov edi, dword [esp + 7]
setle dh
jmp 0x62c167
mov di, sp
mov edi, ecx
pop cx
stc
shr eax, 9
mov cl, ch
jmp 0x62c182
mov byte [esp + 0x27], dh
call fcn.0062c1f5
out 0x60, eax
not byte [ecx - 0x62e47fa0]
or eax, 0x6b4ba754
out dx, al
jl 0x62c1dc
neg byte [edi]
jg 0x62c1c1
cld
cmc
pop dword [esp + 0x1f]
rdtsc
pop word [esp + 0xb]
xchg di, cx
jmp 0x62c1a8
int1
ljmp 0x524
mov dword [esp + 5], ebp
clc
pushal
lea edi, [edx + ebx]
push dword [esp + 0x2b]
mov byte [esp + 1], dh
jmp 0x62c1c4
push word [esp + 5]
neg dx
mov ebp, dword [esp + 8]
lea edi, [ecx - 0xab]
bsr si, bp
xchg byte [esp], bl
jmp 0x62c199

Function at 0x62c363
Capabilities:
Execute anti-debugging instructions

Disassembly:
inc ecx
neg ah
setae ah
jmp 0x62c36f
mov ch, byte [esp + 5]
pushal
xchg edi, ebx
cpuid
mov di, bx
mov bl, bh
jmp 0x62c3e2
mov cx, di
lea esi, [edi*4]
rdtsc
neg ax
setae dh
jmp 0x62c3f9
btr ebx, esp
sub esp, 6
xchg byte [esp + 0x32], dl
pop dword [esp + 0x1d]
xchg word [esp + 0x21], ax
add ebx, ebp
jmp 0x62c3ca
not bh
lea ebx, [ecx + 0x83]
setg ah
xchg di, ax
rdtsc
jmp 0x62dc90
xchg word [esp + 0x1b], si
neg bp
call fcn.0062c43d
invalid
lea edi, [edx*4]
xchg edi, ebx
lea ebx, [edx*4]
mov ebp, 0xdb2c8d72
mov word [esp + 0xa], sp
push dword [esp + 0xc]
jmp 0x62d8c1
lea esp, [esp + 0xf]
pop ecx
xchg byte [esp + 0xb], cl
pop word [esp + 0x13]
mov ch, byte [esp + 0x15]
mov edx, 0x3bbdd03e
jmp 0x62da2f
Function at 0x62c77e
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 7], ch
xchg byte [esp + 0xc], cl
lea esp, [esp + 1]
lea esp, [esp + 0x15]
xchg bp, ax
mov byte [esp + 0x15], ah
jmp 0x62c766
pushal
xchg dword [esp + 0x1a], eax
inc al
xchg bh, cl
add esp, 0xf
pushal
jmp 0x62c6fb
lea esp, [esp + 0x4a]
push edx
xchg dword [esp], edi
pop ecx
btc edi, ebx
xchg bx, ax
jmp 0x62c722
mov edi, 0x11f3e80a
mov edi, dword [esp + 0x39]
xchg word [esp + 0xf], cx
mov bl, bh
jmp 0x62c7b1
mov ax, sp
lea eax, [ebp + 0xf7]
not ebp
pushal
bswap edx
jmp 0x62c74f
sub esp, 0x1e
jmp 0x62c73f
mov di, word [esp + 0x13]
push word [esp + 0x10]
lea esp, [esp + 0x41]
jmp 0x62c7e6
bsf dx, ax
push dword [esp + 0xe]
push word [esp + 0x19]
mov ebp, eax
jmp 0x62c783
rdtsc
mov cl, 0x22
mov ecx, esi
lea esi, [eax + ebx]
pop di
mov bx, sp
jmp 0x62c799
lea ebp, [esp + ebp]
shr ah, 1
mov ecx, dword [esp]
mov esi, 0x54005c6e
and ecx, ecx
lea edx, [eax + 0xe1]
jmp 0x62c805
mov dx, word [esp]
mov bl, byte [esp]
mov ebx, 0xf12fc470
mov cl, byte [esp]
lea edi, [edi*4]
lea esi, [ebp*4]
jmp 0x62c7c1
mov di, word [esp]
mov si, di
mov dx, word [esp]
sub esp, 0xe
sub esp, 0x18
sub esp, 0x12
jmp 0x62ca99
rdtsc
mov edx, ecx
popal
btr ebx, esp
xchg si, ax
push dword [esp + 2]
jmp 0x62c86c
pop word [esp + 9]
mov bp, bx
bswap edx
pop ax
sub esp, 8
sub esp, 2
jmp 0x62c840
stc
mov byte [esp + 6], ch
xchg bp, dx
lea eax, [ecx + 0x1b]
mov dx, 0x314f
pop dword [esp + 4]
jmp 0x62c8a6
xchg dword [esp + 0x20], ebp
mov ch, byte [esp + 5]
mov word [esp + 0x28], dx
mov byte [esp + 0x22], ch
xchg cx, di
lea edi, [esi - 0x45]
jmp 0x62c858
setl bh
add esp, 7
mov bl, 0x90
add esp, 5
cpuid
mov al, 0x6e
call int.0062c8ef
mov ds, word [bx + di]
pop dword [esp]
mov byte [esp + 0xe], ah
mov ah, byte [esp + 1]
pushal
setp ch
bsf si, ax
jmp 0x62c88d
pop word [esp + 0x17]
popal
bsf cx, ax
xchg byte [esp + 5], cl
xchg word [esp + 9], dx
neg ebx
jmp 0x62c8bd
xchg ch, dl
mov cx, 0x14fb
lea ebp, [ecx - 0xa3]
neg ecx
pop di
rdtsc
jmp 0x62c942
inc dl
clc
xchg byte [esp + 0x25], al
stc
mov cx, sp
sub bl, ah
jmp 0x62c9c6
Function at 0x62d011
Capabilities:
Access peb ldr_data
Get number of processors
Parse pe header

Disassembly:
push eax
jmp 0x62c07a
mov eax, dword [eax + 8]
jmp 0x62ce88
mov eax, dword [eax]
jmp 0x62ce9e
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0x62ceb5
mov byte [esp + 0xf], ah
lea esp, [esp + 3]
mov dword [esp + 0x44], edi
lea esp, [esp + 0x44]
jmp 0x62cecc
Function at 0x437ed3
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d2d09
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
call fcn.004c5860
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x10]
mov dword [eax], vtable._AFX_DEBUG_STATE.0
push str.AFX.INI
push 1
push str.TraceEnabled
push str.Diagnostics
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [0x549f04], eax
push str.AFX.INI
push 0
push str.TraceFlags
push str.Diagnostics
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [0x549f00], eax
cmp dword [0x549f10], 0
je 0x437f5c
push 0x77
push 0x540e04
call fcn.004b12c0
test eax, eax
je 0x437f5c
int3
xor ecx, ecx
test ecx, ecx
jne 0x437f42
push 0x437d04
call fcn.004060b0
add esp, 4
mov dword [0x549f10], eax
cmp dword [0x549f14], 0
je 0x437f8e
push 0x7a
push 0x540e14
call fcn.004b12c0
test eax, eax
je 0x437f8e
int3
xor edx, edx
test edx, edx
jne 0x437f74
push 0x437e76
call fcn.00408900
add esp, 4
mov dword [0x549f14], eax
push 4
push 2
call fcn.00408820
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45b655
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
cmp dword [eax + 4], 0x100
jne 0x45b6c0
mov ecx, dword [ebp + 8]
cmp dword [ecx + 8], 0x70
jne 0x45b6c0
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xc]
shr eax, 0x10
and eax, 0xffff
and eax, 0xffff
and eax, 0x4000
test eax, eax
jne 0x45b6c0
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
movsx ecx, ax
test ecx, ecx
jl 0x45b6c0
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
movsx edx, ax
test edx, edx
jl 0x45b6c0
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
movsx eax, ax
test eax, eax
jl 0x45b6c0
mov dword [ebp - 4], 1
jmp 0x45b6c7
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4
Function at 0x45fa1d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], 0
mov dword [ebp - 0xc], 0
call fcn.004b4022
mov dword [ebp - 4], eax
push 5
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x45fa76
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x45fa90
push 0xeb
push str.dlgcore.cpp
call fcn.004b12c0
test eax, eax
je 0x45fa90
int3
xor edx, edx
test edx, edx
jne 0x45fa76
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x14]
push edx
mov ecx, dword [ebp - 0x18]
call fcn.0045faeb
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0xc]
push eax
call fcn.00402d70
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x46083e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0x48]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + 0x44]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x24]
cmp dword [ecx + 0x40], 0
je 0x460891
call fcn.004b4022
mov dword [ebp - 0x10], eax
push 5
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + 0x40]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4608a4
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 1
cmp dword [ebp - 0xc], 0
je 0x460938
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0xc]
xor edx, edx
mov dx, word [ecx + 2]
cmp edx, 0xffff
jne 0x4608ef
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0xc]
mov ax, word [edx + 0x12]
mov word [ebp - 0x18], ax
mov ecx, dword [ebp - 0xc]
mov dx, word [ecx + 0x14]
mov word [ebp - 0x1c], dx
jmp 0x460905
mov eax, dword [ebp - 0xc]
mov cx, word [eax + 0xa]
mov word [ebp - 0x18], cx
mov edx, dword [ebp - 0xc]
mov ax, word [edx + 0xc]
mov word [ebp - 0x1c], ax
mov ecx, dword [ebp - 0x20]
and ecx, 0x1801
test ecx, ecx
jne 0x46092b
movsx edx, word [ebp - 0x18]
test edx, edx
jne 0x46092b
movsx eax, word [ebp - 0x1c]
test eax, eax
jne 0x46092b
mov dword [ebp - 0x28], 1
jmp 0x460932
mov dword [ebp - 0x28], 0
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x24]
cmp dword [edx + 0x40], 0
jne 0x46094a
mov eax, dword [ebp - 0x24]
cmp dword [eax + 0x44], 0
je 0x460953
mov ecx, dword [ebp - 4]
push ecx
call fcn.00402d70
mov edx, dword [ebp - 0x24]
cmp dword [edx + 0x40], 0
je 0x460966
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x460aff
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
cmp dword [ebp + 8], 0
jne 0x460b22
push 0x33c
push str.dlgcore.cpp
call fcn.004b12c0
test eax, eax
je 0x460b22
int3
xor eax, eax
test eax, eax
jne 0x460b08
call fcn.004b4022
mov dword [ebp - 8], eax
push 5
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x460b8e
mov eax, dword [ebp + 8]
shr eax, 0x10
and eax, 0xffff
and eax, 0xffff
test eax, eax
je 0x460b70
mov ecx, dword [ebp + 8]
push ecx
push str.ERROR:_Cannot_find_dialog_template_named__s._n
call fcn.00435045
add esp, 8
jmp 0x460b87
mov edx, dword [ebp + 8]
and edx, 0xffff
push edx
push str.ERROR:_Cannot_find_dialog_template_with_IDD_0x_04X._n
call fcn.00435045
add esp, 8
xor eax, eax
jmp 0x460cb8
cmp dword [ebp + 0xc], 0
jne 0x460b9e
mov eax, 1
jmp 0x460cb8
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x460bd1
push str.Warning:_LoadResource_failed_for_dialog_template._n
push 0x53e918
call fcn.00435045
add esp, 8
mov eax, 1
jmp 0x460cb8
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
xor ecx, ecx
mov cx, word [eax + 2]
cmp ecx, 0xffff
jne 0x460bfa
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0x14], eax
jmp 0x460c02
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0xc]
push eax
call fcn.00402d70
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov edx, dword [ebp - 0x14]
and edx, 0x10000000
test edx, edx
je 0x460c64
mov eax, dword [ebp + 8]
shr eax, 0x10
and eax, 0xffff
and eax, 0xffff
test eax, eax
je 0x460c49
mov ecx, dword [ebp + 8]
push ecx
push str.ERROR:_Dialog_named__s_must_be_invisible._n
call fcn.00435045
add esp, 8
jmp 0x460c60
mov edx, dword [ebp + 8]
and edx, 0xffff
push edx
push str.ERROR:_Dialog_with_IDD_0x_04X_must_be_invisible._n
call fcn.00435045
add esp, 8
xor eax, eax
jmp 0x460cb8
mov eax, dword [ebp - 0x14]
and eax, 0x40000000
test eax, eax
jne 0x460cb3
mov ecx, dword [ebp + 8]
shr ecx, 0x10
and ecx, 0xffff
and ecx, 0xffff
test ecx, ecx
je 0x460c99
mov edx, dword [ebp + 8]
push edx
push str.ERROR:_Dialog_named__s_must_have_the_child_style._n
call fcn.00435045
add esp, 8
jmp 0x460caf
mov eax, dword [ebp + 8]
and eax, 0xffff
push eax
push str.ERROR:_Dialog_with_IDD_0x_04X_must_have_the_child_style._n
call fcn.00435045
add esp, 8
xor eax, eax
jmp 0x460cb8
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x462c91
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x1c]
push ecx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x462cc2
push 0x43d
push str.wincore.cpp
call fcn.004b12c0
test eax, eax
je 0x462cc2
int3
xor edx, edx
test edx, edx
jne 0x462c9d
mov eax, dword [ebp - 8]
cmp dword [eax + 0x38], 0
jne 0x462d0e
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
add eax, 1
push eax
mov ecx, dword [ebp - 4]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00459f27
push eax
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x1c]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0xffffffffffffffff
mov ecx, dword [ebp + 8]
call fcn.00459eb3
jmp 0x462d26
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
mov ecx, dword [edx + 0x38]
mov eax, dword [ebp - 8]
mov edx, dword [eax + 0x38]
mov eax, dword [edx]
call dword [eax + 0x90]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x466580
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
cmp dword [ebp + 8], 0
je 0x46660c
call fcn.004b4022
mov dword [ebp - 0x10], eax
push 0xf0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x46660c
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4665df
xor eax, eax
jmp 0x46663d
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x466606
push 0xcc5
push str.wincore.cpp
call fcn.004b12c0
test eax, eax
je 0x466606
int3
xor edx, edx
test edx, edx
jne 0x4665ec
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0x18]
call fcn.00466646
mov dword [ebp - 0xc], eax
cmp dword [ebp - 4], 0
je 0x46663a
cmp dword [ebp - 8], 0
je 0x46663a
mov ecx, dword [ebp - 8]
push ecx
call fcn.00402d70
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x469e17
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
push 0xed
push str.filecore.cpp
mov eax, dword [ebp - 8]
push eax
call fcn.0045e250
mov ecx, dword [ebp - 8]
cmp dword [ecx + 4], 0xffffffff
jne 0x469e53
push 0xee
push str.filecore.cpp
call fcn.004b12c0
test eax, eax
je 0x469e53
int3
xor edx, edx
test edx, edx
jne 0x469e36
cmp dword [ebp + 0xc], 0
jne 0x469e64
jmp 0x469f05
cmp dword [ebp + 8], 0
jne 0x469e7e
push 0xf3
push str.filecore.cpp
call fcn.004b12c0
test eax, eax
je 0x469e7e
int3
xor eax, eax
test eax, eax
jne 0x469e64
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00435286
test eax, eax
jne 0x469eab
push 0xf4
push str.filecore.cpp
call fcn.004b12c0
test eax, eax
je 0x469eab
int3
xor eax, eax
test eax, eax
jne 0x469e84
push 0
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x469ee8
mov ecx, dword [ebp - 8]
add ecx, 0xc
call fcn.004ad8ea
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0045eb80
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0xc]
je 0x469f05
mov ecx, dword [ebp - 8]
add ecx, 0xc
call fcn.004ad8ea
push eax
push 0xffffffffffffffff
push 0xd
call fcn.0045ed60
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x46a64c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
lea eax, [ebp - 8]
push eax
push str.CLSID
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x46a722
mov dword [ebp - 0xc], 0
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x46a718
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x10]
push ecx
push str.InProcServer32
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x46a70e
push 0x104
mov ecx, dword [ebp + 0xc]
call fcn.00459d78
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x20], 0x104
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
lea edx, [ebp - 0x1c]
push edx
push 0
push 0x54a178
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x18], eax
push 0xffffffffffffffff
mov ecx, dword [ebp + 0xc]
call fcn.00459eb3
xor ecx, ecx
cmp dword [ebp - 0x18], 0
sete cl
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8