joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47bb40
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x68000]
push edi
jmp 0x47bb5a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x47bb61
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x47bb50
mov eax, 1
add ebx, ebx
jne 0x47bb73
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x47bb84
jne 0x47bba3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x47bba3
dec eax
add ebx, ebx
jne 0x47bb90
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x47bb68
add ebx, ebx
jne 0x47bb9f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x47bbf5
xor ecx, ecx
sub eax, 3
jb 0x47bbbb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x47bc2a
sar eax, 1
mov ebp, eax
jmp 0x47bbc6
add ebx, ebx
jne 0x47bbc6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x47bb94
inc ecx
add ebx, ebx
jne 0x47bbd4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x47bb94
add ebx, ebx
jne 0x47bbe1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x47bbd6
jne 0x47bbf2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x47bbd6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x47bc14
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x47bc06
jmp 0x47bb56
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x47bc14
add edi, ecx
jmp 0x47bb56
pop esi
mov edi, esi
mov ecx, 0x12c3
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x47bc32
cmp byte [edi], 6
jne 0x47bc32
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x47bc37
lea edi, [esi + 0x79000]
mov eax, dword [edi]
or eax, eax
je 0x47bcaf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x7b524]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x7b620]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x47bc64
mov ecx, edi
jns 0x47bc93
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x7b628]
or eax, eax
je 0x47bca9
mov dword [ebx], eax
add ebx, 4
jmp 0x47bc81
call dword [esi + 0x7b624]
mov ebp, dword [esi + 0x7b62c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x47bce3
sub esp, 0xffffff80
jmp 0x42047a
Function at 0x402e40
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59e827
mov eax, dword fs:[0]
push eax
sub esp, 0x70
mov eax, dword [0x60ce80]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 8
push eax
mov dword [ebp - 0x14], 0xff
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov ecx, esi
call fcn.0040f91f
call fcn.00412798
test eax, eax
jne 0x402ea5
push 0xffffffffffffffff
push eax
push 0x64
call fcn.00412955
xor eax, eax
jmp 0x403029
push 0
call fcn.00412fe4
add esp, 4
push 5
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
push 0
mov ecx, esi
call fcn.00411e25
push 0x5e6b5c
mov ecx, esi
call fcn.004124a9
push 4
mov ecx, esi
call fcn.0040fa52
mov ecx, esi
call fcn.00410f47
mov ecx, esi
call fcn.00410f94
mov ecx, esi
call fcn.0041102f
movaps xmm0, xmmword [0x5ea120]
lea eax, [ebp - 0x4c]
push eax
push 0x5b293c
push 0xffff
mov ecx, 0x616d10
mov dword [ebp - 0x3c], 1
movups xmmword [ebp - 0x4c], xmm0
mov dword [ebp - 0x38], 1
mov dword [ebp - 0x30], 0xc8
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x34], 1
call fcn.00410f33
mov ecx, eax
call fcn.004142f2
push 0x8c
call fcn.004126ad
mov edi, eax
add esp, 4
mov dword [ebp - 0x7c], edi
mov dword [ebp - 4], 0
test edi, edi
je 0x402fae
push 0x8c
push 0
push edi
call fcn.005785e0
add esp, 0xc
mov ecx, edi
push 0x5e7148
push 0x5e89bc
push 0x5e6ff8
push 0x80
call fcn.00415b00
jmp 0x402fb0
xor eax, eax
mov dword [ebp - 4], 0xffffffff
test eax, eax
je 0x402e9e
push eax
mov ecx, esi
call fcn.00415f47
push 0x2c
lea eax, [ebp - 0x78]
push 0
push eax
call fcn.005785e0
add esp, 0xc
lea ecx, [ebp - 0x78]
call fcn.0040eb3c
lea eax, [ebp - 0x78]
mov dword [ebp - 4], 1
push eax
mov ecx, esi
call fcn.0040fc2d
lea eax, [ebp - 0x78]
mov ecx, esi
push eax
call fcn.0041619f
test eax, eax
jne 0x403004
xor esi, esi
jmp 0x40301f
mov ecx, dword [esi + 0x20]
push 5
call fcn.004172e7
mov eax, dword [esi + 0x20]
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_UpdateWindow]
mov esi, 1
lea ecx, [ebp - 0x78]
call fcn.0040ed01
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00573f01
mov esp, ebp
pop ebp
ret

Function at 0x405ff0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
movzx eax, word [ebp + 8]
mov dword [ebp + 8], eax
pop ebp
jmp fcn.00417af3
Function at 0x4061b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov eax, edi
shr eax, 4
inc eax
push 6
movzx eax, ax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp + 0xc], eax
test eax, eax
jne 0x4061d9
pop edi
pop ebx
pop ebp
ret
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4061ef
xor esi, esi
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4061e6
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [esi + eax]
and edi, 0xf
jbe 0x406222
nop
cmp esi, ecx
jae 0x4061e6
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edi, 1
jne 0x406210
cmp esi, ecx
jae 0x4061e6
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x406280
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov edi, dword [ebp + 8]
push edi
mov dword [ebp - 4], ecx
call fcn.00419922
mov ebx, eax
test ebx, ebx
jne 0x4062a0
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, edi
shr eax, 4
push esi
inc eax
push 6
movzx eax, ax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp + 8], eax
test eax, eax
je 0x406387
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x406387
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x406387
push dword [ebp + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [esi + eax]
and edi, 0xf
jbe 0x406308
cmp esi, ecx
jae 0x406387
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edi, 1
jne 0x4062f2
cmp esi, ecx
jae 0x406387
cmp word [esi], 0
je 0x406387
movzx eax, word [esi]
lea ecx, [esi + 2]
push 0
push 0
push 0
push 0
push eax
push ecx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
test edi, edi
js 0x406392
mov ebx, dword [ebp - 4]
mov edx, 1
mov ecx, dword [ebx]
sub edx, dword [ecx - 4]
mov ecx, dword [ecx - 8]
sub ecx, edi
or edx, ecx
jge 0x406350
push edi
mov ecx, ebx
call fcn.004067c0
movzx eax, word [esi]
push 0
push 0
push edi
push dword [ebx]
push eax
lea eax, [esi + 2]
push eax
push 0
push 3
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, dword [ebx]
cmp edi, dword [eax - 8]
jg 0x406392
mov dword [eax - 0xc], edi
mov eax, dword [ebx]
pop esi
mov byte [edi + eax], 0
mov eax, 1
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop esi
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.004068b0
int3
Function at 0x411f68
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x18
mov eax, 0x59fd6d
call fcn.005744c3
mov eax, ecx
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp + 0x10]
xor edi, edi
mov esi, dword [ebp + 0x14]
push edi
mov dword [ebx], edi
mov dword [esi], edi
cmp dword [eax + 0x58], edi
je 0x412010
push dword [ebp + 8]
call fcn.00412285
mov dword [ebp - 0x10], eax
test eax, eax
je 0x412097
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], edi
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], edi
push ecx
push edi
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], edi
push ecx
push edi
push dword [ebp + 0xc]
mov dword [ebp - 0x14], edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [ebp - 0x14]
mov dword [esi], ecx
test eax, eax
jne 0x411ff9
push ecx
call fcn.004bc86d
pop ecx
lea ecx, [ebp - 0x14]
mov dword [ebx], eax
push ecx
push eax
lea eax, [ebp - 0x18]
push eax
push edi
push dword [ebp + 0xc]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x411ff9
xor edi, edi
inc edi
jmp 0x412003
push dword [ebx]
call fcn.004126e5
pop ecx
mov dword [ebx], edi
lea ecx, [ebp - 0x24]
call fcn.00411e0b
jmp 0x412095
mov eax, dword [eax]
push dword [ebp + 0xc]
push dword [ebp + 8]
mov esi, dword [eax + 0x84]
lea eax, [ebp - 0x10]
push eax
mov ecx, esi
call dword [0x5b1a70]
mov ecx, dword [ebp - 0x18]
call esi
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], 1
mov ecx, dword [eax - 0xc]
test ecx, ecx
je 0x41208d
mov esi, dword [ebp + 0x14]
shr ecx, 1
push ecx
mov dword [esi], ecx
call fcn.004bc86d
mov dword [ebx], eax
pop ecx
cmp dword [esi], edi
jbe 0x412087
lea esi, [edi + edi]
lea eax, [esi + 1]
push eax
lea ecx, [ebp - 0x10]
call fcn.00411db0
push esi
lea ecx, [ebp - 0x10]
lea ebx, [eax - 1]
shl bl, 4
sub bl, 0x41
call fcn.00411db0
mov ecx, dword [ebp + 0x10]
add al, bl
mov ecx, dword [ecx]
mov byte [edi + ecx], al
inc edi
mov eax, dword [ebp + 0x14]
cmp edi, dword [eax]
jb 0x412054
mov eax, dword [ebp - 0x10]
xor edi, edi
inc edi
lea ecx, [eax - 0x10]
call fcn.004066a0
mov eax, edi
call fcn.00574491
ret 0x10

Function at 0x41209f
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
push edi
cmp dword [ecx + 0x58], esi
je 0x4120f2
push esi
push dword [ebp + 8]
call fcn.00412285
mov edi, eax
test edi, edi
je 0x4120ed
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp + 0xc]
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x4120ed
mov eax, dword [ebp - 8]
jmp 0x412104
mov eax, dword [ebp + 0x10]
jmp 0x412104
push dword [ecx + 0x6c]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
pop edi
pop esi
leave
ret 0xc
Function at 0x41210a
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59fd9a
mov eax, dword fs:[0]
push eax
mov eax, 0x101c
call fcn.00574670
mov eax, dword [0x60ce80]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xor ebx, ebx
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x14]
mov dword [ebp - 0x101c], edi
mov dword [ebp - 0x1024], eax
cmp dword [ecx + 0x58], ebx
je 0x412238
push ebx
push edx
call fcn.00412285
mov ebx, eax
test ebx, ebx
jne 0x412172
push esi
jmp 0x412260
lea ecx, [ebp - 0x1014]
call fcn.00406150
xor ecx, ecx
lea eax, [ebp - 0x1018]
push eax
push ecx
lea eax, [ebp - 0x1020]
mov dword [ebp - 4], ecx
push eax
push ecx
push dword [ebp - 0x1024]
mov dword [ebp - 0x1020], ecx
push ebx
mov dword [ebp - 0x1018], ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x101c], eax
test eax, eax
jne 0x4121f7
push dword [ebp - 0x1018]
lea ecx, [ebp - 0x1014]
call fcn.00406820
lea ecx, [ebp - 0x1018]
push ecx
push eax
lea eax, [ebp - 0x1020]
push eax
push 0
push dword [ebp - 0x1024]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 0xffffffffffffffff
lea ecx, [ebp - 0x1014]
mov dword [ebp - 0x101c], eax
call fcn.004123c1
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x101c], 0
jne 0x412225
mov esi, dword [ebp - 0x1014]
add esi, 0xfffffff0
push esi
call fcn.0040f444
pop ecx
add eax, 0x10
mov ecx, esi
mov dword [edi], eax
call fcn.004066a0
jmp 0x412267
push esi
mov ecx, edi
call fcn.0040ddd0
mov ecx, dword [ebp - 0x1014]
lea ecx, [ecx - 0x10]
jmp 0x41221e
test esi, esi
jne 0x412241
mov esi, 0x5e6e08
push dword [ecx + 0x6c]
lea ecx, [ebp - 0x1010]
push 0x1000
push ecx
push esi
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x1010]
push eax
mov ecx, edi
call fcn.0040ddd0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00573f01
leave
ret 0x10
Function at 0x4124dd
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0x10]
xor ebx, ebx
push edi
mov edi, ecx
cmp dword [edi + 0x58], ebx
je 0x412525
push ebx
push dword [ebp + 8]
call fcn.00412285
mov edi, eax
test edi, edi
je 0x412586
push dword [ebp + 0x14]
push esi
push 3
push ebx
push dword [ebp + 0xc]
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
sete al
jmp 0x412586
mov eax, dword [ebp + 0x14]
lea eax, [eax*2 + 1]
push eax
call fcn.004bc86d
mov edx, dword [ebp + 0x14]
mov ebx, eax
pop ecx
xor ecx, ecx
test edx, edx
je 0x41255c
mov al, byte [esi + ecx]
and al, 0xf
add al, 0x41
mov byte [ebx + ecx*2], al
mov al, byte [esi + ecx]
shr al, 4
add al, 0x41
mov byte [ebx + ecx*2 + 1], al
inc ecx
cmp ecx, edx
jb 0x412541
mov byte [ebx + ecx*2], 0
mov eax, dword [edi]
push ebx
push dword [ebp + 0xc]
mov esi, dword [eax + 0x88]
mov ecx, esi
push dword [ebp + 8]
call dword [0x5b1a70]
mov ecx, edi
call esi
push ebx
mov esi, eax
call fcn.004126e5
pop ecx
mov eax, esi
pop edi
pop esi
pop ebx
pop ebp
ret 0x10

Function at 0x413638
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
xor edi, edi
mov eax, ecx
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], edi
je 0x41367d
call fcn.0044b8ee
push 0xf0
push dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x41367a
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4136c4
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov eax, dword [ebp - 4]
push ebx
xor ebx, ebx
inc ebx
test edi, edi
je 0x4136a0
mov ecx, dword [eax]
push dword [ebp + 0x10]
push edi
mov esi, dword [ecx + 0x20]
mov ecx, esi
push dword [ebp + 8]
call dword [0x5b1a70]
mov ecx, dword [ebp - 4]
call esi
mov ebx, eax
mov eax, dword [ebp + 8]
mov edi, dword [eax + 0x70]
test edi, edi
je 0x4136c1
mov edx, dword [edi]
push dword [ebp + 0x10]
mov esi, dword [edx + 0xa0]
mov ecx, esi
call dword [0x5b1a70]
mov ecx, edi
call esi
mov eax, ebx
pop ebx
pop edi
pop esi
leave
ret 0xc

Function at 0x416ca9
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x59fa33
call fcn.005744c3
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x74], ebx
jne 0x416ccf
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x416d29
lea ecx, [ebp - 0x10]
call fcn.00406150
mov edi, dword [edi + 0x74]
lea ecx, [ebp - 0x10]
push ecx
mov dword [ebp - 4], ebx
mov eax, dword [edi]
mov esi, dword [eax + 0x8c]
mov ecx, esi
call dword [0x5b1a70]
mov ecx, edi
call esi
mov esi, dword [ebp + 8]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push esi
call fcn.0058045a
push eax
call fcn.0040f1a5
add esp, 0x14
test esi, esi
je 0x416d1c
push esi
call fcn.0057fe70
pop ecx
mov ebx, eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.004066a0
mov eax, ebx
call fcn.00574491
ret 8
Function at 0x417a5d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x84], 0
mov esi, dword [ebx + 0x8c]
mov edi, dword [ebx + 0x88]
je 0x417aa5
call fcn.0044b8ee
push 5
push dword [ebx + 0x84]
mov eax, dword [eax + 0xc]
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x417aa5
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x417ab2
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
xor eax, eax
inc eax
test esi, esi
je 0x417aee
mov edx, 0xffff
lea ecx, [esi + 0xc]
cmp word [esi + 2], dx
jne 0x417ad1
movzx edi, word [esi + 0x12]
movzx edx, word [esi + 0x14]
jmp 0x417ada
movzx edx, word [ecx]
mov ecx, esi
movzx edi, word [esi + 0xa]
test dword [ecx], 0x1801
jne 0x417aec
test di, di
jne 0x417aec
test dx, dx
je 0x417aee
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x417af3
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
mov dword [esi + 0x84], edi
test edi, 0xffff0000
jne 0x417b1e
cmp dword [esi + 0x80], 0
jne 0x417b1e
movzx eax, di
mov dword [esi + 0x80], eax
call fcn.0044b8ee
push 5
push edi
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x417b4e
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x417b4e
push ebx
push dword [ebp + 0xc]
mov ecx, esi
push eax
call fcn.00417db5
jmp 0x417b50
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x417b57
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, ecx
call fcn.0044b8ee
push 5
push dword [ebp + 8]
mov esi, dword [eax + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x417b97
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x417b97
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push dword [ebp + 0xc]
mov ecx, edi
push eax
call fcn.00417b9f
jmp 0x417b99
xor eax, eax
pop edi
pop esi
pop ebp
ret 8
Function at 0x417e8a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x24
mov eax, 0x5a01e6
call fcn.0057452c
mov edi, ecx
mov dword [ebp - 0x24], edi
mov ebx, dword [edi + 0x8c]
mov esi, dword [edi + 0x88]
mov dword [ebp - 0x18], ebx
call fcn.0044b8ee
cmp dword [edi + 0x84], 0
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x20], eax
je 0x417ee9
call fcn.0044b8ee
push 5
push dword [edi + 0x84]
mov ebx, dword [eax + 0xc]
push ebx
mov dword [ebp - 0x20], ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x417efd
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, dword [ebp - 0x18]
mov esi, eax
test esi, esi
je 0x417ef9
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov dword [ebp - 0x18], eax
test ebx, ebx
jne 0x417f05
or eax, 0xffffffff
jmp 0x418057
mov ecx, edi
call fcn.0041848d
mov ebx, eax
mov dword [ebp - 0x2c], ebx
call fcn.0041eef7
xor esi, esi
and dword [ebp - 0x1c], esi
and dword [ebp - 0x28], esi
mov dword [ebp - 0x14], esi
test ebx, ebx
je 0x417f91
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp ebx, eax
je 0x417f91
push ebx
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x417f91
push esi
push ebx
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [ebp - 0x14], 1
call fcn.00408ae0
mov esi, eax
mov dword [ebp - 0x1c], esi
test esi, esi
je 0x417f8e
mov ecx, dword [esi]
mov esi, dword [ecx + 0x150]
mov ecx, esi
call dword [0x5b1a70]
mov ecx, dword [ebp - 0x1c]
call esi
test eax, eax
je 0x417f8e
mov esi, dword [ebp - 0x1c]
mov ecx, esi
call fcn.00416de9
test eax, eax
je 0x417f8e
push 0
mov ecx, esi
call fcn.0041670b
mov dword [ebp - 0x28], 1
mov esi, dword [ebp - 0x14]
and dword [ebp - 4], 0
push edi
call fcn.0041ebc4
push ebx
call fcn.004202b9
push dword [ebp - 0x20]
mov ecx, edi
push eax
push dword [ebp - 0x18]
call fcn.00417e2d
test eax, eax
jne 0x417fda
cmp dword [edi + 0x9c], eax
jne 0x417fda
call fcn.0044b8ee
push ebx
mov eax, dword [eax + 8]
mov dword [ebp - 0x20], eax
call fcn.004202b9
push dword [ebp - 0x20]
mov ecx, edi
push eax
push dword [ebp - 0x18]
call fcn.00417e2d
and dword [edi + 0x9c], 0
jmp 0x418005
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x28], 0
je 0x418019
mov ecx, dword [ebp - 0x1c]
push 1
call fcn.0041670b
test esi, esi
je 0x418026
push 1
push ebx
call dword [sym.imp.USER32.dll_EnableWindow]
test ebx, ebx
je 0x41803c
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [edi + 0x20]
jne 0x41803c
push ebx
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [edi]
mov esi, dword [eax + 0x60]
mov ecx, esi
call dword [0x5b1a70]
mov ecx, edi
call esi
mov ecx, edi
call fcn.00418444
mov eax, dword [edi + 0x68]
call fcn.00574491
ret