joyce8/EMBER2024-capa huggingface dataset:
Function at 0x449748
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
test byte [esi + 0x1c], 0x10
je 0x449794
mov eax, esi
call fcn.00431724
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x449794
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x250], 0
je 0x449794
mov ecx, ebx
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x250]
mov edx, esi
mov edi, dword [eax]
call dword [edi + 0x24]
test al, al
jne 0x4498d3
mov eax, dword [ebx]
cmp eax, 0x100
jb 0x4497d4
cmp eax, 0x108
ja 0x4497d4
mov eax, esi
call fcn.00431724
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4498ca
mov ecx, ebx
mov edx, esi
mov eax, dword [ebp - 0x14]
mov edi, dword [eax]
call dword [edi + 0xf0]
test al, al
jne 0x4498d3
jmp 0x4498ca
mov eax, dword [ebx]
cmp eax, 0x200
jb 0x4498b3
cmp eax, 0x20a
ja 0x4498b3
test byte [esi + 0x50], 0x80
jne 0x449806
sub eax, 0x203
je 0x449803
sub eax, 3
je 0x449803
sub eax, 3
jne 0x449806
sub dword [ebx], 2
mov eax, dword [ebx]
sub eax, 0x200
je 0x44981a
dec eax
je 0x44982f
dec eax
je 0x44984c
dec eax
je 0x44982f
jmp 0x449853
mov ecx, ebx
mov eax, dword [0x46e98c]
mov eax, dword [eax]
mov edx, esi
call fcn.0043ad4c
jmp 0x4498ca
cmp byte [esi + 0x5d], 1
jne 0x449845
mov eax, esi
mov si, 0xffed
call fcn.0040336c
jmp 0x4498d3
or word [esi + 0x54], 1
jmp 0x4498ca
and word [esi + 0x54], 0xfffe
jmp 0x4498ca
mov eax, dword [0x46fbb0]
cmp byte [eax + 0x20], 0
je 0x4498ca
mov eax, dword [0x46fbb0]
cmp dword [eax + 0x1c], 0
je 0x4498ca
mov eax, dword [ebx]
mov edx, dword [0x46fbb0]
cmp eax, dword [edx + 0x1c]
jne 0x4498ca
lea eax, [ebp - 0x114]
push eax
call sub.user32.dll_GetKeyboardState
mov eax, dword [ebx]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
call fcn.00431668
mov byte [ebp - 0xc], al
mov ax, word [ebx + 4]
mov word [ebp - 0xa], ax
mov eax, dword [ebx + 8]
mov dword [ebp - 8], eax
lea edx, [ebp - 0x10]
mov eax, esi
mov si, 0xffc9
call fcn.0040336c
jmp 0x4498d3
cmp eax, 0xb00b
jne 0x4498ca
mov edx, dword [ebx + 8]
push edx
mov ecx, dword [ebx + 4]
mov edx, eax
mov eax, esi
call fcn.004480b0
mov edx, ebx
mov eax, esi
mov ecx, dword [eax]
call dword [ecx - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44cd54
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x1f8], 0
je 0x44cd70
cmp dword [esi + 4], 0
je 0x44cd9d
test byte [ebx + 0x55], 1
jne 0x44cd8f
mov eax, ebx
call fcn.0044b960
test eax, eax
jne 0x44cd8f
mov edx, esi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx - 0x10]
jmp 0x44cead
mov edx, esi
mov eax, ebx
call fcn.0044c878
jmp 0x44cead
push 0
call sub.user32.dll_GetDC
mov edi, eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push edi
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [ebp - 8], eax
push edi
push 0
call sub.user32.dll_ReleaseDC
push 0
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x44cea6
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.0044ebfc
push eax
call sub.user32.dll_BeginPaint
mov edi, eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 4]
mov edx, 0x14
mov eax, ebx
call fcn.0044967c
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
mov edx, esi
mov eax, ebx
call fcn.0044cd54
xor eax, eax
mov dword [esi + 4], eax
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 4]
push eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push 0
push 0
push edi
call sub.gdi32.dll_BitBlt
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.0044ebfc
push eax
call sub.user32.dll_EndPaint
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44cead
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_DeleteDC
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_DeleteObject
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x453354
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [0x46eb10]
cmp byte [eax + 0xc], 0
je 0x4534c1
push 0x8000
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4534ba
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x46fc04], 0
jne 0x4533a8
push 0x4534c8
call sub.kernel32.dll_GetModuleHandleA_2
mov ebx, eax
push 0x4534d0
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x46fc04], eax
cmp dword [0x46dd6c], 0
jne 0x4534a3
push 0x4534e0
call sub.kernel32.dll_LoadLibraryA
mov dword [0x46dd6c], eax
cmp dword [0x46dd6c], 0
je 0x4534a3
push 0x4534ec
mov eax, dword [0x46dd6c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x46fc08], eax
push 0x4534fc
mov eax, dword [0x46dd6c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x46fc0c], eax
push 0x453510
mov eax, dword [0x46dd6c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x46fc10], eax
push 0x453528
mov eax, dword [0x46dd6c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x46fc14], eax
push 0x453540
mov eax, dword [0x46dd6c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x46fc18], eax
push 0x453554
mov eax, dword [0x46dd6c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x46fc1c], eax
push 0x45356c
mov eax, dword [0x46dd6c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x46fc20], eax
push 0x453584
mov eax, dword [0x46dd6c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x46fc24], eax
push 0x4535a0
mov eax, dword [0x46dd6c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x46fc28], eax
push 0x4535ac
mov eax, dword [0x46dd6c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x46fc2c], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4534c1
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
pop ebx
pop ecx
pop ebp
ret
Function at 0x45bdf8
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x45be26
mov eax, ebx
call fcn.0045c8ac
cmp dword [ebx + 0x40], 0
je 0x45be1f
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x45be97
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x45be89
cmp dword [ebx + 8], 0
je 0x45be48
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x45be5a
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x45be89
cmp dword [ebx + 8], 0
je 0x45be3b
cmp eax, 3
je 0x45be6d
dec eax
jne 0x45be3b
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x45be3b
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x45be3b
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x45beb5
cmp dword [ebx + 0x14], 0xcc
je 0x45beb5
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.0045bec0
pop ebx
ret
Function at 0x40c2f0
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x114
push ebx
push ebp
mov ebp, dword [esp + 0x120]
push esi
push edi
mov dword [esp + 0x14], 0x104
mov dword [esp + 0x10], 0
xor ebx, ebx
lea eax, [esp + 0x18]
lea ecx, [esp + 0x14]
push eax
push 0
push 0
push 0
lea edx, [esp + 0x30]
push ecx
push edx
push ebx
push ebp
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov esi, eax
test esi, esi
jne 0x40c378
mov edi, str.HIDVid_3689Pid_8762
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + 0x24]
push ecx
push eax
push str.HIDVid_3689Pid_8762
mov dword [esp + 0x20], 0xc8
call fcn.0040b5d0
add esp, 0xc
test eax, eax
jne 0x40c378
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x12c]
cmp ecx, eax
je 0x40c38a
mov eax, ecx
inc eax
mov dword [esp + 0x10], eax
inc ebx
test esi, esi
je 0x40c313
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x114
ret
mov edi, str.__
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [esp + 0x130]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x24]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x114
ret
Function at 0x40e330
Capabilities:
Hash data with md5

Disassembly:
xor eax, eax
push 0x40
push eax
push 0x442b2c
mov dword [0x442b18], eax
mov dword [0x442b14], eax
mov dword [0x442b1c], 0x67452301
mov dword [0x442b20], 0xefcdab89
mov dword [0x442b24], 0x98badcfe
mov dword [0x442b28], 0x10325476
call fcn.0040eec0
add esp, 0xc
mov byte [0x442b2c], 0x80
ret

Function at 0x40ef40
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0xc
xor eax, eax
xor ecx, ecx
mov cl, byte [eax + 0x429af8]
inc eax
cmp eax, 0x38
mov dl, byte [ecx + 0x442f34]
mov byte [eax + 0x442efb], dl
jl 0x40ef45
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x10], 0
mov dword [esp + 0x18], 0x442bfc
mov eax, dword [esp + 0x10]
mov ecx, dword [0x442efc]
and ecx, 0xff
xor edx, edx
mov al, byte [eax + 0x429ae8]
mov dl, byte [0x442efd]
mov ebp, eax
xor esi, esi
and ebp, 0xff
mov eax, ebp
neg eax
lea edi, [eax + 0x1c]
test edi, edi
jle 0x40efca
lea ebx, [ebp + 0x442efc]
mov dword [esp + 0x14], ebx
mov ebx, dword [esp + 0x14]
inc esi
mov bl, byte [ebx]
mov byte [esi + 0x442efb], bl
mov ebx, dword [esp + 0x14]
inc ebx
cmp esi, edi
mov dword [esp + 0x14], ebx
jl 0x40efb0
mov esi, dword [esp + 0x10]
cmp byte [esi + 0x429ae8], 2
jne 0x40efe5
mov byte [0x442f16], cl
mov byte [0x442f17], dl
jmp 0x40efeb
mov byte [0x442f17], cl
mov edx, dword [0x442f18]
mov ecx, 0x1c
lea esi, [eax + 0x38]
and edx, 0xff
xor ebx, ebx
cmp esi, ecx
mov bl, byte [0x442f19]
jle 0x40f020
lea ebp, [ebp + 0x442f18]
mov al, byte [ebp]
mov byte [ecx + 0x442efc], al
inc ecx
inc ebp
cmp ecx, esi
jl 0x40f011
mov ecx, dword [esp + 0x10]
cmp byte [ecx + 0x429ae8], 2
jne 0x40f03b
mov byte [0x442f32], dl
mov byte [0x442f33], bl
jmp 0x40f041
mov byte [0x442f33], dl
mov ecx, dword [esp + 0x18]
xor eax, eax
xor edx, edx
mov dl, byte [eax + 0x429b30]
inc eax
cmp eax, 0x30
mov dl, byte [edx + 0x442efc]
mov byte [ecx + eax - 1], dl
jl 0x40f047
mov esi, dword [esp + 0x10]
add ecx, 0x30
inc esi
cmp ecx, 0x442efc
mov dword [esp + 0x10], esi
mov dword [esp + 0x18], ecx
jl 0x40ef73
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x40f2b0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
sub esp, 0x20
mov eax, edx
push ebx
push esi
and eax, 0x80000007
push edi
jns 0x40f2c8
dec eax
or eax, 0xfffffff8
inc eax
jne 0x40f48b
mov al, byte [esp + 0x44]
test al, al
je 0x40f2de
cmp al, 1
jne 0x40f48b
mov bl, byte [esp + 0x40]
cmp bl, 1
je 0x40f2ef
test bl, bl
jne 0x40f48b
mov ecx, dword [esp + 0x3c]
test ecx, ecx
je 0x40f302
mov esi, dword [ecx]
mov ecx, dword [ecx + 4]
mov dword [esp + 0x14], esi
jmp 0x40f308
xor ecx, ecx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x38]
test al, al
mov esi, dword [ecx]
mov dword [esp + 0x1c], esi
mov esi, dword [ecx + 4]
mov dword [esp + 0x20], esi
mov esi, dword [ecx + 8]
mov dword [esp + 0x24], esi
mov ecx, dword [ecx + 0xc]
mov dword [esp + 0x28], ecx
jne 0x40f3e0
test edx, edx
jle 0x40f48b
mov esi, dword [esp + 0x30]
lea edi, [edx + 7]
shr edi, 3
cmp bl, 1
jne 0x40f361
xor eax, eax
mov dl, byte [esi + eax]
mov cl, byte [esp + eax + 0x14]
xor dl, cl
mov byte [esp + eax + 0xc], dl
inc eax
cmp eax, 8
jl 0x40f34c
jmp 0x40f370
mov eax, esi
mov ecx, dword [eax]
mov dword [esp + 0xc], ecx
mov edx, dword [eax + 4]
mov dword [esp + 0x10], edx
lea eax, [esp + 0x1c]
push 1
lea ecx, [esp + 0x10]
push eax
lea edx, [esp + 0x14]
push ecx
push edx
call fcn.0040f0c0
lea eax, [esp + 0x34]
push 0xffffffffffffffff
lea ecx, [esp + 0x20]
push eax
lea edx, [esp + 0x24]
push ecx
push edx
call fcn.0040f0c0
lea eax, [esp + 0x3c]
push 1
lea ecx, [esp + 0x30]
push eax
lea edx, [esp + 0x34]
push ecx
push edx
call fcn.0040f0c0
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x40]
add esp, 0x30
mov dword [esi], eax
cmp bl, 1
mov dword [esi + 4], ecx
jne 0x40f3cf
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ecx
add esi, 8
dec edi
jne 0x40f345
pop edi
pop esi
pop ebx
add esp, 0x20
ret
cmp al, 1
jne 0x40f48b
test edx, edx
jle 0x40f48b
mov esi, dword [esp + 0x30]
lea edi, [edx + 7]
shr edi, 3
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov dword [esp + 0xc], eax
lea edx, [esp + 0x1c]
mov dword [esp + 0x10], ecx
push 0xffffffffffffffff
lea eax, [esp + 0x10]
push edx
lea ecx, [esp + 0x14]
push eax
push ecx
call fcn.0040f0c0
lea edx, [esp + 0x34]
push 1
lea eax, [esp + 0x20]
push edx
lea ecx, [esp + 0x24]
push eax
push ecx
call fcn.0040f0c0
lea edx, [esp + 0x3c]
push 0xffffffffffffffff
lea eax, [esp + 0x30]
push edx
lea ecx, [esp + 0x34]
push eax
push ecx
call fcn.0040f0c0
add esp, 0x30
cmp bl, 1
jne 0x40f474
xor eax, eax
mov dl, byte [esp + eax + 0x14]
mov cl, byte [esp + eax + 0xc]
xor cl, dl
mov byte [esp + eax + 0xc], cl
inc eax
cmp eax, 8
jl 0x40f453
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ecx
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
mov dword [esi], edx
mov dword [esi + 4], eax
add esi, 8
dec edi
jne 0x40f3fa
pop edi
pop esi
pop ebx
add esp, 0x20
ret
Function at 0x411b20
Capabilities:
Check os version

Disassembly:
sub esp, 0x94
push 0x94
lea eax, [esp + 4]
push 0
push eax
call fcn.004030b0
add esp, 0xc
lea ecx, [esp]
push ecx
mov dword [esp + 4], 0x94
call dword [sym.imp.KERNEL32.DLL_GetVersionExA]
mov eax, dword [esp + 4]
cmp eax, 4
jne 0x411b7b
mov eax, dword [esp + 8]
cmp eax, 0xa
je 0x411b6f
cmp eax, 0x5a
je 0x411b6f
mov eax, 0x421ea4
add esp, 0x94
ret
mov eax, 0x421ea3
add esp, 0x94
ret
cmp eax, 5
mov eax, 0x421ea4
je 0x411b8a
mov eax, str.Local_
add esp, 0x94
ret

Function at 0x412ec0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x18]
mov eax, dword [ebx]
mov ecx, dword [ebx + 4]
push edi
mov edi, dword [esp + 0x20]
test edi, edi
mov dword [esp + 8], eax
mov dword [esp + 0xc], ecx
jbe 0x412f3a
add edi, 0xffffffff
push ebp
mov ebp, dword [esp + 0x18]
lea edx, [esp + 0xc]
shr edi, 3
push esi
mov esi, dword [esp + 0x20]
sub ebx, edx
add edi, 1
push 1
lea eax, [esp + 0x14]
push eax
push esi
push ebp
call fcn.004135d0
mov ecx, dword [esi]
mov edx, dword [esi + 4]
mov dword [esp + 0x20], ecx
add esp, 0x10
mov dword [esp + 0x14], edx
lea eax, [esp + 0x10]
mov ecx, 8
mov edi, edi
mov dl, byte [ebx + eax]
xor byte [eax], dl
add eax, 1
sub ecx, 1
jne 0x412f20
add ebp, 8
add esi, 8
sub edi, 1
jne 0x412ef7
pop esi
pop ebp
pop edi
pop ebx
add esp, 8
ret

Function at 0x412f40
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x18]
mov eax, dword [ebx]
mov ecx, dword [ebx + 4]
push edi
mov edi, dword [esp + 0x20]
test edi, edi
mov dword [esp + 8], eax
mov dword [esp + 0xc], ecx
jbe 0x412fba
add edi, 0xffffffff
push ebp
mov ebp, dword [esp + 0x1c]
lea edx, [esp + 0xc]
shr edi, 3
push esi
mov esi, dword [esp + 0x1c]
sub ebx, edx
add edi, 1
push 1
lea eax, [esp + 0x14]
push eax
push ebp
push esi
call fcn.004135d0
mov ecx, dword [esi]
mov edx, dword [esi + 4]
mov dword [esp + 0x20], ecx
add esp, 0x10
mov dword [esp + 0x14], edx
lea eax, [esp + 0x10]
mov ecx, 8
mov edi, edi
mov dl, byte [ebx + eax]
xor byte [eax], dl
add eax, 1
sub ecx, 1
jne 0x412fa0
add esi, 8
add ebp, 8
sub edi, 1
jne 0x412f77
pop esi
pop ebp
pop edi
pop ebx
add esp, 8
ret
Function at 0x416a50
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
push 0xf00021
mov edx, dword [esi + 4]
mov ecx, dword [esi]
mov eax, dword [esi + 0xc]
sub eax, edx
push eax
mov eax, dword [esi + 8]
sub eax, ecx
push eax
push edx
push ecx
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.GDI32.dll_PatBlt]
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov ebx, eax
lea eax, [eax + 5]
add eax, 3
and eax, 0xfffffffc
call fcn.00402c90
mov dword [ebp - 4], esp
cmp dword [ebp - 4], 0
je 0x416b1b
add ebx, 2
mov eax, dword [ebp - 4]
push ebx
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
je 0x416b1b
mov bx, 0x140
mov edi, dword [ebp + 0x14]
mov eax, edi
and al, 0xf
cmp al, 0xc
je 0x416ace
mov ebx, edi
and bx, 0xf
or bx, 0x150
test edi, 0x80
je 0x416ad9
or bh, 8
and edi, 0x8000000
je 0x416af4
mov eax, dword [0x44e47c]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
movzx eax, bx
push eax
push esi
push 0xffffffffffffffff
push ecx
push edx
call dword [sym.imp.USER32.dll_DrawTextA]
test edi, edi
je 0x416b1b
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x416ef0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
sub esp, 4
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
push ebp
push 2
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
mov edi, eax
test edi, edi
jne 0x416f1b
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push edi
push esi
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
mov ebx, eax
push edi
push esi
call dword [sym.imp.KERNEL32.DLL_LoadResource]
mov esi, eax
test esi, esi
jne 0x416f3f
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push ebx
push 0x40
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov ebp, eax
test ebp, ebp
jne 0x416f5a
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
mov edi, ebp
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x20]
xor ecx, ecx
mov cl, ah
mov edx, eax
mov dword [esp + 0x10], 0
shl ecx, 8
shr edx, 0x10
mov byte [esp + 0x10], dl
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x28]
or ecx, edx
mov edx, eax
shr edx, 0x10
mov dword [ebp + 0x28], ecx
mov dword [esp + 0x10], 0
xor ecx, ecx
mov byte [esp + 0x10], dl
mov cl, ah
xor edx, edx
shl ecx, 8
mov dl, al
shl edx, 0x10
or ecx, dword [esp + 0x10]
or ecx, edx
mov eax, dword [esp + 0x24]
mov edx, eax
mov dword [ebp + 0x44], ecx
shr edx, 0x10
xor ecx, ecx
mov dword [esp + 0x10], 0
mov cl, ah
mov byte [esp + 0x10], dl
shl ecx, 8
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x2c]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x48], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x30]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x64], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x34]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x54], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
push 0
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
or ecx, edx
mov dword [ebp + 0x50], ecx
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
push 0
push ebp
lea ecx, [ebp + 0x68]
push ecx
push 4
push ebp
push edi
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
mov esi, eax
push edi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
push ebp
call dword [sym.imp.KERNEL32.DLL_GlobalFree]
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
Function at 0x41b570
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x41b5b2
call fcn.0041e4dc
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
cmp eax, edi
je 0x41b5b2
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_LoadResource]
cmp eax, edi
jne 0x41b5a9
xor eax, eax
jmp 0x41b5ba
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0041b5c0
pop edi
pop esi
pop ebx
ret 4

Function at 0x41ebb8
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x41ebe6
push dword [esi]
call dword [sym.imp.KERNEL32.DLL_TlsGetValue]
test eax, eax
je 0x41ec04
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0041eb1e
jmp 0x41ec04
mov eax, dword [esi + 0x14]
test eax, eax
je 0x41ec04
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0041eb1e
test edi, edi
mov eax, edi
jne 0x41ebee
pop edi
push ebx
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x100115e0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [0x1014e914]
cmp dword [esi], 0
je 0x10011625
mov eax, dword [esi + 4]
cmp eax, 2
je 0x1001160a
cmp eax, 3
je 0x1001160a
cmp eax, 4
je 0x1001160a
cmp eax, 5
jne 0x1001161d
push str.StartButtonType
push dword [esi]
call fcn.100dc721
add esp, 8
test eax, eax
je 0x10011677
add esi, 0x60
cmp dword [esi], 0
jne 0x100115f3
xor bl, bl
xor esi, esi
test bl, bl
je 0x10011712
mov dx, word [0x10159320]
test dx, dx
jne 0x1001165c
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov ecx, eax
shr eax, 8
movzx edx, al
movzx eax, cl
shl ax, 8
or dx, ax
mov word [0x10159320], dx
mov eax, 0x602
cmp dx, ax
jae 0x100116d6
call dword [sym.imp.UxTheme.dll_IsAppThemed]
neg eax
pop esi
sbb eax, eax
inc eax
pop ebx
mov esp, ebp
pop ebp
ret
push 0x10158d3c
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockShared]
mov eax, dword [esi + 0x30]
test eax, eax
je 0x1001168e
mov ecx, dword [eax + 0x20]
jmp 0x10011691
mov ecx, dword [esi + 0x20]
shr ecx, 0xc
test cl, 1
je 0x100116c1
test eax, eax
je 0x100116a2
mov eax, dword [eax + 0x20]
jmp 0x100116a5
mov eax, dword [esi + 0x20]
shr eax, 0xd
test al, 1
jne 0x100116c1
mov esi, dword [esi + 0x40]
mov bl, 1
push 0x10158d3c
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockShared]
jmp 0x10011629
mov esi, dword [esi + 0x40]
xor bl, bl
push 0x10158d3c
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockShared]
jmp 0x10011629
push 0
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0xc
push eax
push 0xc
xorps xmm0, xmm0
push 0x42
movq qword [ebp - 8], xmm0
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
test eax, eax
je 0x1001170a
test byte [ebp - 8], 1
je 0x1001170a
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret