joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a4f0
Capabilities:
Move file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x40a513
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x40a51a
mov dword [ebp - 4], 0
cmp dword [ebp - 4], 0
je 0x40a531
mov edx, dword [ebp - 4]
push edx
call fcn.004105a0
add esp, 4
or eax, 0xffffffff
jmp 0x40a533
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x40a790
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x40a7af
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x40a7b6
mov dword [ebp - 4], 0
cmp dword [ebp - 4], 0
je 0x40a7cd
mov ecx, dword [ebp - 4]
push ecx
call fcn.004105a0
add esp, 4
or eax, 0xffffffff
jmp 0x40a7cf
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x414d00
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x492154]
jne 0x414d0a
repz ret
jmp fcn.0041ade0
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x408f6c
nop
nop
mov ecx, 0x23d42728
nop
nop
nop
test eax, eax
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..data
mov ebx, 0x42e3d0
nop
nop
mov ecx, 0x7b1d6af4
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCR71.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x40287f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x40288e
pop dword [ebp - 0x1c]
mov eax, 0x1247e43f
sub eax, 0x1207bbb1
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0x3ffa7e70
add dword [ebp - 0x2c], 0xe57c6db
mov dword [ebp - 0x28], 0x93e13ef0
add dword [ebp - 0x28], 0x9e520d55
mov dword [ebp - 0x24], 0x4cc1e19b
add dword [ebp - 0x24], 0xff8a6293
mov dword [ebp - 0x20], 0x9614c0fa
add dword [ebp - 0x20], 0x69eb3f06
lea eax, [ebp - 0x2c]
push eax
mov eax, 0xc9d70468
add eax, 0x36697c24
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0x933f052f
add dword [ebp - 0x2c], 0xe1336427
mov dword [ebp - 0x28], 0x6b5b49c2
sub dword [ebp - 0x28], 0x29eee84d
mov dword [ebp - 0x24], 0xe0c51b9b
sub dword [ebp - 0x24], 0x7d55af2f
mov dword [ebp - 0x20], 0x261cb3a2
sub dword [ebp - 0x20], 0x261cb3a2
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, 0xbfb0fe2b
sub eax, 0xbf707d57
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x36c56
push 0
call eax
mov ecx, 0x91eac23b
sub ecx, 0x91ea7988
xor edx, edx
add edx, eax
mov esi, 0x2c95c97f
sub esi, 0x2c54b97f
add esi, dword [ebp - 0x1c]
mov ebx, 0x3c9712bd
add ebx, 0x50cf8cf8
xor dword [ebp - 4], 0xd3bb87fc
mov edi, dword [esi]
sub dword [ebp - 8], 0xf621c539
sub edi, ebx
xor dword [ebp - 0x10], ecx
mov dword [edx], edi
sub dword [ebp - 0xc], esi
add edx, 0x689561b4
add edx, 0x976a9e50
add esi, 0x81897bca
sub esi, 0x81897bc6
loop 0x4029b2
add eax, 0x1159f
mov ebx, eax
add eax, 5
mov ecx, 0xf5440146
sub ecx, 0xf5040146
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x4027e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov eax, edi
shr eax, 4
inc eax
push 6
movzx eax, ax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp + 0xc], eax
test eax, eax
jne 0x402809
pop edi
pop ebx
pop ebp
ret
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x40281f
xor esi, esi
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x402816
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [esi + eax]
and edi, 0xf
jbe 0x402852
nop
cmp esi, ecx
jae 0x402816
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edi, 1
jne 0x402840
cmp esi, ecx
jae 0x402816
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4028b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov edi, dword [ebp + 8]
push edi
mov dword [ebp - 4], ecx
call fcn.004137c3
mov ebx, eax
test ebx, ebx
jne 0x4028d0
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, edi
shr eax, 4
push esi
inc eax
push 6
movzx eax, ax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp + 8], eax
test eax, eax
je 0x4029b7
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4029b7
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4029b7
push dword [ebp + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [esi + eax]
and edi, 0xf
jbe 0x402938
cmp esi, ecx
jae 0x4029b7
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edi, 1
jne 0x402922
cmp esi, ecx
jae 0x4029b7
cmp word [esi], 0
je 0x4029b7
movzx eax, word [esi]
lea ecx, [esi + 2]
push 0
push 0
push 0
push 0
push eax
push ecx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
test edi, edi
js 0x4029c2
mov ebx, dword [ebp - 4]
mov edx, 1
mov ecx, dword [ebx]
sub edx, dword [ecx - 4]
mov ecx, dword [ecx - 8]
sub ecx, edi
or edx, ecx
jge 0x402980
push edi
mov ecx, ebx
call fcn.004020c0
movzx eax, word [esi]
push 0
push 0
push edi
push dword [ebx]
push eax
lea eax, [esi + 2]
push eax
push 0
push 3
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, dword [ebx]
cmp edi, dword [eax - 8]
jg 0x4029c2
mov dword [eax - 0xc], edi
mov eax, dword [ebx]
pop esi
mov byte [edi + eax], 0
mov eax, 1
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop esi
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.00401d90
int3

Function at 0x403400
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
movzx eax, word [ebp + 8]
mov dword [ebp + 8], eax
pop ebp
jmp fcn.004128db
Function at 0x405c75
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
xor esi, esi
mov ebx, ecx
push edi
cmp dword [ebp + 8], esi
je 0x405cb4
call fcn.004175c7
push 0xf0
push dword [ebp + 8]
mov edi, dword [eax + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x405cb4
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x405cbc
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
push esi
mov ecx, ebx
call fcn.00416fcf
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x406713
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
je 0x40679f
cmp dword [esi + 0x20], 0
je 0x40679f
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x40679f
cmp dword [ebp + 8], 0
je 0x40679f
xor edi, edi
mov ebx, edi
call fcn.004175c7
push 0x58e950
push dword [ebp + 8]
mov eax, dword [eax + 0xc]
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 8], eax
test eax, eax
je 0x406783
mov ebx, dword [ebp - 4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp - 8]
mov edi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40679f
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
push edi
push ebx
push esi
call fcn.0041ba34
mov edi, eax
add esp, 0xc
test edi, edi
je 0x40679b
mov ecx, esi
call fcn.004064b1
mov eax, edi
jmp 0x4067a1
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x40b748
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x57cf8e
call fcn.00549e57
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x74], ebx
jne 0x40b76e
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x40b7c8
lea ecx, [ebp - 0x10]
call fcn.00401f80
mov edi, dword [edi + 0x74]
lea ecx, [ebp - 0x10]
push ecx
mov dword [ebp - 4], ebx
mov eax, dword [edi]
mov esi, dword [eax + 0x8c]
mov ecx, esi
call dword [0x58da18]
mov ecx, edi
call esi
mov esi, dword [ebp + 8]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push esi
call fcn.00554ac7
push eax
call fcn.00403410
add esp, 0x14
test esi, esi
je 0x40b7bb
push esi
call fcn.00554940
pop ecx
mov ebx, eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00401db0
mov eax, ebx
call fcn.00549e25
ret 8
Function at 0x411f23
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
xor edi, edi
mov eax, ecx
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], edi
je 0x411f68
call fcn.004175c7
push 0xf0
push dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x411f65
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x411faf
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov eax, dword [ebp - 4]
push ebx
xor ebx, ebx
inc ebx
test edi, edi
je 0x411f8b
mov ecx, dword [eax]
push dword [ebp + 0x10]
push edi
mov esi, dword [ecx + 0x20]
mov ecx, esi
push dword [ebp + 8]
call dword [0x58da18]
mov ecx, dword [ebp - 4]
call esi
mov ebx, eax
mov eax, dword [ebp + 8]
mov edi, dword [eax + 0x70]
test edi, edi
je 0x411fac
mov edx, dword [edi]
push dword [ebp + 0x10]
mov esi, dword [edx + 0xa0]
mov ecx, esi
call dword [0x58da18]
mov ecx, edi
call esi
mov eax, ebx
pop ebx
pop edi
pop esi
leave
ret 0xc

Function at 0x412933
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, ecx
xor esi, esi
call fcn.004175c7
push 5
push dword [ebp + 8]
mov edi, dword [eax + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x412966
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
push edi
push dword [ebp + 0xc]
mov ecx, ebx
push esi
call fcn.00412979
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x41623d
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
push edi
cmp dword [ecx + 0x58], esi
je 0x416290
push esi
push dword [ebp + 8]
call fcn.00416423
mov edi, eax
test edi, edi
je 0x41628b
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp + 0xc]
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x41628b
mov eax, dword [ebp - 8]
jmp 0x4162a2
mov eax, dword [ebp + 0x10]
jmp 0x4162a2
push dword [ecx + 0x6c]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
pop edi
pop esi
leave
ret 0xc

Function at 0x4162a8
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57d66b
mov eax, dword fs:[0]
push eax
mov eax, 0x101c
call fcn.0054a000
mov eax, dword [0x5e6e74]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xor ebx, ebx
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x14]
mov dword [ebp - 0x101c], edi
mov dword [ebp - 0x1024], eax
cmp dword [ecx + 0x58], ebx
je 0x4163d6
push ebx
push edx
call fcn.00416423
mov ebx, eax
test ebx, ebx
jne 0x416310
push esi
jmp 0x4163fe
lea ecx, [ebp - 0x1014]
call fcn.00401f80
xor ecx, ecx
lea eax, [ebp - 0x1018]
push eax
push ecx
lea eax, [ebp - 0x1020]
mov dword [ebp - 4], ecx
push eax
push ecx
push dword [ebp - 0x1024]
mov dword [ebp - 0x1020], ecx
push ebx
mov dword [ebp - 0x1018], ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x101c], eax
test eax, eax
jne 0x416395
push dword [ebp - 0x1018]
lea ecx, [ebp - 0x1014]
call fcn.00402050
lea ecx, [ebp - 0x1018]
push ecx
push eax
lea eax, [ebp - 0x1020]
push eax
push 0
push dword [ebp - 0x1024]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 0xffffffffffffffff
lea ecx, [ebp - 0x1014]
mov dword [ebp - 0x101c], eax
call fcn.0040847f
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x101c], 0
jne 0x4163c3
mov esi, dword [ebp - 0x1014]
add esi, 0xfffffff0
push esi
call fcn.00403510
pop ecx
add eax, 0x10
mov ecx, esi
mov dword [edi], eax
call fcn.00401db0
jmp 0x416405
push esi
mov ecx, edi
call fcn.004037f0
mov ecx, dword [ebp - 0x1014]
lea ecx, [ecx - 0x10]
jmp 0x4163bc
test esi, esi
jne 0x4163df
mov esi, 0x58df84
push dword [ecx + 0x6c]
lea ecx, [ebp - 0x1010]
push 0x1000
push ecx
push esi
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x1010]
push eax
mov ecx, edi
call fcn.004037f0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00549544
leave
ret 0x10
Function at 0x41a3b3
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
xor eax, eax
mov dword [ebp - 8], ecx
inc eax
inc ebx
mov dword [ebp - 4], eax
cmp dword [edi + 8], ebx
jle 0x41a42a
mov edx, dword [ebp + 0xc]
test edx, edx
je 0x41a3f0
mov eax, dword [ecx + 0x10]
cmp dword [eax + ebx*8 + 4], edx
je 0x41a3f0
mov eax, dword [edi + 0xc]
cmp dword [eax + ebx*4], 0
je 0x41a41d
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x41a420
mov eax, dword [edi + 0xc]
mov eax, dword [eax + ebx*4]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x41a416
mov eax, dword [eax]
push 1
mov esi, dword [eax]
mov ecx, esi
call dword [0x58da18]
mov ecx, dword [ebp - 0xc]
call esi
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 0xc]
mov eax, dword [edi + 0xc]
and dword [eax + ebx*4], 0
mov eax, dword [ebp - 4]
inc ebx
cmp ebx, dword [edi + 8]
jl 0x41a3d3
test eax, eax
je 0x41a471
lea esi, [ecx + 0x1c]
mov ebx, edi
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [ebp - 8]
push edi
add ecx, 0x14
call fcn.0041a6a2
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push dword [ebx + 0xc]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [edi]
push 1
mov esi, dword [eax]
mov ecx, esi
call dword [0x58da18]
mov ecx, edi
call esi
mov eax, dword [ebp - 8]
push 0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x41ea96
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
mov dword [ebp - 4], ebx
test byte [edi + 4], 1
mov esi, dword [edi + 0xc]
jne 0x41eaec
push 5
push esi
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
jne 0x41eac5
call fcn.0040ed27
push esi
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
jne 0x41eada
call fcn.0040ed27
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x41eaec
call fcn.0040ed27
call fcn.004175c7
cmp dword [eax + 0x3c], 0
je 0x41eb01
push esi
mov ecx, ebx
call fcn.0041e1bc
mov esi, eax
push dword [ebp + 0xc]
push esi
call fcn.0041ece7
mov ebx, eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x88]
test ecx, ecx
je 0x41eb2a
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 4]
and dword [eax + 0x88], 0
test ebx, ebx
je 0x41eb36
mov esi, ebx
mov dword [eax + 0x88], ebx
or dword [edi + 4], 1
mov dword [edi + 0xc], esi
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x42f8f6
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
mov ecx, dword [esi + 4]
call fcn.0040b325
push 0xfffffffffffffff0
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowLongA]
push dword [ebp + 0xc]
and eax, 3
mov ecx, esi
cmp al, 3
je 0x42f932
call fcn.0042fb13
mov dword [esi + 0xc], 1
jmp 0x42f937
call fcn.0042fb13
cmp dword [esi], 0
je 0x42f982
push edi
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov esi, dword [ebp + 0x10]
mov edi, eax
mov ecx, esi
test edi, edi
jle 0x42f95d
push edi
call fcn.00405d30
lea ecx, [edi + 1]
push ecx
jmp 0x42f96c
push 0xff
call fcn.00402050
push 0x100
push eax
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0xffffffffffffffff
mov ecx, esi
call fcn.0040847f
pop edi
jmp 0x42f9a6
mov esi, dword [ebp + 0x10]
push dword [esi]
push 0xffffffffffffffff
push 0x14d
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 0xffffffff
jne 0x42f9a6
push dword [esi]
push dword [ebp - 4]
call fcn.0041cc01
pop esi
leave
ret 0xc

Function at 0x42fa6a
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
push edi
push dword [ebp + 0xc]
call fcn.0042fb13
cmp dword [esi], 0
mov edi, eax
mov dword [esi + 0xc], 1
je 0x42fab2
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.00405d30
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.0040847f
jmp 0x42fabd
mov eax, dword [ebp + 0x10]
push dword [eax]
push edi
call fcn.0041cc01
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x4310e6
Capabilities:
Extract resource via kernel32 functions
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x43122c
mov ecx, 0x5e6324
call fcn.0041a54d
mov esi, eax
test esi, esi
je 0x431221
xor eax, eax
cmp word [esi + 8], ax
jne 0x4311eb
push 0x593ad4
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ebx, eax
test ebx, ebx
je 0x4311a7
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov edi, dword [ebp + 0x10]
mov ecx, 0x3ff
and ax, cx
cmp ax, 0x11
jne 0x43116d
push str.MS_UI_Gothic
call fcn.0043126a
pop ecx
test eax, eax
je 0x43116d
mov eax, edi
neg eax
push 0xfc11
sbb eax, eax
and eax, 0xe
add eax, 0x3ee
push eax
push 5
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
test eax, eax
jne 0x431188
neg edi
push 5
sbb edi, edi
and edi, 0xe
add edi, 0x3ee
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x4311a7
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
test eax, eax
je 0x4311ad
push ebx
push edi
push eax
call fcn.0042dd25
add esp, 0xc
jmp 0x4311ad
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov eax, dword [edi]
push 1
mov eax, dword [eax - 0xc]
inc eax
push eax
call fcn.0040bf42
pop ecx
pop ecx
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ecx, eax
mov dword [esi + 4], ecx
test ecx, ecx
je 0x431226
mov eax, dword [edi]
push eax
mov eax, dword [eax - 0xc]
inc eax
push eax
push ecx
call fcn.00419203
mov ax, word [ebx]
add esp, 0xc
mov word [esi + 8], ax
xor eax, eax
jmp 0x4311ee
mov ebx, dword [ebp + 0xc]
mov edi, dword [esi + 4]
test edi, edi
je 0x4311fc
push edi
call fcn.00554940
pop ecx
mov ecx, dword [ebp + 8]
push eax
push edi
call fcn.00402120
movzx ecx, word [esi + 8]
mov edx, 0xffff
xor eax, eax
mov word [ebx], cx
pop edi
cmp cx, dx
pop esi
setne al
pop ebx
pop ebp
ret 0xc
call fcn.0040e13d
call fcn.0040e157
int3