joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4047c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0xffffffffffffffff
push 0x4954e7
mov eax, dword fs:[0]
push eax
sub esp, 0x84
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4b8670]
xor eax, esp
push eax
lea eax, [esp + 0x98]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [esp + 0xa8]
mov eax, dword [esp + 0xac]
push 0x30
push eax
push 0x84
mov ecx, ebx
call fcn.004273e4
push 0x4011e0
push 0x4011a0
push 0x18
push 8
lea ecx, [ebx + 0x88]
xor ebp, ebp
mov dword [esp + 0xb0], ebp
push ecx
mov dword [ebx], vtable.ButtonPage.0
call fcn.0043a60b
mov dword [ebx + 0x160], ebp
mov dword [ebx + 0x164], ebp
mov dword [ebx + 0x168], ebp
push fcn.004012a0
push 0x401240
push 0x18
push 0x74
lea edx, [ebx + 0x16c]
push edx
mov byte [esp + 0xb4], 2
call fcn.0043a60b
lea esi, [ebx + 0xc4c]
mov byte [esp + 0xa0], 3
call fcn.00404020
mov byte [esp + 0xa0], 4
mov eax, edi
mov dword [ebx + 0x148], edi
mov dword [ebx + 0xd38], ebp
call fcn.0041b5c0
cmp byte [0xefa754], 0
mov ecx, dword [eax]
mov dword [ebx + 0x14c], ecx
mov edx, dword [eax + 4]
mov dword [ebx + 0x150], edx
mov ecx, dword [eax + 8]
mov dword [ebx + 0x154], ecx
mov edx, dword [eax + 0xc]
mov dword [ebx + 0x158], edx
jne 0x4049f0
mov dword [esp + 0x14], 0xefaae4
mov edi, 0x4c0ad0
jmp 0x4048e2
xor ebp, ebp
movzx eax, word [edi]
mov esi, dword [sym.imp.KERNEL32.dll_FindResourceW]
push 0xa
push eax
push ebp
call esi
cmp eax, ebp
je 0x4048ff
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebp, eax
movzx eax, word [edi]
push 0xa
push eax
push 0
call esi
test eax, eax
jne 0x404911
xor esi, esi
jmp 0x40491c
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
lea eax, [esp + 0x18]
push eax
call fcn.004068d0
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x18], vtable.ysl::storage::memory_streambuf.0
mov dword [esp + 0x54], esi
mov dword [esp + 0x58], ebp
mov dword [ecx], esi
mov edx, dword [esp + 0x3c]
mov dword [edx], esi
mov ecx, dword [esp + 0x4c]
lea eax, [esi + ebp]
sub eax, esi
mov dword [ecx], eax
mov edx, dword [esp + 0x28]
mov dword [edx], esi
mov ecx, dword [esp + 0x38]
mov dword [ecx], esi
mov edx, dword [esp + 0x48]
mov dword [edx], eax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x60]
push ecx
mov byte [esp + 0xa8], 5
call fcn.00406720
mov esi, dword [esp + 0x14]
lea edx, [esp + 0x5c]
push edx
mov ecx, esi
mov byte [esp + 0xa4], 6
call fcn.00403b70
mov byte [esp + 0xa0], 5
mov eax, dword [esp + 0x5c]
mov ecx, dword [eax + 4]
lea edx, [esp + 0x64]
mov dword [esp + ecx + 0x5c], vtable.std::basic_istream_char__struct_std::char_traits_char__.0
push edx
mov dword [esp + 0x68], vtable.std::ios_base.0
call fcn.00454cc6
mov byte [esp + 0xa4], 4
add esp, 4
lea ecx, [esp + 0x18]
mov dword [esp + 0x18], vtable.ysl::storage::memory_streambuf.0
call fcn.004069d0
add edi, 0xc
add esi, 0x3c
cmp edi, 0x4c0bf0
mov dword [esp + 0x14], esi
jl 0x4048e0
mov byte [0xefa754], 1
mov ecx, ebx
call fcn.00425e97
add eax, 4
and dword [eax], 0xffffffdf
mov eax, ebx
mov ecx, dword [esp + 0x98]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x90
ret 8
Function at 0x4068d0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x4941db
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4b8670]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, dword [esp + 0x24]
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.00454ab0
push 4
mov dword [esp + 0x20], 0
call fcn.0041cd13
mov edi, eax
add esp, 4
test edi, edi
je 0x406950
call fcn.004548c3
mov dword [edi], eax
call fcn.004546f7
push 0
lea ecx, [esp + 0x14]
mov ebx, eax
call fcn.004549ff
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x406945
add eax, 1
mov dword [ebx + 4], eax
lea ecx, [esp + 0x10]
call fcn.00454a20
jmp 0x406952
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4
Function at 0x40bd70
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x49514b
mov eax, dword fs:[0]
push eax
sub esp, 0x24c
mov eax, dword [0x4b8670]
xor eax, esp
mov dword [esp + 0x244], eax
push ebx
push esi
mov eax, dword [0x4b8670]
xor eax, esp
push eax
lea eax, [esp + 0x258]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push 0x100
lea ecx, [esp + 0x50]
push ecx
push eax
mov dword [esp + 0x1c], eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
je 0x40bebf
lea eax, [esp + 0x4c]
mov dword [esp + 0x48], 7
mov dword [esp + 0x44], 0
mov word [esp + 0x34], 0
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40bdf0
sub eax, edx
sar eax, 1
push eax
lea edx, [esp + 0x50]
push edx
lea esi, [esp + 0x38]
call fcn.004079e0
mov ebx, 8
mov eax, esi
mov dword [esp + 0x260], 0
call fcn.0040cde0
cmp eax, 0xffffffff
je 0x40beac
cmp dword [esp + 0x48], ebx
mov eax, dword [esp + 0x34]
jae 0x40be3c
lea eax, [esp + 0x34]
add eax, 0x10
call fcn.0040d9c0
mov ecx, dword [0xefb09c]
mov esi, eax
mov eax, dword [0xefb0a0]
push 0
add esi, 0x3980000
push eax
mov edx, esi
push ecx
shr edx, 0x10
push edx
call fcn.00402920
test eax, eax
je 0x40be72
push esi
call fcn.004028c0
jmp 0x40be74
xor eax, eax
lea ecx, [esp + 0x14]
push ecx
mov ecx, eax
call fcn.00402cf0
cmp dword [eax + 0x18], ebx
jb 0x40be8a
mov eax, dword [eax + 4]
jmp 0x40be8d
add eax, 4
mov edx, dword [esp + 0x10]
push eax
push edx
call dword [sym.imp.USER32.dll_SetWindowTextW]
cmp dword [esp + 0x2c], ebx
jb 0x40beac
mov eax, dword [esp + 0x18]
push eax
call fcn.0041cd43
add esp, 4
cmp dword [esp + 0x48], ebx
jb 0x40bebf
mov ecx, dword [esp + 0x34]
push ecx
call fcn.0041cd43
add esp, 4
mov ecx, dword [esp + 0x258]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x244]
xor ecx, esp
call fcn.0043a513
mov esp, ebp
pop ebp
ret
Function at 0x40f540
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4945a8
mov eax, dword fs:[0]
push eax
sub esp, 0x6c
mov eax, dword [0x4b8670]
xor eax, esp
mov dword [esp + 0x64], eax
push esi
push edi
mov eax, dword [0x4b8670]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x2c]
mov esi, ecx
mov ecx, dword [ebp + 0x28]
mov dword [esp + 0x20], eax
mov eax, dword [ebp + 0x24]
lea edi, [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x14], 0
call fcn.004027c0
lea ecx, [esp + 0x14]
push ecx
push ecx
push eax
lea edx, [ebp + 0x18]
push edx
lea eax, [ebp + 0xc]
push eax
lea edx, [esp + 0x48]
mov ecx, esi
mov dword [esp + 0x94], 0
call fcn.004103f0
add esp, 0x10
push eax
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x40]
push edx
call fcn.00455265
fstp qword [esp + 0x3c]
mov dword [esp + 0x90], 0xffffffff
mov edi, dword [esp + 0x34]
add esp, 0x10
test edi, edi
je 0x40f632
push 0
lea ecx, [esp + 0x2c]
call fcn.004549ff
mov eax, dword [edi + 4]
test eax, eax
jbe 0x40f610
cmp eax, 0xffffffff
jae 0x40f610
add eax, 0xffffffff
mov dword [edi + 4], eax
mov esi, dword [edi + 4]
neg esi
sbb esi, esi
not esi
lea ecx, [esp + 0x28]
and esi, edi
call fcn.00454a20
test esi, esi
je 0x40f632
mov eax, dword [esi]
mov edx, dword [eax]
push 1
mov ecx, esi
call edx
cmp byte [ebp + 0x14], 0
mov edi, dword [ebp + 0x10]
jne 0x40f677
test edi, edi
je 0x40f671
mov eax, dword [edi + 0x20]
cmp dword [eax], 0
je 0x40f656
mov ecx, dword [edi + 0x30]
cmp dword [ecx], 0
jle 0x40f656
mov edx, dword [eax]
movzx eax, word [edx]
jmp 0x40f662
mov eax, dword [edi]
mov edx, dword [eax + 0x10]
mov ecx, edi
call edx
movzx eax, ax
movzx eax, ax
cmp ax, 0xffff
je 0x40f671
mov word [ebp + 0x16], ax
jmp 0x40f673
xor edi, edi
mov byte [ebp + 0x14], 1
cmp byte [ebp + 0x20], 0
mov esi, dword [ebp + 0x1c]
jne 0x40f6af
test esi, esi
je 0x40f6ad
mov eax, dword [esi + 0x20]
cmp dword [eax], 0
je 0x40f69b
mov ecx, dword [esi + 0x30]
cmp dword [ecx], 0
jle 0x40f69b
mov edx, dword [eax]
movzx eax, word [edx]
jmp 0x40f6a7
mov eax, dword [esi]
mov edx, dword [eax + 0x10]
mov ecx, esi
call edx
movzx eax, ax
cmp ax, 0xffff
jne 0x40f6af
xor esi, esi
test edi, edi
jne 0x40f6d8
test esi, esi
je 0x40f6dc
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x34]
cmp dword [esp + 0x18], ecx
je 0x40f6e5
cmp dword [esp + 0x14], 0
jne 0x40f6e5
fld qword [esp + 0x2c]
mov edx, dword [esp + 0x1c]
fstp qword [edx]
jmp 0x40f6e8
test esi, esi
je 0x40f6b7
mov eax, dword [esp + 0x10]
or dword [eax], 1
jmp 0x40f6bb
or dword [eax], 2
mov eax, dword [esp + 0x20]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x14]
mov dword [eax], ecx
mov dword [eax + 4], edi
mov dword [eax + 8], edx
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.0043a513
mov esp, ebp
pop ebp
ret 0x28
Function at 0x40f720
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4945a8
mov eax, dword fs:[0]
push eax
sub esp, 0x6c
mov eax, dword [0x4b8670]
xor eax, esp
mov dword [esp + 0x64], eax
push esi
push edi
mov eax, dword [0x4b8670]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x2c]
mov esi, ecx
mov ecx, dword [ebp + 0x28]
mov dword [esp + 0x20], eax
mov eax, dword [ebp + 0x24]
lea edi, [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x14], 0
call fcn.004027c0
lea ecx, [esp + 0x14]
push ecx
push ecx
push eax
lea edx, [ebp + 0x18]
push edx
lea eax, [ebp + 0xc]
push eax
lea edx, [esp + 0x48]
mov ecx, esi
mov dword [esp + 0x94], 0
call fcn.004103f0
add esp, 0x10
push eax
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x40]
push edx
call fcn.00454f05
fstp qword [esp + 0x3c]
mov dword [esp + 0x90], 0xffffffff
mov edi, dword [esp + 0x34]
add esp, 0x10
test edi, edi
je 0x40f812
push 0
lea ecx, [esp + 0x2c]
call fcn.004549ff
mov eax, dword [edi + 4]
test eax, eax
jbe 0x40f7f0
cmp eax, 0xffffffff
jae 0x40f7f0
add eax, 0xffffffff
mov dword [edi + 4], eax
mov esi, dword [edi + 4]
neg esi
sbb esi, esi
not esi
lea ecx, [esp + 0x28]
and esi, edi
call fcn.00454a20
test esi, esi
je 0x40f812
mov eax, dword [esi]
mov edx, dword [eax]
push 1
mov ecx, esi
call edx
cmp byte [ebp + 0x14], 0
mov edi, dword [ebp + 0x10]
jne 0x40f857
test edi, edi
je 0x40f851
mov eax, dword [edi + 0x20]
cmp dword [eax], 0
je 0x40f836
mov ecx, dword [edi + 0x30]
cmp dword [ecx], 0
jle 0x40f836
mov edx, dword [eax]
movzx eax, word [edx]
jmp 0x40f842
mov eax, dword [edi]
mov edx, dword [eax + 0x10]
mov ecx, edi
call edx
movzx eax, ax
movzx eax, ax
cmp ax, 0xffff
je 0x40f851
mov word [ebp + 0x16], ax
jmp 0x40f853
xor edi, edi
mov byte [ebp + 0x14], 1
cmp byte [ebp + 0x20], 0
mov esi, dword [ebp + 0x1c]
jne 0x40f88f
test esi, esi
je 0x40f88d
mov eax, dword [esi + 0x20]
cmp dword [eax], 0
je 0x40f87b
mov ecx, dword [esi + 0x30]
cmp dword [ecx], 0
jle 0x40f87b
mov edx, dword [eax]
movzx eax, word [edx]
jmp 0x40f887
mov eax, dword [esi]
mov edx, dword [eax + 0x10]
mov ecx, esi
call edx
movzx eax, ax
cmp ax, 0xffff
jne 0x40f88f
xor esi, esi
test edi, edi
jne 0x40f8b8
test esi, esi
je 0x40f8bc
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x34]
cmp dword [esp + 0x18], ecx
je 0x40f8c5
cmp dword [esp + 0x14], 0
jne 0x40f8c5
fld qword [esp + 0x2c]
mov edx, dword [esp + 0x1c]
fstp qword [edx]
jmp 0x40f8c8
test esi, esi
je 0x40f897
mov eax, dword [esp + 0x10]
or dword [eax], 1
jmp 0x40f89b
or dword [eax], 2
mov eax, dword [esp + 0x20]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x14]
mov dword [eax], ecx
mov dword [eax + 4], edi
mov dword [eax + 8], edx
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.0043a513
mov esp, ebp
pop ebp
ret 0x28
Function at 0x40fb70
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x4941db
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4b8670]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, dword [esp + 0x24]
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.00454ab0
push 4
mov dword [esp + 0x20], 0
call fcn.0041cd13
mov edi, eax
add esp, 4
test edi, edi
je 0x40fbf0
call fcn.004548c3
mov dword [edi], eax
call fcn.004546f7
push 0
lea ecx, [esp + 0x14]
mov ebx, eax
call fcn.004549ff
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x40fbe5
add eax, 1
mov dword [ebx + 4], eax
lea ecx, [esp + 0x10]
call fcn.00454a20
jmp 0x40fbf2
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4
Function at 0x413110
Capabilities:
Create thread
Resume thread

Disassembly:
sub esp, 0x58
mov eax, dword [0x4b8670]
xor eax, esp
mov dword [esp + 0x50], eax
cmp dword [0xefa76c], 0
push esi
je 0x41325e
push 0x19054
call fcn.0041cd13
add esp, 4
test eax, eax
je 0x413148
mov esi, eax
call fcn.00412d80
mov esi, eax
jmp 0x41314a
xor esi, esi
xor eax, eax
mov dword [esp + 8], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov word [esp + 8], 0xfffe
mov ax, word [esi + 0x20]
mov word [esp + 0xa], ax
movzx eax, ax
shl eax, 4
cdq
and edx, 7
add eax, edx
sar eax, 3
movzx ecx, ax
mov word [esp + 0x14], ax
mov edx, dword [0x4aaba8]
mov eax, ecx
imul ecx, ecx, 0xc80
imul eax, eax, 0xbb80
mov dword [esp + 0x10], eax
mov eax, dword [0x4aabac]
mov dword [esp + 0x24], eax
mov eax, dword [0x4aabb4]
mov dword [esp + 0x2c], eax
xor eax, eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x38], ecx
mov dword [esp + 0x40], eax
lea ecx, [esp + 8]
mov dword [esp + 0x40], ecx
push 0
mov dword [esp + 0x24], edx
mov edx, dword [0x4aabb0]
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
lea ecx, [esi + 0x10]
push ecx
mov dword [esp + 0x44], eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], eax
mov eax, dword [0xefa764]
mov dword [esp + 0x30], edx
lea ecx, [esp + 0x38]
mov dword [esp + 0x14], 0xbb80
mov word [esp + 0x1e], 0x10
mov word [esp + 0x20], 0x16
mov word [esp + 0x22], 0x10
mov dword [esp + 0x24], 0x3f
mov dword [esp + 0x38], 0x24
mov dword [esp + 0x3c], 0x58020
mov edx, dword [eax]
mov edx, dword [edx + 0xc]
push ecx
push eax
call edx
test eax, eax
jge 0x413270
mov eax, dword [esi]
mov edx, dword [eax]
mov ecx, esi
call edx
xor eax, eax
pop esi
mov ecx, dword [esp + 0x50]
xor ecx, esp
call fcn.0043a513
add esp, 0x58
ret
lea eax, [esi + 0x19024]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0
push 0
push 0
push 0
mov dword [esi + 0x1903c], 1
call dword [sym.imp.KERNEL32.dll_CreateEventW]
test eax, eax
mov dword [esi + 0x19040], eax
jne 0x4132b9
mov edx, dword [esi]
mov eax, dword [edx]
mov ecx, esi
call eax
xor eax, eax
pop esi
mov ecx, dword [esp + 0x50]
xor ecx, esp
call fcn.0043a513
add esp, 0x58
ret
push 0x21
push 0
push eax
push 0
push 0x10
call dword [sym.imp.WINMM.dll_timeSetEvent]
lea ecx, [esi + 0x19048]
push ecx
push 4
push esi
push 0x413460
push 0
push 0
mov dword [esi + 0x1904c], eax
call fcn.0043b395
add esp, 0x18
test eax, eax
mov dword [esi + 0x19044], eax
je 0x41329f
push 0xf
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov ecx, dword [esi + 0x19044]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [esp + 0x54]
mov eax, esi
pop esi
xor ecx, esp
call fcn.0043a513
add esp, 0x58
ret
Function at 0x413ab0
Capabilities:
Create thread
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_FindResourceW]
push edi
push 0x4aae68
push 0xd2
push 0
call esi
mov edi, dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
push 0
mov dword [0x4d7040], eax
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [esp + 0x14], eax
mov eax, dword [0x4d7040]
push eax
push 0
call ebx
mov ebp, dword [sym.imp.KERNEL32.dll_LockResource]
push eax
mov dword [0x4d7054], eax
call ebp
push 0x4aae68
push 0xd5
push 0
mov dword [0x4d705c], eax
call esi
push eax
xor esi, esi
push esi
mov dword [0x4d7050], eax
call edi
mov ecx, dword [0x4d7050]
push ecx
push esi
call ebx
push eax
mov dword [0xed7064], eax
call ebp
push 0x413ff0
mov dword [0xefa24c], eax
call fcn.00474a90
add esp, 4
push esi
push 0x414070
call fcn.00479d90
push 0xa00000
push 0x4d7060
call fcn.00475560
push 0xefa77c
mov dword [0x4d7048], eax
call fcn.00470a90
fld dword [0x4ab7d0]
mov eax, dword [0x4d7048]
fstp dword [esp + 0x2c]
add esp, 0x14
push 0xefa77c
lea edx, [esp + 0x1c]
push edx
push eax
mov dword [esp + 0x28], 0x80
mov dword [esp + 0x30], 2
mov dword [esp + 0x2c], 6
call fcn.00457c20
add esp, 0xc
mov dword [0x4d7044], eax
call fcn.00412d40
test eax, eax
jne 0x413bcb
mov dword [0xefa788], 1
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [0xefa788], esi
call fcn.00412d60
cmp eax, esi
mov dword [0xefa784], eax
je 0x413bb9
mov ecx, dword [0x4d7044]
mov edx, dword [eax]
mov edx, dword [edx + 4]
push ecx
push 0x414010
mov ecx, eax
mov dword [0xefa788], esi
call edx
mov ecx, dword [0xefa784]
mov eax, dword [ecx]
mov edx, dword [eax + 8]
call edx
mov eax, dword [0x4d7044]
mov ecx, dword [0x4d7048]
push 0xefa77c
push str.Tutorial
push eax
push ecx
call fcn.0045bb70
mov edx, dword [0x4d7048]
push 0xefa77c
push edx
mov dword [0x4d704c], eax
call fcn.0045a070
mov ecx, dword [esp + 0x2c]
mov edx, dword [eax]
mov edx, dword [edx + 0x1c]
add esp, 0x18
push 0xefa77c
push ecx
mov ecx, dword [0x4d705c]
push ecx
mov ecx, eax
mov dword [0x4d7038], eax
call edx
mov ecx, dword [0x4d704c]
mov eax, dword [ecx]
mov edx, dword [0x4d7038]
mov eax, dword [eax + 4]
push 0xefa77c
push edx
call eax
mov ecx, dword [0x4d704c]
push 0xefa77c
push ecx
call fcn.0045d670
push 0xed7060
push esi
push esi
push 0x414040
push esi
push esi
mov dword [0x4d703c], eax
call fcn.0043b395
mov dword [0x4d7058], eax
call fcn.0047b750
push esi
push esi
call fcn.0047a290
push 0x231e4
push 0xed7068
push 2
call fcn.0047aea0
add esp, 0x34
pop edi
mov dword [0x4d7034], eax
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x415740
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x88
push ebx
push edi
push 0
push 0
push 0
push 0
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
lea edi, [esi + 0x10]
push edi
mov dword [esi + 4], eax
mov eax, dword [ebx]
mov ecx, dword [eax]
push 0x49cbd0
push ebx
call ecx
test eax, eax
jne 0x4157f3
mov eax, dword [ebp + 8]
mov ecx, dword [esi + 4]
shr eax, 2
lea edx, [eax + eax]
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], edx
lea eax, [eax + eax*2]
mov dword [esp + 0x28], eax
mov eax, dword [edi]
lea edx, [esp + 0x10]
push edx
xor ebx, ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x28], ecx
mov dword [esp + 0x30], ecx
mov ecx, dword [eax]
push 4
push eax
mov eax, dword [ecx + 0xc]
call eax
test eax, eax
jne 0x4157e7
lea ecx, [esp + 0xc]
push ecx
push ebx
push esi
push 0x4156e0
push ebx
push ebx
mov dword [esp + 0x24], ebx
mov byte [esi + 0xc], bl
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, ebx
mov dword [esi + 8], eax
je 0x4157e7
mov al, 1
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [edi]
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
mov dword [edi], ebx
mov ecx, dword [esi + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4161c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x7c
push ebx
mov ebx, ecx
cmp dword [ebx + 0xd4], 0
push esi
push edi
je 0x41634c
mov esi, dword [ebp + 8]
mov eax, dword [esi + 4]
mov ecx, dword [eax + 4]
push ecx
mov ecx, esi
mov dword [esp + 0x74], 0x1f40
mov dword [esp + 0x78], 0x2b11
mov dword [esp + 0x7c], 0x5622
mov dword [esp + 0x80], 0xac44
mov dword [esp + 0x84], 0xbb80
mov dword [esp + 0x88], 0x17700
call fcn.00417000
mov eax, dword [esi + 4]
mov dword [eax + 4], eax
mov eax, dword [esi + 4]
mov dword [esi + 8], 0
mov dword [eax], eax
mov eax, dword [esi + 4]
mov dword [eax + 8], eax
xor eax, eax
mov dword [esp + 0xc], eax
mov edi, dword [esp + eax*4 + 0x70]
cmp dword [ebx + 0x58], edi
ja 0x41632d
cmp edi, dword [ebx + 0x5c]
ja 0x41632d
mov eax, dword [ebx + 0x54]
test eax, 0x400
je 0x41628e
test eax, 0x100
je 0x41628e
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x44]
push eax
push esi
mov dword [esp + 0x1c], 1
mov dword [esp + 0x20], 8
mov dword [esp + 0x24], edi
call fcn.00416eb0
mov eax, dword [ebx + 0x54]
test eax, 0x400
je 0x4162c3
test eax, 0x200
je 0x4162c3
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x50]
push edx
push esi
mov dword [esp + 0x28], 2
mov dword [esp + 0x2c], 8
mov dword [esp + 0x30], edi
call fcn.00416eb0
mov eax, dword [ebx + 0x54]
test eax, 0x800
je 0x4162f8
test eax, 0x100
je 0x4162f8
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x5c]
push ecx
push esi
mov dword [esp + 0x34], 1
mov dword [esp + 0x38], 0x10
mov dword [esp + 0x3c], edi
call fcn.00416eb0
mov eax, dword [ebx + 0x54]
test eax, 0x800
je 0x41632d
test eax, 0x200
je 0x41632d
lea edx, [esp + 0x34]
push edx
lea eax, [esp + 0x68]
push eax
push esi
mov dword [esp + 0x40], 2
mov dword [esp + 0x44], 0x10
mov dword [esp + 0x48], edi
call fcn.00416eb0
mov eax, dword [esp + 0xc]
add eax, 1
cmp eax, 6
mov dword [esp + 0xc], eax
jb 0x416243
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 4