joyce8/EMBER2024-capa huggingface dataset:
Function at 0x423d71
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x6184ac
call fcn.0044c384
sub esp, 0x58
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
call fcn.00401000
test eax, eax
jne 0x423e1c
push str.acroct.ini
push 1
push str.BlendThruClip
push str.WinFntSvr
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
test eax, eax
je 0x423e1c
push 0x6784d4
push dword [ebp + 0x10]
call fcn.005986b2
pop ecx
test eax, eax
pop ecx
jne 0x423ded
push 4
push str.HP_Color_LaserJet
push dword [ebp + 0x10]
call fcn.00423d30
add esp, 0xc
test ax, ax
jne 0x423ded
mov edi, dword [ebp + 0xc]
mov esi, dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 0xc
push dword [edi + 8]
call esi
cmp eax, 1
je 0x423df6
jmp 0x423e1c
mov edi, dword [ebp + 0xc]
mov esi, dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 0x58
push dword [edi + 8]
call esi
cmp eax, 0x258
jge 0x423e24
push 0xe
push dword [edi + 8]
call esi
cmp eax, 3
je 0x423e24
push 0x18
push dword [edi + 8]
call esi
cmp eax, 8
je 0x423e24
xor ax, ax
jmp 0x423edd
xor esi, esi
mov dword [ebp - 4], esi
call fcn.005989f0
mov dword [ebp - 0x14], eax
mov ecx, dword [eax]
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0x1c]
mov dword [eax], ecx
mov dword [ebp - 0x18], 0x5989d1
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x5c]
push eax
mov dword [ebp - 0x5c], 0x24
push dword [ebp + 8]
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x54], 0x423ef2
mov dword [ebp - 0x48], 0x424031
mov dword [ebp - 0x44], 0x42403c
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], esi
call fcn.0050c5b9
add esp, 0xc
cmp dword [ebp - 0x24], esi
je 0x423ecb
push dword [ebp - 0x24]
call fcn.005a0460
pop ecx
mov ebx, eax
xor edi, edi
cmp edi, ebx
jge 0x423ec2
push edi
push dword [ebp - 0x24]
call fcn.005a0467
pop ecx
cmp eax, esi
pop ecx
je 0x423ebf
push eax
call fcn.005989b0
pop ecx
inc edi
jmp 0x423ea5
push dword [ebp - 0x24]
call fcn.005a041e
pop ecx
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x1c]
mov dword [eax], ecx
push 0x32
pop eax
cmp eax, dword [ebp - 0x20]
sbb eax, eax
neg eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x42497e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, dword [eax + 0x94]
call fcn.006092e4
mov edi, dword [eax + 8]
push str.PSPROCSET
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
xor ebx, ebx
mov dword [ebp + 8], eax
cmp eax, ebx
je 0x4249cc
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebx
mov dword [ebp + 0xc], eax
je 0x4249cc
push dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
cmp edi, ebx
jne 0x4249f6
cmp dword [esi + 0xac], ebx
lea edi, [esi + 0xac]
jne 0x4249e9
push ebx
push ebx
push 0x474a
call fcn.0040fb61
add esp, 0xc
push 1
pop eax
mov dword [edi], eax
mov dword [esi + 0xb0], eax
jmp 0x424a5c
lea eax, [edi + 6]
push eax
call fcn.0044e905
cmp eax, ebx
pop ecx
mov dword [ebp + 8], eax
jne 0x424a1a
push ebx
call fcn.0040fd08
pop ecx
mov dword [esi + 0xb0], 1
jmp 0x424a5c
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp eax, ebx
mov dword [ebp + 0xc], eax
je 0x424a53
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp ax, bx
jle 0x424a3b
cmp ax, di
jle 0x424a3d
mov eax, edi
movsx eax, ax
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0xa8]
call dword [ebp + 0x10]
add esp, 0x10
push dword [ebp + 8]
call fcn.0044ddce
pop ecx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x42a48f
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
push ebx
xor ebx, ebx
cmp dword [0x6b56fc], ebx
push esi
push edi
mov edi, 0xff
jne 0x42a4f0
mov esi, dword [sym.imp.USER32.dll_GetKeyboardLayoutList]
push ebx
push ebx
call esi
cmp eax, 0xa
jle 0x42a4bb
push dword [0x6b56fc]
push ebx
call esi
jmp 0x42a4be
push 0xa
pop eax
cmp eax, ebx
mov dword [0x6b5700], eax
je 0x42a4e8
shl eax, 2
push eax
call fcn.005988ea
cmp eax, ebx
pop ecx
mov dword [0x6b56fc], eax
je 0x42a539
push eax
push dword [0x6b5700]
call esi
mov dword [0x6b5700], eax
cmp dword [0x6b56fc], ebx
je 0x42a539
cmp dword [0x6b5700], ebx
je 0x42a539
xor esi, esi
cmp esi, dword [0x6b5700]
jae 0x42a532
mov eax, dword [0x6b56fc]
push dword [eax + esi*4]
call fcn.004076f4
test al, al
pop ecx
jne 0x42a52a
mov eax, dword [0x6b56fc]
push dword [eax + esi*4]
push dword [esp + 0x14]
call dword [sym.imp.USER32.dll_VkKeyScanExA]
movzx di, al
inc esi
cmp di, 0xff
je 0x42a4fa
cmp di, 0xff
jne 0x42a53f
or ax, 0xffff
jmp 0x42a542
mov ax, di
pop edi
pop esi
pop ebx
ret

Function at 0x42b33e
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push edi
xor edi, edi
cmp dword [ebp + 8], edi
mov dword [ebp - 8], edi
je 0x42b418
push ebx
push esi
push dword [ebp + 8]
call fcn.00462253
mov esi, eax
pop ecx
cmp dword [esi + 0x90], edi
jne 0x42b36e
mov dword [ebp - 8], 1
push edi
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push 0xe
push dword [esi + 4]
call edi
mov ebx, eax
inc ebx
lea eax, [ebx + 1]
push eax
call fcn.005988ea
pop ecx
mov dword [ebp - 4], eax
push eax
push ebx
push 0xd
push dword [esi + 4]
call edi
mov ebx, dword [ebp + 0xc]
lea eax, [esi + 0x90]
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp - 8]
movzx eax, bl
push eax
movzx eax, byte [esi + 0x89]
push eax
call fcn.0047b971
add esp, 0x14
push 0
push 0
push 0xb0
push dword [esi + 4]
call edi
push dword [ebp - 4]
mov dword [ebp + 0xc], eax
push 0
push dword [ebp + 8]
call fcn.00462320
push dword [ebp - 4]
call fcn.005989b0
push 1
push ebx
push dword [ebp + 8]
call fcn.0042b1ca
add esp, 0x1c
mov byte [esi + 0x89], bl
mov ebx, 0xb1
push 0
push 0
push ebx
push dword [esi + 4]
call edi
mov eax, dword [ebp + 0xc]
shr eax, 0x10
push eax
movzx eax, word [ebp + 0xc]
push eax
push ebx
push dword [esi + 4]
call edi
pop esi
pop ebx
pop edi
leave
ret
Function at 0x42b41b
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
xor ebx, ebx
push edi
push ebx
push ebx
push 0xe
push dword [eax + 4]
call esi
mov dword [ebp - 0xc], eax
inc eax
push eax
mov dword [ebp - 0x10], eax
call fcn.005988ea
cmp eax, ebx
pop ecx
mov dword [ebp - 8], eax
je 0x42b51e
mov ecx, dword [ebp - 0xc]
push eax
push dword [ebp - 0x10]
mov dword [ebp - 4], eax
add ecx, eax
mov eax, dword [ebp + 8]
push 0xd
xor edi, edi
push dword [eax + 4]
mov dword [ebp - 0xc], ecx
call esi
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0xc]
jae 0x42b515
mov ecx, dword [ebp - 4]
mov al, byte [ecx]
cmp al, 0x28
jne 0x42b487
mov edi, ecx
xor ebx, ebx
jmp 0x42b4a7
cmp al, 0x29
jne 0x42b493
test edi, edi
je 0x42b4a7
mov ebx, ecx
jmp 0x42b4a7
push eax
call fcn.00598807
test ax, ax
pop ecx
jne 0x42b4a7
test ebx, ebx
je 0x42b4a7
xor ebx, ebx
xor edi, edi
push dword [ebp - 4]
call fcn.004ecc67
pop ecx
mov ecx, eax
dec eax
test ecx, ecx
je 0x42b4c0
mov ecx, dword [ebp - 4]
lea eax, [ecx + eax + 1]
jmp 0x42b4c3
mov eax, dword [ebp - 4]
inc eax
cmp eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
jb 0x42b478
test edi, edi
je 0x42b515
test ebx, ebx
je 0x42b515
movzx eax, word [ebp + 0x10]
movzx ecx, word [ebp + 0xc]
sub ebx, dword [ebp - 8]
sub edi, dword [ebp - 8]
shl eax, 0x10
or eax, ecx
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp + 8]
push eax
push 0
push 0xd7
push dword [ebx + 4]
inc edi
call esi
movzx eax, ax
cmp eax, edi
jl 0x42b515
cmp eax, dword [ebp - 0xc]
jg 0x42b515
push dword [ebp - 0xc]
push edi
push 0xb1
push dword [ebx + 4]
jmp 0x42b52d
push dword [ebp - 8]
call fcn.005989b0
pop ecx
mov eax, dword [ebp + 8]
push 0xffffffffffffffff
push 0
push 0xb1
push dword [eax + 4]
call esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x42b68b
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
cmp word [esi + 0x5c], bx
je 0x42b7f1
cmp word [esi + 0x5a], bx
jne 0x42b7f1
lea eax, [ebp - 0x28]
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetClientRect]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push ebx
push ebx
push 0xe
push dword [esi + 4]
call edi
test eax, eax
mov dword [ebp - 0xc], eax
je 0x42b6df
push ebx
push ebx
push 0xd6
push dword [esi + 4]
call edi
movsx ebx, ax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], ebx
test eax, eax
je 0x42b7a5
inc eax
push eax
call fcn.005988ea
test eax, eax
pop ecx
mov dword [ebp - 4], eax
je 0x42b7a5
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetDC]
test eax, eax
mov dword [ebp + 8], eax
je 0x42b79c
mov eax, dword [ebp - 0xc]
push dword [ebp - 4]
inc eax
push eax
push 0xd
push dword [esi + 4]
call edi
push dword [esi + 8]
push dword [ebp + 8]
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0xc]
push dword [ebp - 4]
push dword [ebp + 8]
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
push dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
add eax, ebx
push dword [ebp + 8]
mov dword [ebp - 8], eax
call dword [sym.imp.GDI32.dll_SelectObject]
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ReleaseDC]
test ebx, ebx
jge 0x42b79c
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 8]
sub eax, dword [ebp - 0x28]
sub ecx, ebx
cmp ecx, eax
jg 0x42b79c
push dword [ebp - 4]
xor ebx, ebx
push ebx
push 0xc
push dword [esi + 4]
call edi
push ebx
push ebx
push 0xd6
push dword [esi + 4]
call edi
movsx ebx, ax
mov eax, dword [ebp - 0x18]
add eax, ebx
mov dword [ebp - 8], eax
push dword [ebp - 4]
call fcn.005989b0
pop ecx
and dword [ebp + 8], 0
test ebx, ebx
jl 0x42b7ca
mov ecx, dword [ebp - 8]
test ecx, ecx
jl 0x42b7ca
mov eax, dword [ebp - 0x20]
sub ecx, ebx
sub eax, dword [ebp - 0x28]
cmp ecx, eax
jge 0x42b7ca
sub eax, ecx
cdq
sub eax, edx
sar eax, 1
mov dword [ebp + 8], eax
push 0
push 0
push 0xd4
push dword [esi + 4]
call edi
movzx eax, ax
cmp dword [ebp + 8], eax
je 0x42b7f1
movzx eax, word [ebp + 8]
push eax
push 1
push 0xd3
push dword [esi + 4]
call edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x42c085
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi + 0x8c]
test eax, eax
je 0x42c09b
push eax
call fcn.005989b0
pop ecx
push ebx
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
push 0xe
push dword [esi + 4]
call edi
mov ebx, eax
lea eax, [ebx + 1]
push eax
call fcn.005988ea
pop ecx
mov dword [esi + 0x8c], eax
push eax
push ebx
push 0xd
push dword [esi + 4]
call edi
mov eax, dword [esi + 0x8c]
add esi, 0x90
pop edi
and byte [ebx + eax], 0
mov al, byte [esp + 0x10]
and word [esi + 4], 0
mov byte [esi - 8], al
mov byte [esi - 7], al
mov eax, dword [esi]
test eax, eax
pop ebx
je 0x42c0f7
push eax
call fcn.005989b0
pop ecx
and dword [esi], 0
pop esi
ret
Function at 0x4320f8
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 8]
push edi
push eax
push dword [esi]
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov edi, eax
test edi, edi
je 0x4321da
push edi
call fcn.005988ea
test eax, eax
pop ecx
mov dword [0x6b5730], eax
je 0x4321da
push eax
push edi
push 0
push dword [esi]
call sub.VERSION.dll_GetFileVersionInfoA
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp + 8]
push eax
push str.VarFileInfoTranslation
push dword [0x6b5730]
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x4321b8
mov eax, dword [ebp + 8]
push dword [0x678e0c]
movzx ecx, word [eax + 2]
movzx eax, word [eax]
push ecx
push eax
push 0x678f70
lea eax, [ebp - 0x80]
push str._s_04x_04x_s
push eax
call fcn.0044d2a5
add esp, 0x18
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x80]
push eax
push dword [0x6b5730]
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x4321b8
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 4]
call fcn.0043e5b8
lea eax, [ebp - 0x30]
push eax
call fcn.0044c440
add esp, 0xc
push eax
lea eax, [ebp - 0x30]
push eax
jmp 0x4321c6
mov edi, 0x6b5734
push edi
call fcn.0044c440
pop ecx
push eax
push edi
lea ecx, [esi + 0x2c]
call fcn.004326c7
push dword [0x6b5730]
call fcn.005989b0
pop ecx
pop edi
pop esi
leave
ret 4
Function at 0x43b306
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x164
push ebx
push esi
push edi
mov edi, ecx
push dword [edi + 0x68]
call fcn.004f9f61
mov esi, eax
mov eax, dword [0x6b8268]
mov dword [esp], 0x536d6574
push dword [edi + 4]
call dword [eax + 0x120]
pop ecx
xor ebx, ebx
cmp si, 0xffff
pop ecx
mov dword [ebp - 0xc], eax
je 0x43b377
push esi
call fcn.004f9e56
cmp eax, ebx
pop ecx
jne 0x43b351
mov eax, 0x6b577c
push eax
lea eax, [ebp - 0x164]
push eax
call fcn.0059848b
pop ecx
pop ecx
call fcn.00469766
push eax
lea eax, [ebp - 0x164]
push eax
lea ecx, [ebp - 0xc]
call fcn.0043076a
jmp 0x43b384
push 0xf9
push eax
call fcn.0042fb65
pop ecx
pop ecx
lea eax, [ebp - 8]
push eax
push dword [edi + 0x68]
call fcn.004fa0ad
pop ecx
mov dword [ebp - 0x64], 0x26
pop ecx
mov dword [ebp - 0x60], 0x25
push 2
mov dword [ebp - 0x5c], 0x6e
pop eax
mov dword [ebp - 0x58], 0x6d
mov dword [ebp - 0x54], 0x6f707764
mov dword [ebp - 0x50], 1
mov word [ebp - 0x4c], bx
mov word [ebp - 0x4a], bx
mov dword [ebp - 0x48], 0x73707764
mov dword [ebp - 0x44], eax
mov word [ebp - 0x40], bx
mov word [ebp - 0x3e], bx
mov dword [ebp - 0x3c], 0x70726e74
mov dword [ebp - 0x38], 4
mov word [ebp - 0x34], ax
mov word [ebp - 0x32], bx
mov dword [ebp - 0x30], 0x63686e67
mov dword [ebp - 0x2c], 8
mov word [ebp - 0x28], ax
mov word [ebp - 0x26], bx
mov dword [ebp - 0x24], 0x73656c20
mov dword [ebp - 0x20], 0x10
mov word [ebp - 0x1c], ax
mov word [ebp - 0x1a], bx
mov dword [ebp - 0x18], 0x616e6f74
mov dword [ebp - 0x14], 0x20
mov word [ebp - 0x10], ax
mov word [ebp - 0xe], bx
lea esi, [ebp - 0x50]
mov dword [ebp - 4], 6
push dword [esi - 4]
mov eax, dword [0x6b8268]
push dword [edi + 4]
call dword [eax + 0x120]
cmp word [esi + 6], bx
pop ecx
pop ecx
jne 0x43b460
mov ecx, dword [ebp - 8]
test dword [esi], ecx
je 0x43b460
push 1
pop ecx
jmp 0x43b462
xor ecx, ecx
movsx edx, word [esi + 4]
add edx, ecx
push dword [ebp + edx*4 - 0x64]
push eax
call fcn.0042fb65
pop ecx
add esi, 0xc
dec dword [ebp - 4]
pop ecx
jne 0x43b43b
pop edi
pop esi
pop ebx
leave
ret
Function at 0x43d304
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
push edi
push str.ColorDrop
push ebx
call dword [sym.imp.USER32.dll_GetPropA]
mov esi, eax
test esi, esi
je 0x43d405
cmp word [esi + 0x20], 0xffff
push 0x10
pop edi
jne 0x43d346
mov ecx, dword [esi + 0x1c]
xor eax, eax
movsx edx, ax
cmp dword [edx*4 + 0x679328], ecx
je 0x43d342
inc eax
cmp ax, di
jl 0x43d330
mov word [esi + 0x20], ax
mov eax, dword [esp + 0x14]
cmp eax, 0x25
ja 0x43d3fa
je 0x43d3c4
cmp eax, 8
jb 0x43d405
cmp eax, 9
jbe 0x43d390
cmp eax, 0xd
je 0x43d390
cmp eax, 0x1b
jne 0x43d405
push 0
push ebx
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esi + 0x28]
push dword [esi + 0x1c]
push 0
push dword [esi + 4]
call dword [esi + 0x24]
add esp, 0x10
jmp 0x43d48e
push 0
push ebx
call dword [sym.imp.USER32.dll_ShowWindow]
mov ax, word [esi + 0x20]
cmp ax, di
jne 0x43d3ad
push ebx
call fcn.0043d4ee
jmp 0x43d48d
push dword [esi + 0x28]
cmp ax, 0xffff
je 0x43d37d
movsx eax, ax
push dword [eax*4 + 0x679328]
push 1
jmp 0x43d382
mov ax, word [esi + 0x20]
cmp ax, di
jge 0x43d48e
push eax
push esi
call fcn.0043d704
pop ecx
pop ecx
mov cx, word [esi + 0x20]
push 4
movsx eax, cx
cdq
pop edi
idiv edi
test edx, edx
jne 0x43d3f0
add ecx, 3
jmp 0x43d3f1
dec ecx
mov word [esi + 0x20], cx
jmp 0x43d481
sub eax, 0x26
je 0x43d464
dec eax
je 0x43d438
dec eax
je 0x43d40d
push 1
pop eax
jmp 0x43d490
mov ax, word [esi + 0x20]
push eax
push esi
call fcn.0043d704
mov ax, word [esi + 0x20]
pop ecx
cmp ax, di
pop ecx
jne 0x43d42a
and word [esi + 0x20], 0
jmp 0x43d481
add eax, 4
cmp ax, di
mov word [esi + 0x20], ax
jle 0x43d481
jmp 0x43d47d
mov ax, word [esi + 0x20]
cmp ax, di
jge 0x43d48e
push eax
push esi
call fcn.0043d704
pop ecx
pop ecx
mov cx, word [esi + 0x20]
push 4
movsx eax, cx
inc eax
pop edi
cdq
idiv edi
test edx, edx
jne 0x43d461
add ecx, 0xfffffffd
jmp 0x43d3f1
inc ecx
jmp 0x43d3f1
mov ax, word [esi + 0x20]
push eax
push esi
call fcn.0043d704
add word [esi + 0x20], 0xfffc
cmp word [esi + 0x20], 0
pop ecx
pop ecx
jge 0x43d481
mov word [esi + 0x20], di
mov ax, word [esi + 0x20]
push eax
push esi
call fcn.0043d704
pop ecx
pop ecx
xor eax, eax
pop edi
pop esi
pop ebx
ret

Function at 0x43d494
Capabilities:
Hide graphical window

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
push str.ColorDrop
push edi
call dword [sym.imp.USER32.dll_GetPropA]
push 0
push edi
mov esi, eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ax, word [esi + 0x20]
cmp ax, 0x10
jne 0x43d4c4
push edi
call fcn.0043d4ee
pop ecx
jmp 0x43d4e9
push dword [esi + 0x28]
cmp ax, 0xffff
je 0x43d4db
movsx eax, ax
push dword [eax*4 + 0x679328]
push 1
jmp 0x43d4e0
push dword [esi + 0x1c]
push 0
push dword [esi + 4]
call dword [esi + 0x24]
add esp, 0x10
pop edi
xor eax, eax
pop esi
ret
Function at 0x43ebed
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x6196b0
call fcn.0044c384
push ecx
push ecx
mov eax, dword [0x679548]
push esi
mov dword [ebp - 0x14], eax
and dword [ebp - 4], 0
mov dword [ebp - 0x10], eax
mov ecx, dword [0x6b5470]
push 1
mov byte [ebp - 4], 1
call fcn.00411cfb
push 6
lea ecx, [ebp - 0x14]
mov esi, eax
call fcn.005fa867
push 7
lea ecx, [ebp - 0x10]
call fcn.005fa867
mov ecx, dword [0x6b5470]
push esi
call fcn.00411cfb
call fcn.006092e4
push dword [ebp - 0x10]
mov esi, dword [eax + 0xc]
push dword [ebp - 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x43ec7b
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x43ec7b
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [ebp + 8]
mov edx, dword [eax + 0x12]
push 1
mov dword [ecx], edx
mov eax, dword [eax + 0x16]
mov dword [ecx + 4], eax
pop esi
jmp 0x43ec8e
call fcn.006092e4
cmp esi, dword [eax + 0xc]
je 0x43ec8c
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor esi, esi
and byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.005f5a4b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.005f5a4b
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x43f521
Capabilities:
Check os version

Disassembly:
mov eax, 0x619782
call fcn.0044c384
sub esp, 0x1c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], esp
push dword [ebp + 0x1c]
mov esi, ecx
push ebx
mov dword [ebp - 0x14], esi
call fcn.005fa3c6
mov eax, dword [0x679548]
mov dword [ebp - 4], ebx
mov dword [esi + 0xb8], eax
lea edi, [esi + 0x5c]
push 0x58
push ebx
push edi
mov byte [ebp - 4], 1
mov dword [esi], 0x62ced8
mov dword [esi + 0x204], ebx
call fcn.0044cbc0
mov eax, dword [ebp + 8]
and byte [esi + 0xbc], bl
add esp, 0xc
mov dword [esi + 0xb4], eax
neg eax
sbb eax, eax
mov dword [esi + 0x200], ebx
add eax, 0x7005
mov dword [esi + 0x3c], eax
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov ebx, 0xff
mov byte [ebp - 4], 2
and eax, ebx
cmp eax, 5
sbb eax, eax
and al, 0xf4
add eax, 0x58
mov dword [edi], eax
call fcn.005989f0
mov dword [ebp - 0x18], eax
mov ecx, dword [eax]
mov dword [ebp - 0x20], ecx
lea ecx, [ebp - 0x20]
mov dword [eax], ecx
mov dword [ebp - 0x1c], 0x5989d1
push 0x10400
mov byte [ebp - 4], 3
call fcn.005a084f
pop ecx
mov dword [esi + 0x78], eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x20]
mov dword [esi + 0x7c], 0x103ff
mov dword [eax], ecx
jmp 0x43f60c
mov eax, dword [esi + 0x78]
mov edi, dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 4], 1
and byte [eax], 0
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x98], eax
lea eax, [esi + 0xbc]
mov dword [esi + 0x80], eax
mov eax, dword [ebp + 0x14]
or eax, 0x800020
mov dword [esi + 0x84], 0x3f
or dword [esi + 0x90], eax
call edi
and eax, ebx
cmp eax, 4
jb 0x43f667
or byte [esi + 0x92], 8
call fcn.006092e4
mov eax, dword [eax + 0xc]
mov dword [esi + 0x64], eax
call edi
and eax, ebx
cmp eax, 5
jb 0x43f677
or byte [esi + 0x92], 0x40
xor ebx, ebx
mov dword [esi + 0xa0], 0x43f452
cmp dword [ebp + 0x10], ebx
mov dword [esi + 0x9c], esi
je 0x43f69d
push dword [esi + 0x7c]
push dword [ebp + 0x10]
push dword [esi + 0x78]
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
cmp dword [ebp + 0x18], ebx
je 0x43f6d5
push dword [ebp + 0x18]
lea edi, [esi + 0xb8]
mov ecx, edi
call fcn.005f5bd4
push ebx
mov ecx, edi
call fcn.005f5e7b
push 0x7c
push eax
call fcn.0044d910
pop ecx
cmp eax, ebx
pop ecx
je 0x43f6d0
and byte [eax], 0
push 0x7c
inc eax
jmp 0x43f6bc
mov eax, dword [edi]
mov dword [esi + 0x68], eax
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 0x18
Function at 0x43ffe1
Capabilities:
Check os version

Disassembly:
mov eax, 0x619877
call fcn.0044c384
sub esp, 0x320
push ebx
xor ebx, ebx
push esi
push edi
mov dword [ebp - 0x1c], ebx
lea eax, [ebp + 0x14]
lea ecx, [ebp - 0x14]
push eax
mov dword [ebp - 4], 1
call fcn.005f57c0
mov byte [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_GetVersion]
and eax, 0xff
cmp eax, 5
jb 0x440115
cmp dword [ebp + 0xc], ebx
je 0x440115
mov esi, dword [ebp + 0x10]
cmp esi, ebx
je 0x440115
lea ecx, [ebp + 0x14]
call fcn.00614961
mov edi, eax
cmp edi, ebx
je 0x440115
push edi
call fcn.0043f3a5
cmp eax, ebx
pop ecx
je 0x44010e
push 0x103
push eax
lea eax, [ebp - 0x32c]
push eax
call fcn.0044edef
lea eax, [ebp - 0x32c]
mov word [ebp - 0x126], bx
push eax
call fcn.0043f3f5
add esp, 0x10
mov eax, dword [esi]
lea ecx, [ebp + 0x10]
mov dword [ebp + 0x10], ebx
push ebx
push ecx
lea ecx, [ebp - 0x32c]
push ebx
push ecx
push ebx
push ebx
push esi
call dword [eax + 0xc]
cmp dword [ebp + 0x10], ebx
je 0x44010e
mov eax, dword [esi]
lea ecx, [ebp - 0x124]
push ecx
push 0xa000
push dword [ebp + 0x10]
push esi
call dword [eax + 0x2c]
test eax, eax
jl 0x440102
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], ebx
push eax
lea eax, [ebp - 0x124]
push dword [ebp + 0x10]
push eax
call fcn.0043f224
add esp, 0xc
cmp dword [ebp - 0x10], ebx
je 0x440102
push dword [ebp - 0x10]
lea ecx, [ebp - 0x18]
call fcn.005f5b0b
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 3
call fcn.005f5b84
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 2
call fcn.005f5a4b
push dword [ebp - 0x10]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, dword [ebp + 0xc]
push dword [ebp + 0x10]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
push edi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x14]
push eax
call fcn.005f57c0
mov dword [ebp - 0x1c], 1
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.005f5a4b
lea ecx, [ebp + 0x14]
mov byte [ebp - 4], bl
call fcn.005f5a4b
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret