joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401bd0
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56a998
mov eax, dword fs:[0]
push eax
sub esp, 0xe8
mov eax, dword [0x5cd000]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 8
push eax
mov dword [ebp - 0x14], 0xff
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov ecx, edi
call fcn.00404500
push 0
call fcn.00405753
push 0xc
call fcn.0040652d
add esp, 8
mov dword [ebp - 0xf4], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x401c59
xorps xmm0, xmm0
mov ecx, eax
movq qword [eax], xmm0
mov dword [eax + 8], 0
call fcn.00406565
mov esi, eax
jmp 0x401c5b
xor esi, esi
push 0x57b9f4
mov dword [ebp - 4], 0xffffffff
call fcn.0040eea3
push str.Local_AppWizard_Generated_Applications
mov ecx, edi
call fcn.00412666
push 0xd8
lea eax, [ebp - 0xf0]
push 0
push eax
call fcn.0054e830
add esp, 0xc
lea ecx, [ebp - 0xf0]
push 0
push 0x66
call fcn.00417eda
mov dword [ebp - 4], 1
mov dword [ebp - 0xf0], 0x5ae7cc
call fcn.004187bb
call fcn.004187bb
push 0x80
mov eax, dword [eax + 0xc]
push eax
call dword [sym.imp.USER32.dll_LoadIconW]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0xf0]
mov dword [ebp - 4], 2
mov ecx, eax
mov dword [edi + 0x20], eax
call fcn.00412ecf
test esi, esi
je 0x401cee
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax + 4]
lea ecx, [ebp - 0x30]
call fcn.0041615d
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x3c], vtable.CBrush.0
call fcn.00402a80
lea ecx, [ebp - 0xf0]
call fcn.0041293f
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0054c83b
mov esp, ebp
pop ebp
ret

Function at 0x401f20
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov eax, edi
shr eax, 4
inc eax
push 6
movzx eax, ax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp + 0xc], eax
test eax, eax
jne 0x401f49
pop edi
pop ebx
pop ebp
ret
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x401f5f
xor esi, esi
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x401f56
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [esi + eax]
and edi, 0xf
jbe 0x401f92
nop
cmp esi, ecx
jae 0x401f56
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edi, 1
jne 0x401f80
cmp esi, ecx
jae 0x401f56
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x402040
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56a9f0
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5cd000]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edi, dword [ebp + 8]
push edi
mov dword [ebp - 4], 0
call fcn.0041497e
mov esi, eax
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x10], esi
test esi, esi
je 0x40216d
mov eax, edi
shr eax, 4
inc eax
push 6
movzx eax, ax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp + 8], eax
test eax, eax
je 0x40216d
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40216d
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x40216d
push dword [ebp + 8]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [esi + eax]
and edi, 0xf
jbe 0x4020f6
nop
cmp esi, ecx
jae 0x40216d
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edi, 1
jne 0x4020e0
cmp esi, ecx
jae 0x40216d
cmp word [esi], 0
je 0x40216d
mov eax, dword [ebx]
mov ecx, 1
movzx edi, word [esi]
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, edi
or ecx, eax
jge 0x40211e
push edi
mov ecx, ebx
call fcn.004027b0
movzx ecx, word [esi]
lea eax, [esi + 2]
push ecx
push eax
push edi
push dword [ebx]
call fcn.00554429
add esp, 0x10
cmp eax, 0x50
ja case.0x40213d.1
movzx eax, byte [eax + 0x4021a8]
jmp dword [eax*4 + 0x402198]
mov eax, dword [ebx]
cmp edi, dword [eax - 8]
jg 0x402188
mov dword [eax - 0xc], edi
xor ecx, ecx
mov eax, dword [ebx]
mov word [eax + edi*2], cx
lea eax, [ecx + 1]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
call fcn.004142f0
push 0x80070057
call fcn.00402860
call fcn.004142d6
nop
inc esp
and dword [eax], eax
and dword [ecx], 0x40
add byte [edx - 1845477343], dl
and dword [eax], eax
add byte [ebx], al
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add dword [ebx], eax
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add al, byte [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add al, byte [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add ah, cl
int3
Function at 0x402e00
Capabilities:
Accept command line arguments
Create process on windows
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56ab5b
mov eax, dword fs:[0]
push eax
sub esp, 0x45c
mov eax, dword [0x5cd000]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
mov dword [ebp - 4], 0
call fcn.004147a7
mov ecx, eax
mov dword [ebp - 4], 0xffffffff
test ecx, ecx
je 0x402fe3
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x414], eax
mov dword [ebp - 4], 1
test esi, esi
je 0x402ea1
test esi, 0xffff0000
jne 0x402e88
movzx eax, si
lea ecx, [ebp - 0x414]
push eax
call fcn.00402040
jmp 0x402eb0
mov ecx, esi
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x402e90
sub ecx, edx
sar ecx, 1
jmp 0x402ea3
xor ecx, ecx
push ecx
push esi
lea ecx, [ebp - 0x414]
call fcn.00402350
push str.._StiGlobal.ini
push 0
push str.ClassicMode
push str.General
mov dword [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
mov edx, str.BaseClassic.exe
mov ecx, str.BaseGray.exe
cmovne ecx, edx
push ecx
push str.Base.exe
lea ecx, [ebp - 0x414]
call fcn.004031b0
mov esi, dword [ebp - 0x414]
lea edx, [ebp - 0x210]
mov ecx, esi
sub edx, ecx
nop
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x402f00
xor ecx, ecx
movzx eax, word [ebp + ecx - 0x210]
lea ecx, [ecx + 2]
mov word [ebp + ecx - 0x412], ax
test ax, ax
jne 0x402f12
lea eax, [ebp - 0x468]
mov dword [ebp - 0x458], 0x44
push eax
lea eax, [ebp - 0x458]
xorps xmm0, xmm0
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x410]
movlpd qword [ebp - 0x454], xmm0
push eax
push 0
movlpd qword [ebp - 0x44c], xmm0
movlpd qword [ebp - 0x444], xmm0
movlpd qword [ebp - 0x43c], xmm0
movlpd qword [ebp - 0x434], xmm0
movlpd qword [ebp - 0x42c], xmm0
movlpd qword [ebp - 0x424], xmm0
movlpd qword [ebp - 0x41c], xmm0
movups xmmword [ebp - 0x468], xmm0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push 1
mov ecx, edi
call fcn.004130a7
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x402fc8
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0054c83b
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00402860
int3

Function at 0x403450
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
movzx eax, word [ebp + 8]
mov dword [ebp + 8], eax
pop ebp
jmp fcn.00412b33
Function at 0x405d91
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
xor edi, edi
mov eax, ecx
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], edi
je 0x405dd6
call fcn.004187bb
push 0xf0
push dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x405dd3
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x405e1d
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov eax, dword [ebp - 4]
push ebx
xor ebx, ebx
inc ebx
test edi, edi
je 0x405df9
mov ecx, dword [eax]
push dword [ebp + 0x10]
push edi
mov esi, dword [ecx + 0x20]
mov ecx, esi
push dword [ebp + 8]
call dword [0x57a9a4]
mov ecx, dword [ebp - 4]
call esi
mov ebx, eax
mov eax, dword [ebp + 8]
mov edi, dword [eax + 0x70]
test edi, edi
je 0x405e1a
mov edx, dword [edi]
push dword [ebp + 0x10]
mov esi, dword [edx + 0xa0]
mov ecx, esi
call dword [0x57a9a4]
mov ecx, edi
call esi
mov eax, ebx
pop ebx
pop edi
pop esi
leave
ret 0xc
Function at 0x4121aa
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x18
mov eax, 0x56b8ba
call fcn.0054cbb2
mov eax, ecx
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp + 0x10]
xor edi, edi
mov esi, dword [ebp + 0x14]
push edi
mov dword [ebx], edi
mov dword [esi], edi
cmp dword [eax + 0x58], edi
je 0x412252
push dword [ebp + 8]
call fcn.004124c9
mov dword [ebp - 0x10], eax
test eax, eax
je 0x4122d8
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], edi
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], edi
push ecx
push edi
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], edi
push ecx
push edi
push dword [ebp + 0xc]
mov dword [ebp - 0x14], edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp - 0x14]
mov dword [esi], ecx
test eax, eax
jne 0x41223b
push ecx
call fcn.0042641e
pop ecx
lea ecx, [ebp - 0x14]
mov dword [ebx], eax
push ecx
push eax
lea eax, [ebp - 0x18]
push eax
push edi
push dword [ebp + 0xc]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41223b
xor edi, edi
inc edi
jmp 0x412245
push dword [ebx]
call fcn.00426427
pop ecx
mov dword [ebx], edi
lea ecx, [ebp - 0x24]
call fcn.00412071
jmp 0x4122d6
mov eax, dword [eax]
push dword [ebp + 0xc]
push dword [ebp + 8]
mov esi, dword [eax + 0x84]
lea eax, [ebp - 0x10]
push eax
mov ecx, esi
call dword [0x57a9a4]
mov ecx, dword [ebp - 0x18]
call esi
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], 1
mov ecx, dword [eax - 0xc]
test ecx, ecx
je 0x4122ce
mov esi, dword [ebp + 0x14]
shr ecx, 1
push ecx
mov dword [esi], ecx
call fcn.0042641e
mov dword [ebx], eax
pop ecx
cmp dword [esi], edi
jbe 0x4122c8
lea esi, [edi + edi]
lea eax, [esi + 1]
push eax
lea ecx, [ebp - 0x10]
call fcn.0041204d
push esi
lea ecx, [ebp - 0x10]
mov bl, al
call fcn.0041204d
mov ecx, dword [ebp + 0x10]
shl bl, 4
sub bl, 0x51
add al, bl
mov ecx, dword [ecx]
mov byte [edi + ecx], al
inc edi
mov eax, dword [ebp + 0x14]
cmp edi, dword [eax]
jb 0x412296
mov eax, dword [ebp - 0x10]
xor edi, edi
inc edi
lea ecx, [eax - 0x10]
call fcn.00402680
mov eax, edi
call fcn.0054cb80
ret 0x10

Function at 0x4122e0
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
push edi
cmp dword [ecx + 0x58], esi
je 0x412333
push esi
push dword [ebp + 8]
call fcn.004124c9
mov edi, eax
test edi, edi
je 0x41232e
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp + 0xc]
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x41232e
mov eax, dword [ebp - 8]
jmp 0x412345
mov eax, dword [ebp + 0x10]
jmp 0x412345
push dword [ecx + 0x6c]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
pop edi
pop esi
leave
ret 0xc
Function at 0x41234b
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56b8e7
mov eax, dword fs:[0]
push eax
mov eax, 0x201c
call fcn.0054cd30
mov eax, dword [0x5cd000]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xor ebx, ebx
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x14]
mov dword [ebp - 0x201c], edi
mov dword [ebp - 0x2024], eax
cmp dword [ecx + 0x58], ebx
je 0x41247c
push ebx
push edx
call fcn.004124c9
mov ebx, eax
test ebx, ebx
jne 0x4123b3
push esi
jmp 0x4124a4
lea ecx, [ebp - 0x2014]
call fcn.00401e80
xor ecx, ecx
lea eax, [ebp - 0x2018]
push eax
push ecx
lea eax, [ebp - 0x2020]
mov dword [ebp - 4], ecx
push eax
push ecx
push dword [ebp - 0x2024]
mov dword [ebp - 0x2020], ecx
push ebx
mov dword [ebp - 0x2018], ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x201c], eax
test eax, eax
jne 0x41243b
mov eax, dword [ebp - 0x2018]
lea ecx, [ebp - 0x2014]
shr eax, 1
push eax
call fcn.00402810
lea ecx, [ebp - 0x2018]
push ecx
push eax
lea eax, [ebp - 0x2020]
push eax
push 0
push dword [ebp - 0x2024]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x2014]
mov dword [ebp - 0x201c], eax
call fcn.00412605
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x201c], 0
jne 0x412469
mov esi, dword [ebp - 0x2014]
add esi, 0xfffffff0
push esi
call fcn.00404150
pop ecx
add eax, 0x10
mov ecx, esi
mov dword [edi], eax
call fcn.00402680
jmp 0x4124ab
push esi
mov ecx, edi
call fcn.004035d0
mov ecx, dword [ebp - 0x2014]
lea ecx, [ecx - 0x10]
jmp 0x412462
test esi, esi
jne 0x412485
mov esi, 0x57adf8
push dword [ecx + 0x6c]
lea ecx, [ebp - 0x2010]
push 0x1000
push ecx
push esi
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x2010]
push eax
mov ecx, edi
call fcn.004035d0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0054c83b
leave
ret 0x10
Function at 0x412a9d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x84], 0
mov esi, dword [ebx + 0x8c]
mov edi, dword [ebx + 0x88]
je 0x412ae5
call fcn.004187bb
push 5
push dword [ebx + 0x84]
mov eax, dword [eax + 0xc]
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x412ae5
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x412af2
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
xor eax, eax
inc eax
test esi, esi
je 0x412b2e
mov edx, 0xffff
lea ecx, [esi + 0xc]
cmp word [esi + 2], dx
jne 0x412b11
movzx edi, word [esi + 0x12]
movzx edx, word [esi + 0x14]
jmp 0x412b1a
movzx edx, word [ecx]
mov ecx, esi
movzx edi, word [esi + 0xa]
test dword [ecx], 0x1801
jne 0x412b2c
test di, di
jne 0x412b2c
test dx, dx
je 0x412b2e
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x412b97
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, ecx
call fcn.004187bb
push 5
push dword [ebp + 8]
mov esi, dword [eax + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x412bd7
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x412bd7
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push dword [ebp + 0xc]
mov ecx, edi
push eax
call fcn.00412bdf
jmp 0x412bd9
xor eax, eax
pop edi
pop esi
pop ebp
ret 8
Function at 0x412ecf
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x24
mov eax, 0x56b960
call fcn.0054cc1b
mov edi, ecx
mov dword [ebp - 0x24], edi
mov ebx, dword [edi + 0x8c]
mov esi, dword [edi + 0x88]
mov dword [ebp - 0x18], ebx
call fcn.004187bb
cmp dword [edi + 0x84], 0
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x20], eax
je 0x412f2e
call fcn.004187bb
push 5
push dword [edi + 0x84]
mov ebx, dword [eax + 0xc]
push ebx
mov dword [ebp - 0x20], ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x412f42
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, dword [ebp - 0x18]
mov esi, eax
test esi, esi
je 0x412f3e
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov dword [ebp - 0x18], eax
test ebx, ebx
jne 0x412f4a
or eax, 0xffffffff
jmp 0x41309c
mov ecx, edi
call fcn.004134d9
mov ebx, eax
mov dword [ebp - 0x2c], ebx
call fcn.0041a0e6
xor esi, esi
and dword [ebp - 0x1c], esi
and dword [ebp - 0x28], esi
mov dword [ebp - 0x14], esi
test ebx, ebx
je 0x412fd6
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp ebx, eax
je 0x412fd6
push ebx
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x412fd6
push esi
push ebx
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [ebp - 0x14], 1
call fcn.0040386b
mov esi, eax
mov dword [ebp - 0x1c], esi
test esi, esi
je 0x412fd3
mov ecx, dword [esi]
mov esi, dword [ecx + 0x150]
mov ecx, esi
call dword [0x57a9a4]
mov ecx, dword [ebp - 0x1c]
call esi
test eax, eax
je 0x412fd3
mov esi, dword [ebp - 0x1c]
mov ecx, esi
call fcn.0042094f
test eax, eax
je 0x412fd3
push 0
mov ecx, esi
call fcn.0042026d
mov dword [ebp - 0x28], 1
mov esi, dword [ebp - 0x14]
and dword [ebp - 4], 0
push edi
call fcn.00419d69
push ebx
call fcn.0041b466
push dword [ebp - 0x20]
mov ecx, edi
push eax
push dword [ebp - 0x18]
call fcn.00412e72
test eax, eax
jne 0x41301f
cmp dword [edi + 0x9c], eax
jne 0x41301f
call fcn.004187bb
push ebx
mov eax, dword [eax + 8]
mov dword [ebp - 0x20], eax
call fcn.0041b466
push dword [ebp - 0x20]
mov ecx, edi
push eax
push dword [ebp - 0x18]
call fcn.00412e72
and dword [edi + 0x9c], 0
jmp 0x41304a
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x28], 0
je 0x41305e
mov ecx, dword [ebp - 0x1c]
push 1
call fcn.0042026d
test esi, esi
je 0x41306b
push 1
push ebx
call dword [sym.imp.USER32.dll_EnableWindow]
test ebx, ebx
je 0x413081
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [edi + 0x20]
jne 0x413081
push ebx
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [edi]
mov esi, dword [eax + 0x60]
mov ecx, esi
call dword [0x57a9a4]
mov ecx, edi
call esi
mov ecx, edi
call fcn.00413490
mov eax, dword [edi + 0x68]
call fcn.0054cb80
ret
Function at 0x41b3f9
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
xor esi, esi
mov ebx, ecx
push edi
cmp dword [ebp + 8], esi
je 0x41b438
call fcn.004187bb
push 0xf0
push dword [ebp + 8]
mov edi, dword [eax + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x41b438
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x41b440
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
push esi
mov ecx, ebx
call fcn.0049d330
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x41be3c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
je 0x41bec8
cmp dword [esi + 0x20], 0
je 0x41bec8
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x41bec8
cmp dword [ebp + 8], 0
je 0x41bec8
xor edi, edi
mov ebx, edi
call fcn.004187bb
push 0x57d790
push dword [ebp + 8]
mov eax, dword [eax + 0xc]
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 8], eax
test eax, eax
je 0x41beac
mov ebx, dword [ebp - 4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp - 8]
mov edi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x41bec8
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
push edi
push ebx
push esi
call fcn.004a6dbd
mov edi, eax
add esp, 0xc
test edi, edi
je 0x41bec4
mov ecx, esi
call fcn.0041bbda
mov eax, edi
jmp 0x41beca
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x42080f
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x56ad4b
call fcn.0054cbb2
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x74], ebx
jne 0x420835
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x42088f
lea ecx, [ebp - 0x10]
call fcn.00401e80
mov edi, dword [edi + 0x74]
lea ecx, [ebp - 0x10]
push ecx
mov dword [ebp - 4], ebx
mov eax, dword [edi]
mov esi, dword [eax + 0x8c]
mov ecx, esi
call dword [0x57a9a4]
mov ecx, edi
call esi
mov esi, dword [ebp + 8]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push esi
call fcn.0055525a
push eax
call fcn.00401fb0
add esp, 0x14
test esi, esi
je 0x420882
push esi
call fcn.005545d6
pop ecx
mov ebx, eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00402680
mov eax, ebx
call fcn.0054cb80
ret 8
Function at 0x421a70
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov edx, ecx
xor eax, eax
mov ecx, dword [ebp + 8]
inc eax
push edi
xor edi, edi
mov dword [ebp - 8], edx
inc edi
mov dword [ebp - 4], eax
lea ebx, [ecx + 0xc]
cmp dword [ecx + 8], edi
jle 0x421aec
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x421ab1
mov eax, dword [edx + 0x10]
cmp dword [eax + edi*8 + 4], esi
je 0x421ab1
mov eax, dword [ebx]
cmp dword [eax + edi*4], 0
je 0x421adf
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x421ae2
mov eax, dword [ebx]
mov eax, dword [eax + edi*4]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x421ad9
mov eax, dword [eax]
push 1
mov esi, dword [eax]
mov ecx, esi
call dword [0x57a9a4]
mov ecx, dword [ebp - 0xc]
call esi
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 8]
mov esi, dword [ebp + 0xc]
mov eax, dword [ebx]
and dword [eax + edi*4], 0
mov eax, dword [ebp - 4]
inc edi
cmp edi, dword [ecx + 8]
jl 0x421a95
test eax, eax
je 0x421b33
lea esi, [edx + 0x1c]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [ebp - 8]
mov edi, dword [ebp + 8]
add ecx, 0x14
push edi
call fcn.00421d64
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [edi]
push 1
mov esi, dword [eax]
mov ecx, esi
call dword [0x57a9a4]
mov ecx, edi
call esi
mov eax, dword [ebp - 8]
push 0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
pop esi
pop ebx
leave
ret 8