joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e2a80
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xffffff00
mov ebx, eax
push esp
push 0xff
call sub.kernel32.dll_GetTempPathA
mov edx, ebx
mov eax, esp
call fcn.00409cec
add esp, 0x100
pop ebx
ret

Function at 0x4e2da0
Capabilities:
Enumerate internet cache

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00404c98
xor eax, eax
push ebp
push 0x4e2f68
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
call sub.wininet.dll_FindFirstUrlCacheEntryA
mov eax, dword [ebp - 0x14]
call fcn.004027c4
mov esi, eax
lea eax, [ebp - 0x14]
push eax
push esi
push 0
call sub.wininet.dll_FindFirstUrlCacheEntryA
mov edi, eax
test edi, edi
je 0x4e2e6f
mov eax, dword [esi + 0xc]
and eax, 1
cmp eax, 1
jne 0x4e2e6f
lea eax, [ebp - 0x10]
mov edx, dword [esi + 4]
call fcn.004049e0
mov edx, dword [ebp - 0x10]
mov eax, 0x4e2f80
call fcn.00404dec
test eax, eax
jne 0x4e2e6f
mov edx, dword [0x4e2728]
mov eax, 0x10
call fcn.004056ec
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [eax], 1
mov eax, dword [ebp - 0xc]
add eax, 4
mov edx, dword [esi + 4]
call fcn.004049e0
mov eax, dword [ebp - 0xc]
add eax, 8
mov edx, dword [ebp - 8]
call fcn.0040483c
mov eax, dword [ebp - 0xc]
mov byte [eax + 0xc], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x350]
mov edx, dword [ebp - 0xc]
call fcn.0041a4d8
mov eax, esi
call fcn.004027e4
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 0
push edi
call sub.wininet.dll_FindNextUrlCacheEntryA
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
call sub.kernel32.dll_GetLastError_1
cmp eax, 0x7a
jne 0x4e2f33
mov eax, dword [ebp - 0x14]
call fcn.004027c4
mov esi, eax
lea eax, [ebp - 0x14]
push eax
push esi
push edi
call sub.wininet.dll_FindNextUrlCacheEntryA
test eax, eax
je 0x4e2f2c
mov eax, dword [esi + 0xc]
and eax, 1
cmp eax, 1
jne 0x4e2f2c
lea eax, [ebp - 0x10]
mov edx, dword [esi + 4]
call fcn.004049e0
mov edx, dword [ebp - 0x10]
mov eax, 0x4e2f80
call fcn.00404dec
test eax, eax
jne 0x4e2f2c
mov edx, dword [0x4e2728]
mov eax, 0x10
call fcn.004056ec
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [eax], 1
mov eax, dword [ebp - 0xc]
add eax, 4
mov edx, dword [esi + 4]
call fcn.004049e0
mov eax, dword [ebp - 0xc]
add eax, 8
mov edx, dword [ebp - 8]
call fcn.0040483c
mov eax, dword [ebp - 0xc]
mov byte [eax + 0xc], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x350]
mov edx, dword [ebp - 0xc]
call fcn.0041a4d8
mov eax, esi
call fcn.004027e4
cmp ebx, 0x103
je 0x4e2f44
cmp ebx, 0x57
jne 0x4e2e76
push edi
call sub.wininet.dll_FindCloseUrlCache
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e2f6f
lea eax, [ebp - 0x10]
call fcn.004047e8
lea eax, [ebp - 8]
call fcn.004047e8
ret
Function at 0x4e311c
Capabilities:
Enumerate files on windows
Set current directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.00404c98
xor eax, eax
push ebp
push 0x4e326d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404ca8
push eax
call sub.kernel32.dll_SetCurrentDirectoryA_1
lea eax, [ebp - 0x14c]
push eax
push 0x4e327c
call sub.kernel32.dll_FindFirstFileA_1
mov esi, eax
cmp esi, 0xffffffff
je 0x4e3249
mov ebx, dword [ebp - 0x14c]
lea eax, [ebp - 0xc]
lea edx, [ebp - 0x120]
mov ecx, 0x104
call fcn.00404a58
mov eax, dword [ebp - 0xc]
mov edx, 0x4e3288
call fcn.00404bf4
je 0x4e322e
mov eax, dword [ebp - 0xc]
mov edx, 0x4e3294
call fcn.00404bf4
je 0x4e322e
cmp ebx, 0x10
je 0x4e31e8
cmp ebx, 2
je 0x4e31e8
cmp ebx, 4
je 0x4e31e8
cmp ebx, 0x80
je 0x4e31e8
cmp ebx, 0x100
je 0x4e31e8
cmp ebx, 0x20
je 0x4e31e8
cmp ebx, 0x11
je 0x4e31e8
cmp ebx, 0x12
je 0x4e31e8
cmp ebx, 0x13
je 0x4e31e8
cmp ebx, 0x14
jne 0x4e322e
mov edx, dword [0x4e2728]
mov eax, 0x10
call fcn.004056ec
mov ebx, eax
mov eax, dword [ebp - 8]
mov dword [ebx], eax
lea eax, [ebx + 4]
lea edx, [ebp - 0x120]
mov ecx, 0x104
call fcn.00404a58
lea eax, [ebx + 8]
mov edx, dword [ebp - 4]
call fcn.0040483c
mov byte [ebx + 0xc], 1
mov eax, dword [edi + 0x350]
mov edx, ebx
call fcn.0041a4d8
lea eax, [ebp - 0x14c]
push eax
push esi
call sub.kernel32.dll_FindNextFileA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x4e3175
push esi
call sub.kernel32.dll_FindClose_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e3274
lea eax, [ebp - 0xc]
call fcn.004047e8
lea eax, [ebp - 4]
call fcn.004047e8
ret
Function at 0x4e3618
Capabilities:
Delete internet cache
Enumerate internet cache

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 4], edx
lea edi, [ebp - 8]
xor eax, eax
push ebp
push 0x4e36ef
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [edi], eax
push edi
push 0
push 0
call sub.wininet.dll_FindFirstUrlCacheEntryA
mov eax, dword [edi]
call fcn.004027c4
mov ebx, eax
cmp dword [edi], 0
jbe 0x4e3657
mov eax, dword [edi]
mov dword [ebx], eax
push edi
push ebx
push 0
call sub.wininet.dll_FindFirstUrlCacheEntryA
mov esi, eax
test esi, esi
je 0x4e36ca
mov eax, dword [ebx + 0xc]
and eax, 1
cmp eax, 1
jne 0x4e3696
lea eax, [ebp - 4]
mov edx, dword [ebx + 4]
call fcn.004049e0
mov edx, dword [ebp - 4]
mov eax, 0x4e3708
call fcn.00404dec
test eax, eax
jne 0x4e3696
mov eax, dword [ebx + 4]
push eax
call sub.wininet.dll_DeleteUrlCacheEntry
mov edx, dword [edi]
mov eax, ebx
call fcn.004027e4
xor eax, eax
mov dword [edi], eax
push edi
push 0
push esi
call sub.wininet.dll_FindNextUrlCacheEntryA
mov eax, dword [edi]
call fcn.004027c4
mov ebx, eax
cmp dword [edi], 0
jbe 0x4e36be
mov eax, dword [edi]
mov dword [ebx], eax
push edi
push ebx
push esi
call sub.wininet.dll_FindNextUrlCacheEntryA
test eax, eax
jne 0x4e3666
mov edx, dword [edi]
mov eax, ebx
call fcn.004027e4
push esi
call sub.wininet.dll_FindCloseUrlCache
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e36f6
lea eax, [ebp - 4]
call fcn.004047e8
ret

Function at 0x4e3820
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4e3927
push dword fs:[eax]
mov dword fs:[eax], esp
xor edi, edi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x350]
mov eax, dword [eax + 8]
mov dword [ebp - 0xc], eax
mov esi, eax
dec esi
test esi, esi
jl 0x4e3911
inc esi
mov dword [ebp - 8], 0
mov eax, dword [0x4fc898]
cmp byte [eax], 3
je 0x4e3911
cmp edi, dword [ebp - 0xc]
je 0x4e3911
mov eax, dword [0x4fcbc4]
mov eax, dword [eax]
call fcn.00489ae4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x350]
mov edx, dword [ebp - 8]
call fcn.0041a634
mov ebx, eax
cmp byte [ebx + 0xc], 0
je 0x4e3906
mov eax, dword [ebx]
add eax, 0xfffffffd
sub eax, 3
jae 0x4e3906
mov eax, dword [0x4fce24]
mov eax, dword [eax]
mov eax, dword [eax + 0x2f8]
mov edx, dword [ebx + 4]
call fcn.00469d04
xor eax, eax
mov dword [ebp - 0x2a], eax
mov dword [ebp - 0x26], 3
push dword [ebx + 8]
push 0x4e3940
push dword [ebx + 4]
push 0x4e394c
lea eax, [ebp - 0x30]
mov edx, 4
call fcn.00404b68
mov eax, dword [ebp - 0x30]
call fcn.00404ca8
mov dword [ebp - 0x22], eax
xor eax, eax
mov dword [ebp - 0x1e], eax
mov word [ebp - 0x1a], 0x410
lea eax, [ebp - 0x2a]
push eax
call sub.shell32.dll_SHFileOperationA
inc edi
inc dword [ebp - 8]
dec esi
jne 0x4e3863
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e392e
lea eax, [ebp - 0x30]
call fcn.004047e8
ret
Function at 0x4efafc
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
xor eax, eax
push ebp
push 0x4efbb6
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x43c6f8]
call fcn.0043c7f8
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4efb94
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000002
mov eax, dword [ebp - 4]
call fcn.0043c898
mov cl, 1
mov edx, 0x4efbcc
mov eax, dword [ebp - 4]
call fcn.0043c900
test al, al
je 0x4efb7e
lea edx, [ebp - 0xc]
mov eax, dword [0x4fcbc4]
mov eax, dword [eax]
call fcn.0048a2a0
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.0040991c
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0043cb9c
mov eax, dword [0x4fc788]
mov byte [eax + 0xc], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4efb9b
mov eax, dword [ebp - 4]
call fcn.004039b4
ret
Function at 0x402380
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
push edi
lea edi, [ebp - 0x54]
mov ecx, 0x15
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + 4]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
xor ecx, ecx
mov cx, word [edx + 0x14]
lea edx, [eax + ecx + 0x18]
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], 0
jmp 0x4023d3
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x14]
add ecx, 0x28
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
xor ecx, ecx
mov cx, word [eax + 6]
cmp dword [ebp - 4], ecx
jge 0x40249b
mov edx, dword [ebp - 0x14]
cmp dword [edx + 0x10], 0
jne 0x402446
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x38]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
jle 0x402441
mov esi, esp
push 4
push 0x1000
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
cmp esi, esp
call fcn.00403a50
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
mov dword [edx + 8], eax
mov ecx, dword [ebp - 8]
push ecx
push 0
mov edx, dword [ebp - 0x10]
push edx
call fcn.004043d0
add esp, 0xc
jmp 0x4023c1
mov esi, esp
push 4
push 0x1000
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x10]
push ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
add eax, dword [edx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
cmp esi, esp
call fcn.00403a50
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0x10]
push edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x14]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.00403bc0
add esp, 0xc
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
mov dword [eax + 8], ecx
jmp 0x4023c1
pop edi
pop esi
pop ebx
add esp, 0x54
cmp ebp, esp
call fcn.00403a50
mov esp, ebp
pop ebp
ret
Function at 0x402500
Capabilities:
Enumerate pe sections
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
push ebx
push esi
push edi
lea edi, [ebp - 0x64]
mov ecx, 0x19
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov edx, dword [ebp + 8]
mov eax, dword [edx]
xor edx, edx
mov dx, word [eax + 0x14]
lea eax, [ecx + edx + 0x18]
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
jmp 0x40254a
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 8]
add edx, 0x28
mov dword [ebp - 8], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
xor edx, edx
mov dx, word [ecx + 6]
cmp dword [ebp - 4], edx
jge 0x40267d
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x24]
and ecx, 0x20000000
neg ecx
sbb ecx, ecx
neg ecx
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x24]
and eax, 0x40000000
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x24]
and edx, 0x80000000
neg edx
sbb edx, edx
neg edx
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x24]
and ecx, 0x2000000
test ecx, ecx
je 0x4025d3
mov esi, esp
push 0x4000
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x10]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
cmp esi, esp
call fcn.00403a50
jmp 0x402538
mov eax, dword [ebp - 0x18]
shl eax, 4
mov ecx, dword [ebp - 0x1c]
lea edx, [eax + ecx*8 + 0x5889d4]
mov eax, dword [ebp - 0x20]
mov ecx, dword [edx + eax*4]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x24]
and eax, 0x4000000
test eax, eax
je 0x402604
mov ecx, dword [ebp - 0xc]
or ch, 2
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x10]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x402648
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x24]
and edx, 0x40
test edx, edx
je 0x40262d
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x20]
mov dword [ebp - 0x14], edx
jmp 0x402648
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x24]
and ecx, 0x80
test ecx, ecx
je 0x402648
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov ecx, dword [eax + 0x24]
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 0
jbe 0x402678
mov esi, esp
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.00403a50
test eax, eax
jne 0x402678
mov byte [ebp - 0x24], 0
jmp 0x402538
pop edi
pop esi
pop ebx
add esp, 0x64
cmp ebp, esp
call fcn.00403a50
mov esp, ebp
pop ebp
ret
Function at 0x427c03
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c77d9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
call fcn.004bad30
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x10]
mov dword [eax], vtable._AFX_DEBUG_STATE.0
push str.AFX.INI
push 1
push str.TraceEnabled
push str.Diagnostics
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [0x5966dc], eax
push str.AFX.INI
push 0
push str.TraceFlags
push str.Diagnostics
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [0x5966d8], eax
cmp dword [0x5966e8], 0
je 0x427c8c
push 0x77
push 0x58c018
call fcn.004a6790
test eax, eax
je 0x427c8c
int3
xor ecx, ecx
test ecx, ecx
jne 0x427c72
push 0x427a34
call fcn.00405f00
add esp, 4
mov dword [0x5966e8], eax
cmp dword [0x5966ec], 0
je 0x427cbe
push 0x7a
push 0x58c028
call fcn.004a6790
test eax, eax
je 0x427cbe
int3
xor edx, edx
test edx, edx
jne 0x427ca4
push 0x427ba6
call fcn.00407ba0
add esp, 4
mov dword [0x5966ec], eax
push 4
push 2
call fcn.00407ac0
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44e6e5
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
cmp dword [eax + 4], 0x100
jne 0x44e750
mov ecx, dword [ebp + 8]
cmp dword [ecx + 8], 0x70
jne 0x44e750
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xc]
shr eax, 0x10
and eax, 0xffff
and eax, 0xffff
and eax, 0x4000
test eax, eax
jne 0x44e750
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
movsx ecx, ax
test ecx, ecx
jl 0x44e750
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
movsx edx, ax
test edx, edx
jl 0x44e750
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
movsx eax, ax
test eax, eax
jl 0x44e750
mov dword [ebp - 4], 1
jmp 0x44e757
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4

Function at 0x45074d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], 0
mov dword [ebp - 0xc], 0
call fcn.004afa22
mov dword [ebp - 4], eax
push 5
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4507a6
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x4507c0
push 0xeb
push str.dlgcore.cpp
call fcn.004a6790
test eax, eax
je 0x4507c0
int3
xor edx, edx
test edx, edx
jne 0x4507a6
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x14]
push edx
mov ecx, dword [ebp - 0x18]
call fcn.0045081b
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0xc]
push eax
call fcn.00402f00
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x45156e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0x48]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + 0x44]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x24]
cmp dword [ecx + 0x40], 0
je 0x4515c1
call fcn.004afa22
mov dword [ebp - 0x10], eax
push 5
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + 0x40]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4515d4
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 1
cmp dword [ebp - 0xc], 0
je 0x451668
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0xc]
xor edx, edx
mov dx, word [ecx + 2]
cmp edx, 0xffff
jne 0x45161f
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0xc]
mov ax, word [edx + 0x12]
mov word [ebp - 0x18], ax
mov ecx, dword [ebp - 0xc]
mov dx, word [ecx + 0x14]
mov word [ebp - 0x1c], dx
jmp 0x451635
mov eax, dword [ebp - 0xc]
mov cx, word [eax + 0xa]
mov word [ebp - 0x18], cx
mov edx, dword [ebp - 0xc]
mov ax, word [edx + 0xc]
mov word [ebp - 0x1c], ax
mov ecx, dword [ebp - 0x20]
and ecx, 0x1801
test ecx, ecx
jne 0x45165b
movsx edx, word [ebp - 0x18]
test edx, edx
jne 0x45165b
movsx eax, word [ebp - 0x1c]
test eax, eax
jne 0x45165b
mov dword [ebp - 0x28], 1
jmp 0x451662
mov dword [ebp - 0x28], 0
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x24]
cmp dword [edx + 0x40], 0
jne 0x45167a
mov eax, dword [ebp - 0x24]
cmp dword [eax + 0x44], 0
je 0x451683
mov ecx, dword [ebp - 4]
push ecx
call fcn.00402f00
mov edx, dword [ebp - 0x24]
cmp dword [edx + 0x40], 0
je 0x451696
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x45182f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
cmp dword [ebp + 8], 0
jne 0x451852
push 0x33c
push str.dlgcore.cpp
call fcn.004a6790
test eax, eax
je 0x451852
int3
xor eax, eax
test eax, eax
jne 0x451838
call fcn.004afa22
mov dword [ebp - 8], eax
push 5
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4518be
mov eax, dword [ebp + 8]
shr eax, 0x10
and eax, 0xffff
and eax, 0xffff
test eax, eax
je 0x4518a0
mov ecx, dword [ebp + 8]
push ecx
push str.ERROR:_Cannot_find_dialog_template_named__s._n
call fcn.00427765
add esp, 8
jmp 0x4518b7
mov edx, dword [ebp + 8]
and edx, 0xffff
push edx
push str.ERROR:_Cannot_find_dialog_template_with_IDD_0x_04X._n
call fcn.00427765
add esp, 8
xor eax, eax
jmp 0x4519e8
cmp dword [ebp + 0xc], 0
jne 0x4518ce
mov eax, 1
jmp 0x4519e8
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x451901
push str.Warning:_LoadResource_failed_for_dialog_template._n
push 0x58987c
call fcn.00427765
add esp, 8
mov eax, 1
jmp 0x4519e8
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
xor ecx, ecx
mov cx, word [eax + 2]
cmp ecx, 0xffff
jne 0x45192a
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0x14], eax
jmp 0x451932
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0xc]
push eax
call fcn.00402f00
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov edx, dword [ebp - 0x14]
and edx, 0x10000000
test edx, edx
je 0x451994
mov eax, dword [ebp + 8]
shr eax, 0x10
and eax, 0xffff
and eax, 0xffff
test eax, eax
je 0x451979
mov ecx, dword [ebp + 8]
push ecx
push str.ERROR:_Dialog_named__s_must_be_invisible._n
call fcn.00427765
add esp, 8
jmp 0x451990
mov edx, dword [ebp + 8]
and edx, 0xffff
push edx
push str.ERROR:_Dialog_with_IDD_0x_04X_must_be_invisible._n
call fcn.00427765
add esp, 8
xor eax, eax
jmp 0x4519e8
mov eax, dword [ebp - 0x14]
and eax, 0x40000000
test eax, eax
jne 0x4519e3
mov ecx, dword [ebp + 8]
shr ecx, 0x10
and ecx, 0xffff
and ecx, 0xffff
test ecx, ecx
je 0x4519c9
mov edx, dword [ebp + 8]
push edx
push str.ERROR:_Dialog_named__s_must_have_the_child_style._n
call fcn.00427765
add esp, 8
jmp 0x4519df
mov eax, dword [ebp + 8]
and eax, 0xffff
push eax
push str.ERROR:_Dialog_with_IDD_0x_04X_must_have_the_child_style._n
call fcn.00427765
add esp, 8
xor eax, eax
jmp 0x4519e8
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4539c1
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x1c]
push ecx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x4539f2
push 0x43d
push str.wincore.cpp
call fcn.004a6790
test eax, eax
je 0x4539f2
int3
xor edx, edx
test edx, edx
jne 0x4539cd
mov eax, dword [ebp - 8]
cmp dword [eax + 0x38], 0
jne 0x453a3e
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
add eax, 1
push eax
mov ecx, dword [ebp - 4]
push ecx
mov ecx, dword [ebp + 8]
call fcn.0045a457
push eax
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x1c]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0xffffffffffffffff
mov ecx, dword [ebp + 8]
call fcn.0045a3e3
jmp 0x453a56
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
mov ecx, dword [edx + 0x38]
mov eax, dword [ebp - 8]
mov edx, dword [eax + 0x38]
mov eax, dword [edx]
call dword [eax + 0x90]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4