joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401f00
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x10
push ebx
mov ebx, dword [esp + 0x24]
push ebp
push esi
push edi
mov edi, ecx
push ebx
mov dword [esp + 0x14], edi
call dword [sym.imp.MSVCRT.dll_ftell]
push 0x3c04
mov esi, eax
call sub.MFC42.DLL_operatornew
mov edx, eax
xor ebp, ebp
add esp, 8
cmp edx, ebp
je 0x401f46
mov ecx, 0x100
xor eax, eax
mov edi, edx
mov dword [edx + 0x400], ebp
rep stosd dword es:[edi], eax
mov edi, dword [esp + 0x10]
mov ebp, edx
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
add eax, ecx
cmp esi, eax
mov dword [esp + 0x30], eax
jge 0x40200d
lea edx, [esp + 0x18]
mov ecx, edi
push edx
push ebx
call fcn.00401040
test eax, eax
je 0x40200d
mov eax, dword [esp + 0x18]
and eax, 0xffff
sub eax, 2
je 0x401fdd
sub eax, 0x3d3b
je 0x401fbf
sub eax, 0x72c3
je 0x401fa2
mov eax, dword [esp + 0x1c]
push 0
add eax, esi
push eax
push ebx
call dword [sym.imp.MSVCRT.dll_fseek]
add esp, 0xc
jmp 0x401ff5
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x24]
push ebx
push ecx
push esi
push edx
mov ecx, edi
call fcn.00402200
test eax, eax
je 0x40205e
jmp 0x401ff5
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x24]
push ebx
push eax
push esi
push ecx
push ebp
mov ecx, edi
call fcn.00401df0
test eax, eax
je 0x40205e
jmp 0x401ff5
push ebx
push 1
lea edx, [esp + 0x1c]
push 4
push edx
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
cmp eax, 1
jne 0x40205e
push ebx
call dword [sym.imp.MSVCRT.dll_ftell]
mov esi, eax
mov eax, dword [esp + 0x34]
add esp, 4
cmp esi, eax
jl 0x401f5c
test ebp, ebp
je 0x40204f
mov eax, dword [ebp + 0x400]
xor edi, edi
test eax, eax
jle 0x40203c
mov esi, ebp
mov eax, dword [esi]
test eax, eax
je 0x40202e
push eax
call sub.MFC42.DLL_operatordelete
add esp, 4
mov eax, dword [ebp + 0x400]
inc edi
add esi, 4
cmp edi, eax
jl 0x40201f
push ebp
mov dword [ebp + 0x400], 0
call sub.MFC42.DLL_operatordelete
add esp, 4
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x10
ret 0x10
test ebp, ebp
je 0x4020a0
mov eax, dword [ebp + 0x400]
xor edi, edi
test eax, eax
jle 0x40208d
mov esi, ebp
mov eax, dword [esi]
test eax, eax
je 0x40207f
push eax
call sub.MFC42.DLL_operatordelete
add esp, 4
mov eax, dword [ebp + 0x400]
inc edi
add esi, 4
cmp edi, eax
jl 0x402070
push ebp
mov dword [ebp + 0x400], 0
call sub.MFC42.DLL_operatordelete
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret 0x10
Function at 0x402200
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x11c
push ebx
push ebp
push esi
mov esi, dword [esp + 0x138]
push edi
mov ebp, ecx
push esi
call dword [sym.imp.MSVCRT.dll_ftell]
mov ecx, dword [esp + 0x138]
mov edi, eax
mov eax, dword [esp + 0x13c]
add esp, 4
add eax, ecx
cmp edi, eax
mov dword [esp + 0x18], eax
jge 0x402334
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
lea edx, [esp + 0x10]
mov ecx, ebp
push edx
push esi
call fcn.00401040
test eax, eax
je 0x402334
mov eax, dword [esp + 0x10]
and eax, 0xffff
sub eax, 0xb002
je 0x4022f3
sub eax, 6
je 0x4022ca
sub eax, 2
je 0x402282
mov eax, dword [esp + 0x14]
push 0
add eax, edi
push eax
jmp 0x402312
push esi
push 1
lea ecx, [esp + 0x26]
push 2
push ecx
call ebx
add esp, 0x10
cmp eax, 1
jne 0x402346
lea edx, [esp + 0x2c]
push 0x100
push edx
push esi
mov ecx, ebp
call fcn.004010a0
test eax, eax
je 0x402346
push esi
push 1
lea eax, [esp + 0x2c]
push 4
push eax
call ebx
add esp, 0x10
cmp eax, 1
jne 0x402346
jmp 0x40231c
push esi
push 1
lea ecx, [esp + 0x28]
push 4
push ecx
call ebx
add esp, 0x10
cmp eax, 1
jne 0x402346
push esi
push eax
lea edx, [esp + 0x30]
push 4
push edx
call ebx
add esp, 0x10
cmp eax, 1
jne 0x402346
jmp 0x40231c
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x130]
push esi
push eax
push edi
push ecx
mov ecx, ebp
call fcn.00402360
mov edx, dword [esp + 0x14]
push 0
add edx, edi
push edx
push esi
call dword [sym.imp.MSVCRT.dll_fseek]
add esp, 0xc
push esi
call dword [sym.imp.MSVCRT.dll_ftell]
mov edi, eax
mov eax, dword [esp + 0x1c]
add esp, 4
cmp edi, eax
jl 0x402241
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x11c
ret 0x10
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x11c
ret 0x10
Function at 0x402360
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x120
push ebx
push ebp
push esi
mov esi, dword [esp + 0x13c]
push edi
mov dword [esp + 0x18], ecx
push esi
call dword [sym.imp.MSVCRT.dll_ftell]
mov ecx, dword [esp + 0x13c]
mov edi, eax
mov eax, dword [esp + 0x140]
add esp, 4
add eax, ecx
cmp edi, eax
mov dword [esp + 0x1c], eax
jge 0x40252d
mov ebx, dword [sym.imp.MSVCRT.dll_fseek]
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x10]
push edx
push esi
call fcn.00401040
test eax, eax
je 0x40252d
mov eax, dword [esp + 0x10]
mov ecx, eax
and ecx, 0xffff
lea ebp, [ecx - 0xb010]
cmp ebp, 0x20
ja case.0x4023d9.45077
xor edx, edx
mov dl, byte [ebp + 0x402558]
jmp dword [edx*4 + 0x402540]
push esi
push 1
lea eax, [esp + 0x36]
push 2
push eax
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
cmp eax, 1
jne 0x40251e
mov ecx, dword [esp + 0x14]
push 0
add ecx, edi
push ecx
jmp 0x40242c
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x30]
push 0x100
push edx
push esi
call fcn.004010a0
test eax, eax
je 0x40251e
mov eax, dword [esp + 0x14]
push 0
add eax, edi
push eax
push esi
call ebx
add esp, 0xc
push esi
call dword [sym.imp.MSVCRT.dll_ftell]
mov edi, eax
mov eax, dword [esp + 0x20]
add esp, 4
cmp edi, eax
jl 0x4023a3
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x120
ret 0x10
mov ebp, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea ecx, [esp + 0x28]
push 4
push ecx
call ebp
add esp, 0x10
cmp eax, 1
jne 0x40251e
push esi
push eax
lea edx, [esp + 0x2c]
push 4
push edx
call ebp
add esp, 0x10
cmp eax, 1
jne 0x40251e
push esi
push eax
lea eax, [esp + 0x30]
push 4
push eax
call ebp
add esp, 0x10
cmp eax, 1
jne 0x40251e
mov ecx, dword [esp + 0x14]
push 0
add ecx, edi
push ecx
jmp 0x40242c
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x30]
push ecx
push eax
lea eax, [esp + 0x28]
push eax
mov eax, dword [esp + 0x140]
push edx
push esi
push ecx
mov ecx, dword [esp + 0x30]
push edi
push eax
call fcn.00402580
test eax, eax
je 0x40251e
mov ecx, dword [esp + 0x14]
push 0
add ecx, edi
push ecx
jmp 0x40242c
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x20]
push ecx
push eax
lea eax, [esp + 0x38]
push edx
push eax
push esi
push ecx
mov ecx, dword [esp + 0x14c]
push edi
push ecx
mov ecx, dword [esp + 0x38]
call fcn.00402580
test eax, eax
je 0x40251e
mov edx, dword [esp + 0x14]
push 0
add edx, edi
push edx
jmp 0x40242c
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x120
ret 0x10
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x120
ret 0x10
Function at 0x402580
Capabilities:
Read file on windows
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 0x14]
mov ecx, dword [ecx + 4]
sub esp, 0xa4
push eax
call fcn.00403f60
test eax, eax
jne 0x4025a0
add esp, 0xa4
ret 0x20
mov ecx, dword [esp + 0xbc]
push ebx
mov ebx, dword [esp + 0xb8]
push ebp
mov edx, dword [ecx]
mov ebp, dword [sym.imp.MSVCRT.dll_fread]
mov dword [eax + 0x58], edx
mov edx, dword [ecx + 4]
mov dword [eax + 0x5c], edx
mov ecx, dword [ecx + 8]
push ebx
push 1
lea edx, [esp + 0x22]
push 2
push edx
mov dword [eax + 0x60], ecx
call ebp
push ebx
push 1
lea eax, [esp + 0x4c]
push 4
push eax
call ebp
push ebx
push 1
lea ecx, [esp + 0x60]
push 4
push ecx
call ebp
push ebx
push 1
lea edx, [esp + 0x48]
push 4
push edx
call ebp
mov eax, dword [esp + 0x50]
add esp, 0x40
test eax, eax
mov dword [esp + 0xc], 0
jle 0x4027b7
push esi
mov esi, dword [esp + 0xcc]
and esi, 0xffff
push edi
mov dword [esp + 0x1c], esi
jmp 0x402627
mov esi, dword [esp + 0x1c]
mov ecx, 6
xor eax, eax
lea edi, [esp + 0x24]
push ebx
rep stosd dword es:[edi], eax
push 1
lea eax, [esp + 0x40]
push 4
push eax
call ebp
push ebx
push 1
lea ecx, [esp + 0x2a]
push 2
push ecx
call ebp
mov al, byte [esp + 0x32]
add esp, 0x20
test al, 1
je 0x402666
push ebx
push 1
lea edx, [esp + 0x2c]
push 4
push edx
call ebp
add esp, 0x10
test byte [esp + 0x12], 2
je 0x40267c
push ebx
push 1
lea eax, [esp + 0x30]
push 4
push eax
call ebp
add esp, 0x10
test byte [esp + 0x12], 4
je 0x402692
push ebx
push 1
lea ecx, [esp + 0x34]
push 4
push ecx
call ebp
add esp, 0x10
test byte [esp + 0x12], 8
je 0x4026a8
push ebx
push 1
lea edx, [esp + 0x38]
push 4
push edx
call ebp
add esp, 0x10
test byte [esp + 0x12], 0x10
je 0x4026be
push ebx
push 1
lea eax, [esp + 0x3c]
push 4
push eax
call ebp
add esp, 0x10
mov eax, esi
sub eax, 0xb020
je 0x40275e
dec eax
je 0x402714
dec eax
jne 0x4027a0
mov ecx, 9
lea esi, [esp + 0x24]
lea edi, [esp + 0x6c]
push ebx
rep movsd dword es:[edi], dword [esi]
push 1
lea ecx, [esp + 0x8c]
push 4
push ecx
call ebp
push ebx
push 1
lea edx, [esp + 0xa0]
push 4
push edx
call ebp
push ebx
push 1
lea eax, [esp + 0xb4]
push 4
push eax
jmp 0x40279b
mov ecx, 0xa
lea esi, [esp + 0x24]
lea edi, [esp + 0x44]
push ebx
rep movsd dword es:[edi], dword [esi]
push 1
lea ecx, [esp + 0x64]
push 4
push ecx
call ebp
push ebx
push 1
lea edx, [esp + 0x78]
push 4
push edx
call ebp
push ebx
push 1
lea eax, [esp + 0x8c]
push 4
push eax
call ebp
push ebx
push 1
lea ecx, [esp + 0xa0]
push 4
push ecx
call ebp
add esp, 0x40
jmp 0x4027a0
push ebx
mov ecx, 9
lea esi, [esp + 0x28]
lea edi, [esp + 0x94]
push 1
lea edx, [esp + 0xb0]
push 4
push edx
rep movsd dword es:[edi], dword [esi]
call ebp
push ebx
push 1
lea eax, [esp + 0xc4]
push 4
push eax
call ebp
push ebx
push 1
lea ecx, [esp + 0xd8]
push 4
push ecx
call ebp
add esp, 0x30
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
inc eax
cmp eax, ecx
mov dword [esp + 0x14], eax
jl 0x402623
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xa4
ret 0x20
Function at 0x402e70
Capabilities:
Read file on windows

Disassembly:
push esi
push 0x407028
push str.DC10.gl
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
jne 0x402e8f
or eax, 0xffffffff
pop esi
ret
push esi
push 1
push 0x8fa0
push 0x40df5c
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
cmp eax, 1
je 0x402eaf
or eax, 0xffffffff
pop esi
ret
push ebx
push edi
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
push 1
call dword [sym.imp.OPENGL32.dll_glGenLists]
push 0x40df5c
push 0
push 0x2a2b
mov ebx, eax
call dword [sym.imp.OPENGL32.dll_glInterleavedArrays]
push 0x1300
push ebx
call dword [sym.imp.OPENGL32.dll_glNewList]
push 0x901
call dword [sym.imp.OPENGL32.dll_glFrontFace]
push 0xb44
call dword [sym.imp.OPENGL32.dll_glEnable]
push 0x405
call dword [sym.imp.OPENGL32.dll_glCullFace]
push 0x1b02
push 0x408
call dword [sym.imp.OPENGL32.dll_glPolygonMode]
mov esi, dword [sym.imp.OPENGL32.dll_glMaterialfv]
push 0x407088
push 0x1200
push 0x404
call esi
push 0x407098
push 0x1201
push 0x404
call esi
push 0x4070a8
push 0x1202
push 0x404
call esi
mov edi, dword [sym.imp.OPENGL32.dll_glDrawElements]
push 0x4071a8
push 0x1405
push 3
push 4
call edi
push 0x4070b8
push 0x1200
push 0x404
call esi
push 0x4070c8
push 0x1201
push 0x404
call esi
push 0x4070d8
push 0x1202
push 0x404
call esi
push 0x4071b4
push 0x1405
push 0xb1
push 4
call edi
push 0x4070e8
push 0x1200
push 0x404
call esi
push 0x4070f8
push 0x1201
push 0x404
call esi
push 0x407108
push 0x1202
push 0x404
call esi
push 0x407478
push 0x1405
push 0x192c
push 4
call edi
push 0x407118
push 0x1200
push 0x404
call esi
push 0x407128
push 0x1201
push 0x404
call esi
push 0x407138
push 0x1202
push 0x404
call esi
push 0x40d928
push 0x1405
push 0x24
push 4
call edi
push 0x407148
push 0x1200
push 0x404
call esi
push 0x407158
push 0x1201
push 0x404
call esi
push 0x407168
push 0x1202
push 0x404
call esi
push 0x40d9b8
push 0x1405
push 0xe4
push 4
call edi
push 0x407178
push 0x1200
push 0x404
call esi
push 0x407188
push 0x1201
push 0x404
call esi
push 0x407198
push 0x1202
push 0x404
call esi
push 0x40dd48
push 0x1405
push 0x48
push 4
call edi
call dword [sym.imp.OPENGL32.dll_glEndList]
mov eax, ebx
pop edi
pop ebx
pop esi
ret
Function at 0x4038c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x30
push esi
xor esi, esi
mov dword [ecx + 0x1000], esi
mov dword [ecx + 0x1010], esi
mov dword [ecx + 0x1014], esi
mov dword [ecx + 0x1018], 0xc2c80000
mov dword [ecx + 0x1004], 0x41a00000
mov dword [ecx + 0x1008], 0xc1a00000
mov dword [ecx + 0x100c], esi
mov dword [ecx + 0x1028], esi
mov dword [ecx + 0x102c], esi
mov dword [ecx + 0x1030], 0xc1200000
mov dword [ecx + 0x101c], esi
mov dword [ecx + 0x1020], esi
mov dword [ecx + 0x1024], esi
mov dword [ecx + 0x103c], esi
mov dword [ecx + 0x1040], esi
mov dword [ecx + 0x1034], esi
mov dword [ecx + 0x1038], esi
mov dword [ecx + 0x1048], 0x42480000
mov dword [ecx + 0x1044], esi
mov dword [ecx + 0x1050], esi
push edi
add ecx, 0x50
call fcn.00403ee0
push 0x1d00
call dword [sym.imp.OPENGL32.dll_glShadeModel]
push esi
push esi
push esi
push esi
call dword [sym.imp.OPENGL32.dll_glClearColor]
push 0x3ff00000
push esi
call dword [sym.imp.OPENGL32.dll_glClearDepth]
mov esi, dword [sym.imp.OPENGL32.dll_glEnable]
push 0xb71
call esi
push 0xb44
call esi
mov edi, dword [sym.imp.OPENGL32.dll_glLightfv]
lea eax, [esp + 8]
push eax
push 0x1200
push 0x4000
mov dword [esp + 0x14], 0x3e99999a
mov dword [esp + 0x18], 0x3e99999a
mov dword [esp + 0x1c], 0x3e99999a
mov dword [esp + 0x20], 0x3f800000
mov dword [esp + 0x24], 0x3f333333
mov dword [esp + 0x28], 0x3f333333
mov dword [esp + 0x2c], 0x3f333333
mov dword [esp + 0x30], 0x3f800000
mov dword [esp + 0x34], 0x45bb8000
mov dword [esp + 0x38], 0x45bb8000
mov dword [esp + 0x3c], 0x45bb8000
mov dword [esp + 0x40], 0x3f800000
call edi
lea ecx, [esp + 0x18]
push ecx
push 0x1201
push 0x4000
call edi
lea edx, [esp + 0x28]
push edx
push 0x1203
push 0x4000
call edi
lea eax, [esp + 8]
push eax
push 0xb53
call dword [sym.imp.OPENGL32.dll_glLightModelfv]
push 0xb57
call esi
push 0x1602
push 0x404
call dword [sym.imp.OPENGL32.dll_glColorMaterial]
push 0xb50
call esi
push 0x4000
call esi
pop edi
pop esi
add esp, 0x30
ret
Function at 0x4018b9
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebx + 0x1cc]
push esi
push edi
xor edi, edi
cmp eax, edi
mov dword [ebx], 0x419124
mov dword [ebx + 0x20], 0x419104
mov dword [ebx + 0x4c], 0x4190e4
mov dword [ebx + 0x78], 0x4190c4
je 0x4018ef
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
call fcn.0040cc3a
lea esi, [ebx + 0x194]
call fcn.00409ea5
lea esi, [ebx + 0x190]
call fcn.00409ea5
cmp dword [ebx + 0x1e0], edi
mov dword [ebp - 4], edi
je 0x40198e
cmp dword [0x41d8a4], edi
jne 0x40198e
push edi
push 0x2001f
push edi
push edi
push str.SoftwareITConceptsOneCardASPanel
push SysReAllocString
xor edi, edi
lea eax, [ebp - 4]
call fcn.00409e5c
test eax, eax
jne 0x40197f
mov eax, dword [ebx + 0x1e0]
lea edx, [ebp - 8]
push edx
lea edx, [ebp - 0xc]
xor esi, esi
push edx
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], esi
mov ecx, dword [eax]
push eax
call dword [ecx + 0x6c]
test eax, eax
jl 0x40197f
push dword [ebp - 0xc]
push dword [ebp - 8]
push 3
push esi
push str.ExpandState
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 8]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
cmp dword [ebp - 4], 0
je 0x40198e
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebx + 0x214]
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
call esi
push dword [ebx + 0x210]
call esi
lea esi, [ebx + 0x204]
call fcn.00402f46
mov eax, dword [ebx + 0x1e0]
test eax, eax
je 0x4019bf
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea esi, [ebx + 0x1d4]
call fcn.00402f2c
mov eax, dword [ebx + 0x1c8]
test eax, eax
je 0x4019da
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov esi, dword [sym.imp.KERNEL32.dll_LocalFree]
lea edi, [ebx + 0x1a4]
mov eax, dword [edi]
test eax, eax
je 0x4019f2
push eax
call esi
and dword [edi], 0
lea edi, [ebx + 0x1a0]
mov eax, dword [edi]
test eax, eax
je 0x401a04
push eax
call esi
and dword [edi], 0
lea edi, [ebx + 0x19c]
mov eax, dword [edi]
test eax, eax
je 0x401a16
push eax
call esi
and dword [edi], 0
lea edi, [ebx + 0x198]
mov eax, dword [edi]
test eax, eax
je 0x401a28
push eax
call esi
and dword [edi], 0
lea esi, [ebx + 0x188]
call fcn.0040a0ff
lea esi, [ebx + 0x184]
call fcn.0040a0ff
lea eax, [ebx + 0x15c]
call fcn.00408d4a
lea edi, [ebx + 0xdc]
call fcn.00401f20
push dword [ebx + 0xd0]
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
call esi
push dword [ebx + 0xcc]
call esi
lea edi, [ebx + 0xc8]
mov eax, dword [edi]
test eax, eax
je 0x401a80
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
and dword [edi], 0
mov eax, dword [ebx + 0xb8]
test eax, eax
je 0x401a90
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push dword [ebx + 0xb4]
call esi
push dword [ebx + 0xb0]
call esi
mov eax, dword [ebx + 0xa4]
test eax, eax
pop edi
pop esi
je 0x401ab2
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea eax, [ebx + 0x14]
call fcn.00408d4a
leave
ret
Function at 0x40204f
Capabilities:
Check mutex on windows
Enumerate gui resources

Disassembly:
push 0x14
push 0x419450
call fcn.00415ac0
xor edi, edi
mov dword [ebp - 0x1c], edi
push edi
push str.AllowMultipleInstances
push str.SoftwareITConceptsOneCardASPanel
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00413e0e
add esp, 0x10
xor esi, esi
inc esi
mov dword [ebp - 0x20], edi
cmp eax, edi
jne 0x4020b9
push 0x419150
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov ebx, eax
mov dword [ebp - 0x20], ebx
cmp ebx, edi
je 0x4020b9
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x4020b9
push edi
push 0x401f9f
call dword [sym.imp.USER32.dll_EnumWindows]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
cmp esi, edi
je 0x402123
push dword [ebp + 8]
call sub.ItMsg.dll_Ordinal_1054
pop ecx
mov dword [ebp - 0x24], eax
cmp eax, dword [ebp + 8]
je 0x4020d9
push eax
mov ecx, 0x41b6f0
call fcn.0041553b
push edi
call dword [sym.imp.ole32.dll_CoInitialize]
mov dword [ebp - 4], edi
push edi
push edi
push edi
push edi
call dword [sym.imp.USER32.dll_DefWindowProcW]
mov eax, 0xff
call fcn.00409d8b
push dword [ebp + 8]
mov edx, 0x416604
xor eax, eax
mov esi, 0x41d818
call fcn.00409ce4
call fcn.00402011
mov dword [ebp - 0x1c], eax
mov eax, esi
call fcn.00409ba0
or dword [ebp - 4], 0xffffffff
call fcn.00402130
mov eax, dword [ebp - 0x1c]
call fcn.00415afb
ret 0x10
Function at 0x402fa1
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
movzx eax, word [ebp + 0xc]
push ebx
push esi
push edi
mov edi, dword [0x41b6f8]
push 0xf0
push eax
push edi
mov dword [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_FindResourceW]
xor esi, esi
cmp eax, esi
je 0x4030c2
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, esi
je 0x4030c2
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
cmp ebx, esi
je 0x4030c2
xor eax, eax
mov ax, word [ebx]
cmp ax, si
mov dword [ebp + 0xc], eax
je 0x4030c2
inc ebx
inc ebx
mov ax, word [ebx]
inc ebx
inc ebx
mov ecx, dword [ebx]
add ebx, 4
cmp ax, 0x403
mov dword [ebp - 8], ecx
jne 0x403050
cmp ebx, esi
jne 0x403021
xor eax, eax
jmp 0x403047
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
inc edi
lea eax, [edi + edi]
add eax, 3
and eax, 0xfffffffc
call fcn.00415cc0
mov eax, esp
push esi
push edi
push ebx
mov esi, eax
call fcn.00408d22
xor esi, esi
push eax
push esi
push 0x143
jmp 0x40309d
cmp ax, 0x1234
jne 0x4030b6
or dword [ebp - 0x28], 0xffffffff
cmp ebx, esi
mov dword [ebp - 0x2c], 1
jne 0x40306a
mov dword [ebp - 0x24], esi
jmp 0x403093
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
inc edi
lea eax, [edi + edi]
add eax, 3
and eax, 0xfffffffc
call fcn.00415cc0
mov eax, esp
push esi
push edi
push ebx
mov esi, eax
call fcn.00408d22
mov dword [ebp - 0x24], eax
xor esi, esi
lea eax, [ebp - 0x2c]
push eax
push esi
push 0x40b
movzx eax, word [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
cmp eax, 0xffffffff
jne 0x4030b6
mov dword [ebp - 4], esi
add ebx, dword [ebp - 8]
cmp dword [ebp - 4], esi
jne 0x402ff3
mov eax, dword [ebp - 4]
lea esp, [ebp - 0x38]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x403835
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x41b070]
xor eax, dword [ebp + 4]
push ebx
push esi
push edi
xor ebx, ebx
push 2
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x414], ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
cmp edi, ebx
mov dword [ebp - 8], edi
jne 0x40387e
call fcn.004091a3
mov esi, eax
jmp 0x403914
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
cmp esi, ebx
je 0x4038e7
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebx
mov dword [ebp + 0xc], eax
je 0x4038e7
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea edi, [eax + eax]
mov dword [ebp + 8], eax
lea eax, [edi + 2]
push eax
lea esi, [ebp - 0x414]
call fcn.00403941
cmp dword [ebp - 0x414], ebx
jne 0x4038cc
mov esi, 0x8007000e
jmp 0x40390b
push dword [ebp + 8]
push dword [ebp - 0x414]
push dword [ebp + 8]
push dword [ebp + 0xc]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x4038ee
call fcn.004091a3
jmp 0x403909
mov eax, dword [ebp - 0x414]
push dword [ebp + 0x18]
mov word [edi + eax], bx
mov ecx, dword [ebp - 0x414]
lea edx, [ebp - 0x10]
call fcn.00403961
mov esi, eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x410]
cmp dword [ebp - 0x414], eax
je 0x40392d
lea eax, [ebp - 0x414]
call fcn.0040465d
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
pop edi
mov eax, esi
pop esi
pop ebx
call fcn.00415ab2
leave
ret 0x14