joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001be80
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
cmp dword [edi + 0x53b8], 0
lea esi, [edi + 0x53bc]
je 0x1001bf02
mov ecx, dword [esi + 4]
test ecx, ecx
jns 0x1001bebc
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
xor ecx, ecx
test eax, eax
cmovg ecx, eax
push ecx
mov ecx, esi
call fcn.1002b140
push dword [ebp + 8]
mov ecx, esi
mov dword [esi], 0
push ebx
call fcn.10005590
mov edx, dword [esi]
mov ecx, 0x10071573
push dword [edi + 0x53b8]
lea eax, [edx - 1]
neg edx
sbb edx, edx
and edx, eax
mov eax, dword [edi + 0x53c4]
test eax, eax
push edx
cmovne ecx, eax
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp + 8]
mov ecx, esi
push ebx
call fcn.10005590
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1001c3d0
Capabilities:
Hash data with crc32

Disassembly:
push esi
push edi
mov edi, ecx
or ecx, 0xffffffff
mov al, byte [edi]
lea esi, [edi + 1]
test al, al
je 0x1001c40c
push ebx
or ebx, 0xffffffff
cmp al, 0x23
jne 0x1001c3f2
cmp byte [esi], al
jne 0x1001c3f2
cmp byte [esi + 1], al
cmove ecx, ebx
movzx edx, cl
movzx eax, al
xor edx, eax
shr ecx, 8
mov al, byte [esi]
inc esi
xor ecx, dword [edx*4 + 0x10058908]
test al, al
jne 0x1001c3e4
pop ebx
not ecx
call fcn.1001c310
test eax, eax
jne 0x1001c420
mov ecx, edi
pop edi
pop esi
jmp fcn.1001c230
pop edi
pop esi
ret

Function at 0x1001c430
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x100716dc]
lea edx, [ecx + 1]
push ebx
mov dword [ebp - 4], eax
or ebx, 0xffffffff
mov al, byte [ecx]
push esi
push edi
test al, al
je 0x1001c477
or esi, 0xffffffff
nop
cmp al, 0x23
jne 0x1001c45e
cmp byte [edx], al
jne 0x1001c45e
cmp byte [edx + 1], al
cmove ebx, esi
movzx ecx, bl
movzx eax, al
xor ecx, eax
shr ebx, 8
mov al, byte [edx]
inc edx
xor ebx, dword [ecx*4 + 0x10058908]
test al, al
jne 0x1001c450
mov ecx, dword [ebp - 4]
xor esi, esi
not ebx
mov eax, dword [ecx + 0x537c]
test eax, eax
jle 0x1001c4cf
mov edx, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
xor edi, edi
test esi, esi
js 0x1001c498
cmp esi, eax
jl 0x1001c4b5
push 0x74d
push str.D:MyFilesDLLDLL_WITH_HWIDSIGSCAN_PRODIGALImGui_StandaloneImGuiimgui.h
push str.i___0__i___Size
call edx
mov ecx, dword [ebp - 4]
add esp, 0xc
mov edx, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov eax, dword [ecx + 0x5384]
cmp dword [eax + edi + 4], ebx
je 0x1001c4d8
mov eax, dword [ecx + 0x537c]
inc esi
add edi, 0x24
cmp esi, eax
jl 0x1001c490
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
js 0x1001c4e4
cmp esi, dword [ecx + 0x537c]
jl 0x1001c4f8
push 0x74d
push str.D:MyFilesDLLDLL_WITH_HWIDSIGSCAN_PRODIGALImGui_StandaloneImGuiimgui.h
push str.i___0__i___Size
call edx
add esp, 0xc
mov eax, dword [ebp - 4]
lea ecx, [esi + esi*8]
pop edi
pop esi
pop ebx
mov eax, dword [eax + 0x5384]
lea eax, [eax + ecx*4]
mov esp, ebp
pop ebp
ret
Function at 0x10027dd0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov ebx, edx
mov esi, ecx
push edi
mov dword [ebp - 4], ebx
push dword [ebx + 0x390]
lea ecx, [esi + 0x5340]
call fcn.10005330
cmp dword [ebx + 0x388], 0
mov edi, eax
je 0x10027e12
push 0x41bf
push str.D:MyFilesDLLDLL_WITH_HWIDSIGSCAN_PRODIGALImGui_StandaloneImGuiimgui.cpp
push str.window__DockNode__0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
add esp, 0xc
test edi, edi
je 0x10027e31
cmp dword [edi + 0x1c], 0
je 0x10027e62
push 1
mov edx, ebx
call fcn.10020e40
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebx + 0x390]
mov ecx, esi
call fcn.1001ff20
mov edi, eax
mov eax, dword [edi + 0x9c]
and eax, 0xfffffe92
or eax, 0x92
mov dword [edi + 0x9c], eax
mov eax, dword [esi + 0x3ea0]
mov dword [edi + 0x84], eax
test byte [edi + 0xa0], 1
jne 0x10027f26
mov esi, edi
mov eax, dword [esi + 0x18]
test eax, eax
je 0x10027e83
mov esi, eax
test byte [esi + 0xa0], 1
je 0x10027e71
movss xmm0, dword [esi + 0x3c]
xorps xmm1, xmm1
comiss xmm0, xmm1
jbe 0x10027e9a
movss xmm0, dword [esi + 0x40]
comiss xmm0, xmm1
ja 0x10027eb2
push 0x41d9
push str.D:MyFilesDLLDLL_WITH_HWIDSIGSCAN_PRODIGALImGui_StandaloneImGuiimgui.cpp
push str.ancestor_node__Size.x___0.0f__ancestor_node__Size.y___0.0f
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
add esp, 0xc
mov eax, dword [esi + 0x18]
mov edx, esi
test eax, eax
je 0x10027ec9
nop dword [eax + eax]
mov edx, eax
mov eax, dword [edx + 0x18]
test eax, eax
jne 0x10027ec0
and byte [edx + 0xa0], 0xdf
mov ecx, dword [edx + 0x1c]
test ecx, ecx
je 0x10027edc
call fcn.10021fa0
mov ecx, dword [edx + 0x20]
test ecx, ecx
je 0x10027ee8
call fcn.10021fa0
cmp dword [edx + 0x18], 0
jne 0x10027f0e
mov eax, dword [edx + 0x78]
test eax, eax
je 0x10027f0e
nop word [eax + eax]
or byte [eax + 0xa0], 0x20
mov eax, dword [eax + 0x18]
test eax, eax
jne 0x10027f00
push dword [esi + 0x40]
mov edx, edi
mov ecx, esi
push dword [esi + 0x3c]
push dword [esi + 0x38]
push dword [esi + 0x34]
call fcn.10026300
add esp, 0x10
mov esi, dword [ebp - 4]
mov ecx, edi
mov bl, byte [edi + 0xa0]
mov edx, esi
push 1
call fcn.100214a0
mov al, byte [edi + 0xa0]
add esp, 4
xor al, bl
and al, 1
xor byte [edi + 0xa0], al
cmp edi, dword [esi + 0x388]
je 0x10027f6d
push 0x41e2
push str.D:MyFilesDLLDLL_WITH_HWIDSIGSCAN_PRODIGALImGui_StandaloneImGuiimgui.cpp
push str.node__window__DockNode
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10033760
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x1003379a
mov eax, dword [0x100716dc]
mov dword [esi + 4], 0
mov dword [esi], 0
test eax, eax
je 0x1003378d
dec dword [eax + 0xb0]
push ecx
call edi
add esp, 4
mov dword [esi + 8], 0
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x100337cb
mov eax, dword [0x100716dc]
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
test eax, eax
je 0x100337be
dec dword [eax + 0xb0]
push ecx
call edi
add esp, 4
mov dword [esi + 0x14], 0
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x100337fc
mov eax, dword [0x100716dc]
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
test eax, eax
je 0x100337ef
dec dword [eax + 0xb0]
push ecx
call edi
add esp, 4
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov ecx, dword [esi + 0x44]
test ecx, ecx
je 0x10033849
mov eax, dword [0x100716dc]
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
test eax, eax
je 0x1003383c
dec dword [eax + 0xb0]
push ecx
call edi
add esp, 4
mov dword [esi + 0x44], 0
mov ecx, dword [esi + 0x50]
test ecx, ecx
je 0x1003387a
mov eax, dword [0x100716dc]
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
test eax, eax
je 0x1003386d
dec dword [eax + 0xb0]
push ecx
call edi
add esp, 4
mov dword [esi + 0x50], 0
mov ecx, dword [esi + 0x5c]
test ecx, ecx
je 0x100338ab
mov eax, dword [0x100716dc]
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
test eax, eax
je 0x1003389e
dec dword [eax + 0xb0]
push ecx
call edi
add esp, 4
mov dword [esi + 0x5c], 0
pop edi
lea ecx, [esi + 0x78]
pop esi
jmp fcn.100361e0
Function at 0x40b3b0
Capabilities:
Write file on windows

Disassembly:
add eax, 0xafc80
mov dword [ebp + 8], eax
pop eax
inc ebp
invalid
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp cl, byte [eax + 2]
mov eax, 0x55555556
imul ecx
mov ecx, edx
sbb ecx, eax
pop ds
sub dl, cl
lea eax, [edx*4 + 1]
pop ebp
lodsb al, byte [esi]
add al, 0
nop
nop
nop
nop
nop
nop
nop
jae 0x40b36b
nop
nop
push ss
nop
adc al, 0x55
sahf
in al, dx
invalid

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x402766
Capabilities:
Get common file path

Disassembly:
sub esp, 0x800
push esi
push edi
xor esi, esi
xor edi, edi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
cmp edi, 0x1d803
jg 0x4027a0
inc edi
cmp edi, 0x1e70dee2
jl 0x402772
cmp dword [0x47451c], 0x400
jne 0x4027c8
push esi
call fcn.00402823
push esi
push esi
call fcn.00402cc2
push esi
call fcn.00402ae2
push esi
call fcn.00402d6f
add esp, 0x14
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp edi, 0x58bc0a
jg 0x4027e7
inc edi
cmp edi, 0xe14a
jl 0x4027ca
mov eax, dword [0x46c524]
mov dword [0x47451c], eax
call fcn.00402507
mov edi, 0x3078f
cmp dword [0x47451c], 0x51f
jne 0x402813
push esi
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
dec edi
jne 0x4027fb
pop edi
xor eax, eax
pop esi
add esp, 0x800
ret 0x10

Function at 0x405669
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40b570]
jne 0x405673
repz ret
jmp fcn.004070c0
Function at 0x40692b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x40b570]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040421f
and dword [ebp - 0x14], 0
cmp dword [0x46e130], 0
mov dword [ebp - 0x18], eax
jne 0x4069de
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x406a86
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x406a86
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x46e130], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x46e134], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x46e138], eax
call edi
push eax
call esi
mov dword [0x46e140], eax
test eax, eax
je 0x4069de
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x46e13c], eax
mov eax, dword [0x46e13c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x406a37
cmp dword [0x46e140], ecx
je 0x406a37
push eax
call esi
push dword [0x46e140]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x406a37
test ebx, ebx
je 0x406a37
call edi
test eax, eax
je 0x406a2e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x406a2e
test byte [ebp - 8], 1
jne 0x406a37
or dword [ebp + 0x10], 0x200000
jmp 0x406a6a
mov eax, dword [0x46e134]
cmp eax, dword [ebp - 0x18]
je 0x406a6a
push eax
call esi
test eax, eax
je 0x406a6a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x406a6a
mov eax, dword [0x46e138]
cmp eax, dword [ebp - 0x18]
je 0x406a6a
push eax
call esi
test eax, eax
je 0x406a6a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x46e130]
call esi
test eax, eax
je 0x406a86
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x406a88
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00405669
leave
ret
Function at 0x4afce4
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
jmp 0x4afda3
cmp dword [esi + 0x10], 0x1000
jne 0x4afd8f
test byte [esi + 0x15], 1
jne 0x4afd8f
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x4afd40
cmp ebp, 2
je 0x4afd40
cmp ebp, 0x10
je 0x4afd40
cmp ebp, 0x20
jne 0x4afd5c
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4afd5c
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x4afd6d
mov eax, dword [esi]
add eax, ebx
call fcn.004afcdc
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x4afd60
cmp byte [esp + 4], 0
je 0x4afd8f
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov edi, eax
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x4afd15
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x401320
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov dword [0x404169], eax
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0
push 0
push 0x80000000
push 0
push 0x80000000
push 0xcf0000
push str.trast
push str.bask
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x401368
xor eax, eax
jmp 0x401383
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x402630
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
jmp fcn.0040263d

Function at 0x417d34
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.00417db3
jae 0x417d40
xor ecx, ecx
call fcn.00417db3
jae 0x417d6a
xor eax, eax
call fcn.00417db3
jae 0x417d7b
mov al, 0x10
call fcn.00417db3
adc al, al
jae 0x417d5c
jne 0x417da8
stosb byte es:[edi], al
jmp 0x417d41
call fcn.00417dbf
dec ecx
loop 0x417d87
mov eax, ebp
call fcn.00417dbd
jmp 0x417da9
lodsb al, byte [esi]
shr eax, 1
je 0x417dcf
adc ecx, 2
mov ebp, eax
jmp 0x417da9
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.00417dbd
cmp eax, 0x7d00
jae 0x417da7
cmp eax, 0x500
jae 0x417da8
cmp eax, 0x7f
ja 0x417da9
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x417d41
pop ebp
ret 8
Function at 0x4012d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne al
ret
Function at 0x412980
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
push 0xf00021
mov edx, dword [esi + 4]
mov ecx, dword [esi]
mov eax, dword [esi + 0xc]
sub eax, edx
push eax
mov eax, dword [esi + 8]
sub eax, ecx
push eax
push edx
push ecx
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.GDI32.dll_PatBlt]
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov ebx, eax
lea eax, [eax + 5]
add eax, 3
and eax, 0xfffffffc
call fcn.00405060
mov dword [ebp - 4], esp
cmp dword [ebp - 4], 0
je 0x412a4b
add ebx, 2
mov eax, dword [ebp - 4]
push ebx
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
je 0x412a4b
mov bx, 0x140
mov edi, dword [ebp + 0x14]
mov eax, edi
and al, 0xf
cmp al, 0xc
je 0x4129fe
mov ebx, edi
and bx, 0xf
or bx, 0x150
test edi, 0x80
je 0x412a09
or bh, 8
and edi, 0x8000000
je 0x412a24
mov eax, dword [0x42b61c]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
movzx eax, bx
push eax
push esi
push 0xffffffffffffffff
push ecx
push edx
call dword [sym.imp.USER32.dll_DrawTextA]
test edi, edi
je 0x412a4b
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x412e20
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
sub esp, 4
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
push ebp
push 2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x412e4b
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
jne 0x412e6f
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push ebx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
test ebp, ebp
jne 0x412e8a
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
mov edi, ebp
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x20]
xor ecx, ecx
mov cl, ah
mov edx, eax
mov dword [esp + 0x10], 0
shl ecx, 8
shr edx, 0x10
mov byte [esp + 0x10], dl
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x28]
or ecx, edx
mov edx, eax
shr edx, 0x10
mov dword [ebp + 0x28], ecx
mov dword [esp + 0x10], 0
xor ecx, ecx
mov byte [esp + 0x10], dl
mov cl, ah
xor edx, edx
shl ecx, 8
mov dl, al
shl edx, 0x10
or ecx, dword [esp + 0x10]
or ecx, edx
mov eax, dword [esp + 0x24]
mov edx, eax
mov dword [ebp + 0x44], ecx
shr edx, 0x10
xor ecx, ecx
mov dword [esp + 0x10], 0
mov cl, ah
mov byte [esp + 0x10], dl
shl ecx, 8
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x2c]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x48], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x30]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x64], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x34]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x54], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
push 0
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
or ecx, edx
mov dword [ebp + 0x50], ecx
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
push 0
push ebp
lea ecx, [ebp + 0x68]
push ecx
push 4
push ebp
push edi
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
mov esi, eax
push edi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
Function at 0x417a8f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x417ad1
call fcn.0041b9ff
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
cmp eax, edi
je 0x417ad1
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x417ac8
xor eax, eax
jmp 0x417ad9
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00417adf
pop edi
pop esi
pop ebx
ret 4

Function at 0x41befe
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x41bf2c
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x41bf4a
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0041be64
jmp 0x41bf4a
mov eax, dword [esi + 0x14]
test eax, eax
je 0x41bf4a
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0041be64
test edi, edi
mov eax, edi
jne 0x41bf34
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x4013a9
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov dword [ebp - 0x38], 3
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x14], str.TestWindow
mov eax, dword [ebp + 8]
mov dword [ebp - 0x28], eax
mov dword [esp], 0xf
call sub.USER32.dll_GetSysColorBrush
sub esp, 4
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x34], 0x401360
mov dword [esp + 4], 0x7f00
mov dword [esp], 0
call sub.USER32.dll_LoadCursorA
sub esp, 8
mov dword [ebp - 0x20], eax
mov dword [esp + 4], 0x7f01
mov dword [esp], 0
call sub.USER32.dll_LoadIconA
sub esp, 8
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x38]
mov dword [esp], eax
call sub.USER32.dll_RegisterClassA
sub esp, 4
mov eax, dword [ebp - 0x14]
mov dword [esp + 0x2c], 0
mov edx, dword [ebp + 8]
mov dword [esp + 0x28], edx
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0x96
mov dword [esp + 0x18], 0x226
mov dword [esp + 0x14], 0x64
mov dword [esp + 0x10], 0x64
mov dword [esp + 0xc], 0x10ca0000
mov dword [esp + 8], str.GERA_STONE_TEST_2.0__c__2024__HappyAnd_13
mov dword [esp + 4], eax
mov dword [esp], 0
call sub.USER32.dll_CreateWindowExA
sub esp, 0x30
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.USER32.dll_GetDC
sub esp, 4
mov dword [ebp - 0x10], eax
mov dword [esp + 0x10], 0x1b
mov dword [esp + 0xc], str.GERA_STONE_TEST_v2.0_loaded_
mov dword [esp + 8], 0x28
mov dword [esp + 4], 0x96
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.GDI32.dll_TextOutA
sub esp, 0x14
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.USER32.dll_ReleaseDC
sub esp, 8
mov eax, dword [ebp + 0x14]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.USER32.dll_ShowWindow
sub esp, 8
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.USER32.dll_UpdateWindow
sub esp, 4
jmp 0x401525
lea eax, [ebp - 0x54]
mov dword [esp], eax
call sub.USER32.dll_DispatchMessageA
sub esp, 4
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
lea eax, [ebp - 0x54]
mov dword [esp], eax
call sub.USER32.dll_GetMessageA
sub esp, 0x10
test eax, eax
jne 0x401517
mov eax, dword [ebp - 0x4c]
leave
ret 0x10