joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10010af0
Capabilities:
Enumerate devices by category

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x10018720
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push edi
mov edi, dword [esp + 0x34]
xor ebx, ebx
cmp edi, ebx
jge 0x10010b29
pop edi
xor al, al
pop ebx
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret 8
mov dword [esp + 8], ebx
lea eax, [esp + 8]
mov dword [esp + 0x2c], ebx
push eax
push 0x1001c89c
push 1
push ebx
push 0x1001c92c
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp eax, ebx
je 0x10010b78
mov eax, dword [esp + 8]
mov dword [esp + 0x2c], 0xffffffff
cmp eax, ebx
je 0x10010bc2
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
pop edi
xor al, al
pop ebx
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret 8
mov dword [esp + 0x34], ebx
mov eax, dword [esp + 8]
lea ecx, [esp + 0x34]
push ebx
push ecx
mov edx, dword [eax]
push 0x1001c91c
push eax
mov byte [esp + 0x3c], 1
call dword [edx + 0xc]
cmp eax, ebx
je 0x10010bd7
mov eax, dword [esp + 0x34]
mov byte [esp + 0x2c], bl
cmp eax, ebx
je 0x10010bac
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov eax, dword [esp + 8]
mov dword [esp + 0x2c], 0xffffffff
cmp eax, ebx
je 0x10010bc2
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
pop edi
xor al, al
pop ebx
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret 8
mov eax, dword [esp + 0x34]
push esi
push eax
mov edx, dword [eax]
call dword [edx + 0x14]
mov eax, dword [esp + 0x38]
lea edx, [esp + 0x14]
push edx
lea edx, [esp + 0x14]
mov ecx, dword [eax]
push edx
push 1
push eax
xor esi, esi
call dword [ecx + 0xc]
cmp edi, ebx
jl 0x10010c96
push ebp
mov ebp, dword [esp + 0x40]
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x40]
push edx
push 0x10019350
mov ecx, dword [eax]
push ebx
push ebx
push eax
call dword [ecx + 0x24]
cmp eax, ebx
jl 0x10010c6c
mov eax, dword [esp + 0x40]
lea edx, [esp + 0x1c]
push ebx
mov word [esp + 0x20], 8
mov ecx, dword [eax]
push edx
push str.FriendlyName
push eax
call dword [ecx + 0xc]
cmp eax, ebx
jne 0x10010c62
cmp esi, edi
jne 0x10010c57
mov eax, dword [esp + 0x14]
push ebp
push 0x1001c88c
push ebx
mov ecx, dword [eax]
push ebx
push eax
call dword [ecx + 0x20]
mov edx, dword [esp + 0x24]
push edx
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esp + 0x40]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esp + 0x14]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [esp + 0x3c]
lea edx, [esp + 0x18]
push edx
lea edx, [esp + 0x18]
mov ecx, dword [eax]
push edx
push 1
push eax
inc esi
call dword [ecx + 0xc]
cmp esi, edi
jle 0x10010c07
pop ebp
mov eax, dword [esp + 0x38]
mov byte [esp + 0x30], bl
cmp eax, ebx
pop esi
je 0x10010ca9
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 8]
mov dword [esp + 0x2c], 0xffffffff
cmp eax, ebx
je 0x10010cbf
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov ecx, dword [esp + 0x24]
pop edi
mov al, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x28
ret 8
Function at 0x100111c0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x34c
push ebp
push esi
mov esi, ecx
push 0x401
mov dword [esp + 0x18], esi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ebp, eax
add esp, 4
test ebp, ebp
je 0x100113a2
push ebx
push edi
mov ecx, 0x100
xor eax, eax
mov edi, ebp
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov byte [ebp], 0x77
mov eax, dword [esi + 0x18]
lea edi, [ebp + 1]
mov ecx, 0xb
mov esi, dword [eax + 8]
rep movsd dword es:[edi], dword [esi]
lea esi, [ebp + 0x2d]
lea ecx, [esp + 0x18]
push ecx
mov dword [esi], 0x1a21
add esi, 4
mov edi, esi
add esi, 2
push esi
mov byte [edi], 0
call fcn.10010500
mov byte [edi], al
mov ebx, dword [esp + 0x20]
mov dl, byte [0x100233ac]
add esp, 8
add esi, ebx
mov byte [edi + 1], dl
push 4
push 0x78766964
lea eax, [esi + 1]
push 0x63646976
mov byte [esi], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], eax
call dword [0x10022830]
mov ebx, eax
test ebx, ebx
je 0x100112bf
lea ecx, [esp + 0x124]
push 0x238
push ecx
push ebx
mov dword [esp + 0x130], 0x238
call sub.MSVFW32.dll_ICGetInfo
lea edx, [esp + 0x25c]
push 0x5c
push edx
call sub.MSVCRT.dll_wcsrchr
add esp, 8
test eax, eax
jne 0x100112a1
lea eax, [esp + 0x25c]
jmp 0x100112a4
add eax, 2
push str.Divx40.dll
push eax
call sub.MSVCRT.dll__wcsicmp
add esp, 8
test eax, eax
je 0x100112bf
push ebx
call dword [0x100226d8]
xor ebx, ebx
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x21]
mov byte [esp + 0x20], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x20]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [esp + 0x20]
push str.divx40.dll
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
test ebx, ebx
jne 0x10011339
lea edx, [esp + 0x20]
push edx
call fcn.10004500
add esp, 4
test al, al
je 0x10011358
push 2
lea eax, [esp + 0x24]
push ebx
push eax
push 0x78766964
push 0x63646976
call dword [0x10022824]
push 4
push 0x78766964
push 0x63646976
call dword [0x10022830]
mov ebx, eax
test ebx, ebx
je 0x10011358
push ebx
call dword [0x100226d8]
mov eax, dword [esp + 0x10]
mov ebx, 1
mov dword [eax], 0x78766964
add eax, 4
mov dword [esp + 0x10], eax
jmp 0x1001135c
mov ebx, dword [esp + 0x14]
push 4
push 0x64697678
push 0x63646976
call dword [0x10022830]
test eax, eax
je 0x10011384
push eax
call dword [0x100226d8]
mov ecx, dword [esp + 0x10]
inc ebx
mov dword [ecx], 0x64697678
mov ecx, dword [esp + 0x1c]
dec bl
push 0x401
push ebp
mov byte [esi], bl
call fcn.10008bd0
push ebp
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
pop edi
pop ebx
pop esi
pop ebp
add esp, 0x34c
ret
Function at 0x10446058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x104461a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x1044607e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1044606a
add dl, dl
jne 0x10446089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x104460dc
xor eax, eax
add dl, dl
jne 0x10446096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1044617d
add dl, dl
jne 0x104460a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104460b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104460bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104460c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x104460d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x10446075
mov eax, 1
add dl, dl
jne 0x104460ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104460f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x104460e1
sub eax, ebx
mov ebx, 1
jne 0x10446128
mov ecx, 1
add dl, dl
jne 0x1044610e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10446119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10446105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10446075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1044613f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1044614a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10446136
cmp eax, 0x7d00
jae 0x1044616d
cmp eax, 0x500
jb 0x10446168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10446075
cmp eax, 0x7f
ja 0x10446170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10446075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1044619e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x10446075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x68e3d2
Capabilities:
Encode data using xor

Disassembly:
inc esp
inc eax
arpl word [esi - 0x9f3ae52], sp
pop ds
in eax, dx
push ebp
xchg esp, eax
jne 0x68e400
salc
pop eax
rcr ch, cl
cld
and eax, 0xeb640ec
and byte [ebx], 0xaa
aaa
lcall 0xd9b7, 0x72e7b3f7
out 0x72, eax
mov bh, 0xd9
mov al, byte [0x42fbc5b8]
adc eax, 0xa7218209
xchg edi, eax
xor ebp, dword [esi - 0x3c]
adc eax, 0xb45e36f2
add esi, ebp
wait
inc ebx
add ah, byte [0x462f475a]
push ss
jns 0x68e40f
movsb byte es:[edi], byte [esi]
add edi, 0xd11ff766
and dh, dh
push esp
inc ecx
add al, byte [edi + 0x2142c358]
and bl, byte [esi - 0x4d]
mov ah, 0x93
neg dword [edi]
shl dword [eax], 1
not byte [ecx + eax*2 + 2]
xchg dword [eax - 0x3d], ebx
inc edx
and dword [edx], esp
pop esi
mov bl, 0xb4
xchg ebx, eax
outsb dx, byte [esi]
test dword [eax + 0x15], edi
push ss
nop
je 0x68e467
nop
outsb dx, byte [esi]
xchg dword [eax + 0x466f4699], ecx
xchg esi, eax
inc esp
div dword [edx]
push esi
jno 0x68e403
xchg ebx, eax
and edi, esi
push es
aad 0xcb
out 0x84, eax
test byte [edi - 0x6f], 0xa3
out dx, al
fnsave dword [ecx - 0x1d4bbc25]
test dh, dh
dec edi
xchg ecx, eax
mov dword [0xdbb1ddee], eax
inc ebx
mov ah, 0xe2
out 0x93, al
inc ebp
xchg ebx, eax
wait
push ss
je 0x68e475
salc
sub byte [edx + 0xd0cd3f4], bl
xchg ecx, eax
sbb al, 0x7b
xchg edi, eax
jg 0x68e437
sbb byte [eax + 0x4a], dh
in al, 0xe2
cmp dword [ebx + 0x49], ebx
push 0xe148f0e5
sahf
sub dword [esi - 0x59], ebp
push 0xb7d396b4
and dword [esi - 7], 0x21
ret 0xc7f8

Function at 0x770ed2
Capabilities:
Encode data using xor

Disassembly:
neg eax
fidiv dword [ebx + 0x51c1ec2b]
call 0xc303d294
cld
inc ecx
dec esi
sbb byte [ebx + 0x5e], dl
adc esp, ebp
mov bl, 0xf3
or esp, 0x6c
push esp
dec eax
mov ecx, dword [ebx + 0x6203b1e0]
aad 0xf4
add dword [edx - 0x3ad9ff83], edi
push ebx
and dword [esi + 0xe024e21], ebp
and dword [esi + 2], ecx
push cs
and dword [esi + 2], ecx
push cs
add eax, 0x93bc811a
popfd
add dword [esi + 0x207e13fe], 0x5f
pop edi
xor al, 0x65
cmpsd dword [esi], dword es:[edi]
mov dh, 0x48
in eax, dx
aas
xor ecx, ebp
xchg edx, eax
pushfd
lodsb al, byte [esi]
mov ebx, fs
pop ecx
fmul qword [edx - 0x14]
or dword fs:[esi + 0x7c], esi
les esi, [edi + ebx + 0x67fcc4ad]
pop edi
jns 0x770ea3
add esi, dword [esi]
push esi
cmp al, 0xc
or eax, 0x3082b6ac
jecxz 0x770f2f
xchg edx, eax
mov eax, dword [eax + 8]
push edx
outsd dx, dword cs:[esi]
std
and edi, dword [esi + 7]
pop edi
pop ds
test eax, 0x86795c73
iretd
mov bl, al
adc bl, byte [edi + ebx]
sbb al, 0xa4
add ebp, dword [esp + ecx*2 - 0x29]
into
xlatb
xchg dword [ecx + 0x62], esp
insb byte es:[edi], dx
push eax
ja 0x770ee2
fistp qword [eax - 0x4e]
int 0x83
movsd dword es:[edi], dword [esi]
arpl word [edx - 0x7d], bp
push 0xffffffffffffff83
add esi, dword [ebx - 0x5b]
mov edi, 0xfd9e3cd
in eax, dx
inc ebx
in eax, 0xa
cdq
xor dword [0x43bca80c], ebx
fimul word [eax + 1]
popfd
fild qword [ebp - 0x2d]
adc dword [ebx], 0xfffffff2
push esp
add byte [ebx - 0x24], bl
mov esp, 0xac886b44
and ecx, dword [esp + ebx*2 - 0x45]
dec esp
mov byte [0x5e53a7ac], al
jl 0x770f4a
xor edx, edi
pop esp
int3
Function at 0x401000
Capabilities:
Encode data using xor

Disassembly:
push ecx
pcmpeqw mm6, mm6
pxor mm7, mm7
push edx
psllw mm6, 0xf
push edi
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
movq mm1, qword [edx]
sub eax, 4
movq mm0, mm1
psrlq mm1, 0x20
jl 0x4010e4
jmp 0x401040
movq mm3, qword [edx + 8]
add edi, 8
punpckldq mm1, mm3
movq mm4, qword [ecx]
paddd mm0, mm1
pxor mm4, mm6
movq mm1, qword [edx + 0x10]
movq mm5, mm4
punpcklwd mm4, mm7
movq mm2, mm3
psrlq mm3, 0x20
paddd mm0, mm2
punpckldq mm3, mm1
psubd mm0, mm4
paddd mm2, mm1
punpckhwd mm5, mm7
paddd mm3, mm2
pslld mm4, 4
psubd mm3, mm5
pslld mm5, 4
psubd mm4, mm0
pcmpeqd mm7, mm7
psubd mm5, mm3
pslld mm7, 0x12
movq mm2, mm6
paddd mm4, mm7
psrld mm2, 0x1c
paddd mm5, mm7
movq mm3, mm2
psrld mm7, 0x1e
pand mm2, mm4
paddd mm4, mm7
psrld mm2, 3
pand mm3, mm5
paddd mm5, mm7
psrld mm3, 3
paddd mm4, mm2
paddd mm5, mm3
psrad mm4, 3
add edx, 0x10
psrad mm5, 3
add ecx, 8
packssdw mm4, mm5
movq mm0, mm1
pxor mm7, mm7
psrlq mm1, 0x20
sub eax, 4
movq qword [edi - 8], mm4
jge 0x401040
add eax, 4
jle 0x401185
movq mm3, qword [edx + 8]
punpckldq mm1, mm3
movq mm4, qword [ecx]
paddd mm0, mm1
pxor mm4, mm6
movq mm1, qword [edx + 0x10]
movq mm5, mm4
punpcklwd mm4, mm7
movq mm2, mm3
psrlq mm3, 0x20
paddd mm0, mm2
punpckldq mm3, mm1
psubd mm0, mm4
paddd mm2, mm1
punpckhwd mm5, mm7
pcmpeqd mm7, mm7
paddd mm3, mm2
pslld mm4, 4
psubd mm3, mm5
pslld mm5, 4
psubd mm4, mm0
pslld mm7, 0x12
psubd mm5, mm3
psrld mm6, 0x1c
paddd mm4, mm7
movq mm0, mm6
paddd mm5, mm7
psrld mm7, 0x1e
pand mm6, mm4
paddd mm4, mm7
psrld mm6, 3
pand mm0, mm5
paddd mm5, mm7
psrld mm0, 3
paddd mm4, mm6
paddd mm5, mm0
psrad mm4, 3
psrad mm5, 3
packssdw mm4, mm5
cmp eax, 2
jl 0x40117f
movd dword [edi], mm4
je 0x401185
psrlq mm4, 0x20
add edi, 4
movd edx, mm4
mov word [edi], dx
emms
pop edi
pop edx
pop ecx
ret

Function at 0x5ae34d
Capabilities:
Check for vm using instruction vpcext

Disassembly:
salc
sub dword [ebx - 0x5c], 0x728ed68c
mov dword [esi], edx
invalid
clc
or cl, ah
je 0x5ae335
movsb byte es:[edi], byte [esi]
les edx, [ecx - 0x24]
stosd dword es:[edi], eax
inc esp
pop ebp
test dh, bl
stosb byte es:[edi], al
push es
Function at 0x401d80
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ecx
cmp dword [0x5a1bfc], 0
push ebx
mov ebx, dword [0x5a1388]
jne 0x401e2d
push esi
push 0xa
push 0x11
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
je 0x401e2c
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push ebx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x401e2b
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push edi
push 0
mov ebx, eax
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push edi
push ebx
push eax
call fcn.0043e230
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea eax, [esp + 0xc]
push eax
push 1
push esi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
mov eax, dword [esp + 0xc]
test eax, eax
je 0x401e24
push eax
call fcn.004017c0
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
pop edi
pop esi
pop ebx
pop ecx
ret
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x404cd0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov eax, dword [ebx + 0x3c]
mov eax, dword [eax + ebx + 0x80]
sub esp, 0x1c
push ebp
push esi
add eax, ebx
cmp dword [eax + 0xc], 0
push edi
lea edi, [eax + 0xc]
je 0x404d28
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
mov ecx, dword [edi]
add ecx, ebx
push ecx
push 0x457538
call ebp
test eax, eax
jne 0x404d20
mov esi, dword [edi + 4]
add esi, ebx
cmp dword [esi], eax
je 0x404d20
lea ebx, [ebx]
mov edx, dword [esp + 0x2c]
cmp dword [esi], edx
je 0x404d31
add esi, 4
cmp dword [esi], 0
jne 0x404d10
add edi, 0x14
cmp dword [edi], 0
jne 0x404cf1
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x1c
ret
push 0x1c
lea eax, [esp + 0x10]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0xc]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea ecx, [esp + 0x20]
push ecx
push 0x40
push edx
push eax
call edi
push 4
push esi
call dword [sym.imp.KERNEL32.dll_IsBadWritePtr]
test eax, eax
jne 0x404d6b
mov dword [esi], 0x404ed0
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x10]
push edx
push eax
push ecx
call edi
mov eax, dword [esp + 0x2c]
pop edi
pop esi
pop ebp
add esp, 0x1c
ret
Function at 0x407110
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x10
push 1
push 0x11
call dword [sym.imp.GDI32.dll_GetStockObject]
push eax
mov eax, dword [edi]
push 0x30
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [edi]
push 5
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [esi + 4], 0
lea edx, [esi + 4]
mov dword [esi + 8], esi
je 0x40716d
mov ecx, dword [edx + 4]
test ecx, ecx
je 0x407169
mov edx, dword [ecx]
mov edx, dword [edx]
lea eax, [esp]
push eax
mov dword [esp + 0xc], 1
mov dword [esp + 0x10], 4
mov dword [esp + 4], 7
call edx
add esp, 0x10
ret
cmp dword [ebx + 0x24], 4
jne 0x407169
mov ecx, dword [ebx + 0x20]
add esp, 0x10
jmp fcn.004058d0

Function at 0x407200
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x44e767
mov eax, dword fs:[0]
push eax
mov eax, dword [0x46b070]
xor eax, esp
push eax
lea eax, [esp + 4]
mov dword fs:[0], eax
mov eax, dword [esp + 0x14]
xor ecx, ecx
mov dword [eax], vtable.autodlg::dialog_base.0
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], ecx
mov dword [esp + 0xc], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ecx
mov dword [eax + 0x24], ecx
mov byte [esp + 0xc], 1
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
mov dword [eax + 0x38], ecx
mov byte [esp + 0xc], 2
mov dword [eax + 0x44], ecx
mov dword [eax + 0x48], ecx
mov byte [esp + 0xc], 3
mov dword [eax + 0x4c], ecx
mov dword [eax + 0x50], ecx
mov byte [esp + 0xc], 4
mov dword [eax + 0x60], ecx
mov dword [eax + 0x54], ecx
mov dword [eax + 0x58], ecx
mov dword [eax + 0x5c], ecx
mov dword [esp + 0xc], 0xffffffff
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
pop ecx
add esp, 0xc
ret 4

Function at 0x407bb0
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x34
push ebx
lea eax, [esp + 4]
push eax
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x14]
push edx
push esi
call fcn.004077a0
lea ebx, [esi + 0xc]
call fcn.00405dc0
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
push 0
add ecx, eax
add edx, eax
mov eax, dword [esp + 0x40]
push 0
mov dword [esp + 0x24], ecx
push eax
lea ecx, [esp + 0x20]
push ecx
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x30], edx
call dword [sym.imp.USER32.dll_AdjustWindowRectEx]
mov edx, dword [esi + 0x60]
mov ecx, dword [esp + 0x1c]
sub ecx, dword [esp + 0x14]
mov eax, dword [esp + 8]
mov dword [esp + 0x28], edx
mov edx, dword [esp + 0x20]
sub edx, dword [esp + 0x18]
mov dword [esp + 0x30], ecx
mov dword [esp + 0x2c], eax
mov eax, dword [esi]
lea ecx, [esp + 0x24]
mov dword [esp + 0x34], edx
mov edx, dword [eax]
push ecx
mov ecx, esi
mov dword [esp + 0x28], 1
call edx
mov eax, dword [esi + 0x60]
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esi + 0x60]
push ecx
call dword [sym.imp.USER32.dll_UpdateWindow]
cmp dword [esi + 0x60], 0
pop ebx
setne al
add esp, 0x34
ret 4
Function at 0x408650
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x11c
mov eax, dword [0x46b070]
xor eax, esp
mov dword [esp + 0x118], eax
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x1c]
mov esi, dword [edi + 0x18]
mov ecx, dword [edi + 0x20]
mov edx, dword [edi + 0x24]
mov dword [esp + 0xc], eax
mov eax, dword [edi + 0x28]
mov dword [esp + 0x18], eax
mov eax, dword [edi + 0x14]
push eax
push esi
push 0x135
push eax
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], edx
call dword [sym.imp.USER32.dll_GetParent]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
test eax, eax
je 0x4086b7
push eax
lea ecx, [esp + 0x10]
push ecx
push esi
call dword [sym.imp.USER32.dll_FillRect]
mov ebx, dword [edi + 0x10]
test bl, 1
mov dword [esp + 0x1c], ebx
push 0xf
je 0x4086ce
push 0xa
lea edx, [esp + 0x14]
push edx
jmp 0x4086d5
push 5
lea eax, [esp + 0x14]
push eax
push esi
call dword [sym.imp.USER32.dll_DrawEdge]
mov edx, dword [edi + 0x14]
push 0x100
lea ecx, [esp + 0x24]
push ecx
push edx
call dword [sym.imp.USER32.dll_GetWindowTextA]
test bl, 4
je 0x408776
mov ebx, dword [sym.imp.GDI32.dll_SetTextColor]
push 0xf0f0f0
push esi
call ebx
lea eax, [esp + 0x20]
lea edi, [eax + 1]
mov edi, edi
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x408710
push 0x25
lea ecx, [esp + 0x10]
push ecx
sub eax, edi
mov edi, dword [sym.imp.USER32.dll_DrawTextA]
push eax
lea edx, [esp + 0x2c]
push edx
push esi
call edi
mov eax, 1
add dword [esp + 0x10], eax
add dword [esp + 0xc], eax
add dword [esp + 0x14], eax
add dword [esp + 0x18], eax
push 0x787878
push esi
call ebx
lea eax, [esp + 0x20]
lea ecx, [eax + 1]
mov dl, byte [eax]
add eax, 1
test dl, dl
jne 0x408755
push 0x25
sub eax, ecx
lea ecx, [esp + 0x10]
push ecx
push eax
lea edx, [esp + 0x2c]
push edx
push esi
call edi
mov ebx, dword [esp + 0x1c]
jmp 0x40879f
lea eax, [esp + 0x20]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x408780
push 0x25
lea ecx, [esp + 0x10]
push ecx
sub eax, edx
push eax
lea edx, [esp + 0x2c]
push edx
push esi
call dword [sym.imp.USER32.dll_DrawTextA]
test bl, 0x10
je 0x4087c5
mov eax, 3
add dword [esp + 0x10], eax
add dword [esp + 0xc], eax
sub dword [esp + 0x14], eax
sub dword [esp + 0x18], eax
lea eax, [esp + 0xc]
push eax
push esi
call dword [sym.imp.USER32.dll_DrawFocusRect]
mov ecx, dword [esp + 0x124]
pop edi
pop esi
pop ebx
xor ecx, esp
mov al, 1
call fcn.0043afb6
mov esp, ebp
pop ebp
ret
Function at 0x40d3a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push edi
push ebx
push ebp
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x40d3b7
pop edi
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x40d3e8
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, esi
and edi, 0xf
jbe 0x40d3e4
cmp esi, eax
jae 0x40d3e8
sub edi, 1
movzx ecx, word [esi]
lea esi, [esi + ecx*2 + 2]
jne 0x40d3d4
cmp esi, eax
jb 0x40d3ee
pop esi
pop edi
xor eax, eax
pop ebp
ret
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebp
ret

Function at 0x40d660
Capabilities:
Create thread
Extract resource via kernel32 functions

Disassembly:
sub esp, 0x104
mov eax, dword [0x46b070]
xor eax, esp
mov dword [esp + 0x100], eax
mov eax, dword [0x5a1388]
push ebx
mov ebx, dword [0x5a1bd4]
push 0xa
push 0x10
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
jne 0x40d6a7
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x100]
xor ecx, esp
call fcn.0043afb6
add esp, 0x104
ret
mov ecx, dword [0x5a1388]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40d68f
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push 0xff
push 0
push 0x5a1288
mov esi, eax
call fcn.0043e100
mov edx, dword [0x5a1388]
mov edi, dword [sym.imp.USER32.dll_LoadStringA]
add esp, 0xc
push 0xfe
push 0x5a1288
push 0x90
push edx
call edi
mov dword [0x59de58], 0x5a1288
cmp word [esi + 6], 0
je 0x40d70c
call fcn.00401d80
test ebx, ebx
jne 0x40d76e
movzx ecx, word [esi + 2]
mov ax, word [esi]
mov word [0x59c30c], cx
movsx ecx, cx
mov word [0x59c30a], ax
movsx eax, ax
lea edx, [ecx - 0x28]
add ecx, 0xffffffe2
mov dword [0x59dd4c], eax
mov dword [0x59dd60], eax
mov dword [0x59dd74], eax
mov dword [0x59dd50], edx
mov dword [0x59ddfc], ecx
movzx eax, word [esi + 4]
imul eax, eax, 0x3e8
push eax
push ebx
push 0x401ef0
mov dword [0x5a1bc4], 1
call fcn.0043ae71
add esp, 0xc
push 0xff
lea ecx, [esp + 0x10]
push 0
push ecx
call fcn.0043e100
mov eax, dword [0x5a1388]
add esp, 0xc
push 0xfe
lea edx, [esp + 0x10]
push edx
push 0x70
push eax
call edi
test ebx, ebx
pop edi
pop esi
je 0x40d7ab
lea ecx, [esp + 4]
push ecx
call fcn.0043b434
add esp, 4
jmp 0x40d7b4
lea ebx, [esp + 4]
call fcn.00401ff0
mov ecx, dword [esp + 0x104]
pop ebx
xor ecx, esp
mov eax, 1
call fcn.0043afb6
add esp, 0x104
ret