joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41a084
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x90]
sub esp, 0x110
mov eax, dword [0x43e974]
mov ecx, dword [ebp + 0x98]
push ebx
xor eax, ebp
push esi
mov dword [ebp + 0x8c], eax
xor edx, edx
push edi
xor eax, eax
cmp ecx, dword [eax*8 + 0x43eb08]
je 0x41a0bb
inc eax
cmp eax, 0x13
jb 0x41a0ac
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x43eb08]
jne 0x41a1de
mov eax, dword [0x441b8c]
cmp eax, 1
je 0x41a1b9
cmp eax, edx
jne 0x41a0eb
cmp dword [0x43e94c], 1
je 0x41a1b9
cmp ecx, 0xfc
je 0x41a1de
push 0x104
lea eax, [ebp - 0x7c]
push eax
push edx
mov byte [ebp + 0x88], dl
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x41a121
lea eax, [ebp - 0x7c]
push str._program_name_unknown_
push eax
call fcn.0041ed20
pop ecx
pop ecx
lea edi, [ebp - 0x7c]
mov eax, edi
push eax
call fcn.00419c80
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x41a155
mov eax, edi
push eax
call fcn.00419c80
mov edi, eax
lea eax, [ebp - 0x7c]
sub eax, 0x3b
push 3
add edi, eax
push 0x4377e0
push edi
call fcn.0041ee20
add esp, 0x10
push edi
call fcn.00419c80
push dword [esi + 0x43eb0c]
mov ebx, eax
call fcn.00419c80
lea eax, [ebx + eax + 0x1c]
pop ecx
add eax, 3
pop ecx
and eax, 0xfffffffc
call fcn.004196e0
mov ebx, esp
push str.Runtime_Error__n_nProgram:
push ebx
call fcn.0041ed20
push edi
push ebx
call fcn.0041ed30
push 0x4377c0
push ebx
call fcn.0041ed30
push dword [esi + 0x43eb0c]
push ebx
call fcn.0041ed30
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebx
call fcn.0041ec22
add esp, 0x2c
jmp 0x41a1de
push edx
lea eax, [ebp - 0x80]
push eax
lea esi, [esi + 0x43eb0c]
push dword [esi]
call fcn.00419c80
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x8c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x8c]
xor ecx, ebp
call fcn.004190d6
add ebp, 0x90
leave
ret
Function at 0x41ca9e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x41cace
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.0041c7e0
push 0x1c
add dword [ebx], ecx
lea eax, [ebp - 0x40]
push eax
call fcn.0041c7f0
push eax
push esi
push dword [ebp + 8]
call fcn.0041c7a5
add esp, 0x10
mov dword [ebp - 0x88], eax
call fcn.0041c7e0
push ss
leave
jo 0x41caea
inc ebp
lds edi, [edx - 0x3a]
inc ebp
invalid
lea eax, [ebp - 0x18]
mov byte [ebp - 0x18], bl
push eax
mov byte [ebp - 0x17], bl
mov byte [ebp - 0x16], 0x40
ljmp 0x45c6
in al, dx
jmp 0xd72f1126
mov byte [ebp - 0x12], 0xcd
mov byte [ebp - 0x11], 0xcb
mov byte [ebp - 0x10], 0xca
mov byte [ebp - 0xf], 0xde
mov byte [ebp - 0xe], 0xd3
mov byte [ebp - 0xd], 0xf9
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda

Function at 0x41cb84
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 9], 0xbf
call fcn.0041c7f0
push eax
push esi
push dword [ebp + 8]
call fcn.0041c7a5
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
invalid

Function at 0x41cbcc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc ebp
mov al, byte [0xa145c633]
mov byte cs:[ebp - 0x5e], 0x35

Function at 0x41cbf7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test dword [edi + edi*8 - 1], eax
dec dword [ebp + 0x5d88d445]
aam 0x50
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.0041c7f0
push eax
push esi
push dword [ebp + 8]
call fcn.0041c7a5
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.0041c7e0
adc dword [ebx + eax*8 + 0x7c9d8821], eax
invalid
Function at 0x41d6a7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
pop ecx
xor eax, eax
lea edi, [ebp - 0x22f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x12c], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x12b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x654], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x653]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.0041c7be
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
cld
invalid
call dword [edx]
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
push eax
call fcn.0041c7f0
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0041c7a5
add esp, 0xc
mov dword [ebp - 0x3d4], eax
call fcn.0041c7e0
push esi
jnp 0x41d7e4
inc esi
push 0x104
lea eax, [ebp - 0x12c]
push eax
call dword [ebp - 0x3d4]
mov dword [ebp - 0x28], eax
call fcn.0041c7e0
xchg dword [ecx*8 - 0x1f9a7f3d], ebx
add byte [eax - 0x39ff1e9b], al
inc ebp
loop 0x41d823
invalid
and byte [ebp - 0x1d], 0
mov byte [ebp - 0x1c], 0xa5
mov byte [ebp - 0x1b], 0x87
mov byte [ebp - 0x1a], 0x96
mov byte [ebp - 0x19], 0xb6
mov byte [ebp - 0x18], 0x87
mov byte [ebp - 0x17], 0x8f
mov byte [ebp - 0x16], 0x92
mov byte [ebp - 0x15], 0xb2
mov byte [ebp - 0x14], 0x83
mov byte [ebp - 0x13], 0x96
mov byte [ebp - 0x12], 0x8a
mov byte [ebp - 0x11], 0xa3
mov byte [ebp - 0x10], 0xe2
lea eax, [ebp - 0x20]
push eax
call fcn.0041c7f0
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0041c7a5
add esp, 0xc
mov dword [ebp - 0x370], eax
lea eax, [ebp - 0x654]
push eax
push 0x104
call dword [ebp - 0x370]
mov dword [ebp - 0x550], eax
mov eax, dword [ebp - 0x28]
movsx eax, byte [ebp + eax - 0x12d]
cmp eax, 0x5c
jne 0x41d88c
inc ebp
ljmp 0xc6b2
mov eax, dword [ebp - 0x28]
dec eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x550]
movsx eax, byte [ebp + eax - 0x655]
cmp eax, 0x5c
jne 0x41d8ac
mov eax, dword [ebp - 0x550]
dec eax
mov dword [ebp - 0x550], eax
and dword [ebp - 0x338], 0
and dword [ebp - 0x3d0], 0
jmp 0x41d8c9
Function at 0x41ec22
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x4420a8], ebx
push esi
push edi
jne 0x41eca2
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x41ecdd
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
mov dword [0x4420a8], eax
je 0x41ecdd
push 0x43822c
push edi
call esi
push 0x438218
push edi
mov dword [0x4420ac], eax
call esi
cmp dword [0x441b9c], 2
mov dword [0x4420b0], eax
jne 0x41eca2
push str.GetUserObjectInformationA
push edi
call esi
test eax, eax
mov dword [0x4420b8], eax
je 0x41eca2
push str.GetProcessWindowStation
push edi
call esi
mov dword [0x4420b4], eax
mov eax, dword [0x4420b4]
test eax, eax
je 0x41ece7
call eax
test eax, eax
je 0x41ecce
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x4420b8]
test eax, eax
je 0x41ecce
test byte [ebp - 8], 1
jne 0x41ece7
cmp dword [0x441ba8], 4
jb 0x41ece1
or byte [ebp + 0x12], 0x20
jmp 0x41ed06
xor eax, eax
jmp 0x41ed16
or byte [ebp + 0x12], 4
jmp 0x41ed06
mov eax, dword [0x4420ac]
test eax, eax
je 0x41ed06
call eax
mov ebx, eax
test ebx, ebx
je 0x41ed06
mov eax, dword [0x4420b0]
test eax, eax
je 0x41ed06
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x4420a8]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4205f2
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x3a4]
sub esp, 0x424
mov eax, dword [0x43e974]
xor ecx, ecx
xor eax, ebp
cmp dword [ebp + 0x3b4], ecx
push edi
mov edi, dword [ebp + 0x3b0]
mov dword [ebp + 0x3a0], eax
mov dword [ebp - 0x7c], edi
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x78], ecx
jne 0x42062e
xor eax, eax
jmp 0x420798
mov eax, dword [ebp + 0x3ac]
push ebx
mov ebx, dword [ebp + 0x3ac]
and eax, 0x1f
sar ebx, 5
push esi
lea esi, [eax + eax*8]
lea ebx, [ebx*4 + 0x443460]
mov eax, dword [ebx]
shl esi, 2
test byte [eax + esi + 4], 0x20
je 0x42066c
push 2
push ecx
push ecx
push dword [ebp + 0x3ac]
call fcn.004223fc
add esp, 0x10
xor ecx, ecx
mov eax, dword [ebx]
add eax, esi
test byte [eax + 4], 0x80
je 0x420706
cmp dword [ebp + 0x3b4], ecx
mov dword [ebp - 0x70], edi
mov dword [ebp - 0x68], ecx
jbe 0x420769
jmp 0x420690
xor ecx, ecx
mov dword [ebp - 0x6c], ecx
mov ecx, dword [ebp - 0x70]
sub ecx, dword [ebp - 0x7c]
lea eax, [ebp - 0x64]
cmp ecx, dword [ebp + 0x3b4]
jae 0x4206cb
mov edx, dword [ebp - 0x70]
inc dword [ebp - 0x70]
mov dl, byte [edx]
inc ecx
cmp dl, 0xa
jne 0x4206bc
inc dword [ebp - 0x78]
mov byte [eax], 0xd
inc eax
inc dword [ebp - 0x6c]
mov byte [eax], dl
inc eax
inc dword [ebp - 0x6c]
cmp dword [ebp - 0x6c], 0x400
jl 0x42069c
mov edi, eax
lea eax, [ebp - 0x64]
sub edi, eax
push 0
lea eax, [ebp - 0x80]
push eax
push edi
lea eax, [ebp - 0x64]
push eax
mov eax, dword [ebx]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x42072a
mov eax, dword [ebp - 0x80]
add dword [ebp - 0x74], eax
cmp eax, edi
jl 0x420733
mov eax, dword [ebp - 0x70]
sub eax, dword [ebp - 0x7c]
cmp eax, dword [ebp + 0x3b4]
jb 0x42068e
jmp 0x420733
push ecx
lea ecx, [ebp - 0x80]
push ecx
push dword [ebp + 0x3b4]
push edi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x42072a
mov eax, dword [ebp - 0x80]
and dword [ebp - 0x68], 0
mov dword [ebp - 0x74], eax
jmp 0x420733
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x74]
test eax, eax
jne 0x420793
cmp dword [ebp - 0x68], eax
je 0x420766
push 5
pop esi
cmp dword [ebp - 0x68], esi
jne 0x42075b
call fcn.00419f1a
mov dword [eax], 9
call fcn.00419f23
mov dword [eax], esi
jmp 0x42078e
push dword [ebp - 0x68]
call fcn.00419f2c
pop ecx
jmp 0x42078e
mov edi, dword [ebp - 0x7c]
mov eax, dword [ebx]
test byte [eax + esi + 4], 0x40
je 0x42077b
cmp byte [edi], 0x1a
jne 0x42077b
xor eax, eax
jmp 0x420796
call fcn.00419f1a
mov dword [eax], 0x1c
call fcn.00419f23
and dword [eax], 0
or eax, 0xffffffff
jmp 0x420796
sub eax, dword [ebp - 0x78]
pop esi
pop ebx
mov ecx, dword [ebp + 0x3a0]
xor ecx, ebp
pop edi
call fcn.004190d6
add ebp, 0x3a4
leave
ret
Function at 0x422eae
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 8], 0
cmp dword [ebp + 0x10], 0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edx, ebx
je 0x423084
mov eax, dword [ebp + 8]
mov ecx, eax
and eax, 0x1f
sar ecx, 5
lea esi, [eax + eax*8]
lea edi, [ecx*4 + 0x443460]
mov eax, dword [edi]
shl esi, 2
add eax, esi
mov cl, byte [eax + 4]
test cl, 2
jne 0x423084
test cl, 0x48
je 0x422f19
cmp byte [eax + 5], 0xa
je 0x422f19
mov eax, dword [edi]
mov al, byte [eax + esi + 5]
dec dword [ebp + 0x10]
mov byte [ebx], al
mov eax, dword [edi]
lea edx, [ebx + 1]
mov dword [ebp - 8], 1
mov byte [eax + esi + 5], 0xa
push 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x10]
mov eax, dword [edi]
push edx
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x422f6b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 5
pop esi
cmp eax, esi
jne 0x422f53
call fcn.00419f1a
mov dword [eax], 9
call fcn.00419f23
mov dword [eax], esi
jmp 0x422f63
cmp eax, 0x6d
je 0x423084
push eax
call fcn.00419f2c
pop ecx
or eax, 0xffffffff
jmp 0x423086
mov eax, dword [ebp - 0xc]
mov ecx, dword [edi]
add dword [ebp - 8], eax
test byte [ecx + esi + 4], 0x80
je 0x42307f
test eax, eax
je 0x422f92
cmp byte [ebx], 0xa
jne 0x422f92
mov eax, ecx
lea eax, [eax + esi + 4]
or byte [eax], 4
jmp 0x422f9b
mov eax, dword [edi]
lea eax, [eax + esi + 4]
and byte [eax], 0xfb
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
add ecx, eax
cmp eax, ecx
mov dword [ebp + 0x10], eax
mov dword [ebp - 8], ecx
jae 0x423079
mov eax, dword [ebp + 0x10]
mov al, byte [eax]
cmp al, 0x1a
je 0x423069
cmp al, 0xd
je 0x422fcd
mov byte [ebx], al
inc ebx
inc dword [ebp + 0x10]
jmp 0x42305b
dec ecx
cmp dword [ebp + 0x10], ecx
jae 0x422fe7
mov eax, dword [ebp + 0x10]
inc eax
cmp byte [eax], 0xa
jne 0x422fe2
add dword [ebp + 0x10], 2
jmp 0x42303b
mov dword [ebp + 0x10], eax
jmp 0x423057
inc dword [ebp + 0x10]
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
mov eax, dword [edi]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x42300f
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x423057
cmp dword [ebp - 0xc], 0
je 0x423057
mov eax, dword [edi]
test byte [eax + esi + 4], 0x48
je 0x423030
mov al, byte [ebp - 1]
cmp al, 0xa
je 0x42303b
mov byte [ebx], 0xd
mov ecx, dword [edi]
mov byte [ecx + esi + 5], al
jmp 0x42305a
cmp ebx, dword [ebp + 0xc]
jne 0x423040
cmp byte [ebp - 1], 0xa
jne 0x423040
mov byte [ebx], 0xa
jmp 0x42305a
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.004223fc
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x42305b
mov byte [ebx], 0xd
inc ebx
mov ecx, dword [ebp - 8]
cmp dword [ebp + 0x10], ecx
jb 0x422fb1
jmp 0x423079
mov eax, dword [edi]
test byte [eax + esi + 4], 0x40
jne 0x423079
lea esi, [eax + esi + 4]
or byte [esi], 2
sub ebx, dword [ebp + 0xc]
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 8]
jmp 0x423086
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4251a6
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x54], 0
mov eax, dword [edi + 0x58]
mov esi, dword [edi + 0x5c]
mov dword [ebp - 4], eax
je 0x4251dd
call fcn.0042bb92
mov ebx, dword [eax + 0xc]
push 5
push dword [edi + 0x54]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4251ee
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
xor ebx, ebx
inc ebx
test esi, esi
je 0x425227
cmp word [esi + 2], 0xffff
mov ecx, dword [esi]
jne 0x42520c
mov ecx, dword [esi + 0xc]
mov ax, word [esi + 0x12]
mov si, word [esi + 0x14]
jmp 0x425214
mov ax, word [esi + 0xa]
mov si, word [esi + 0xc]
test cx, 0x1801
jne 0x425225
test ax, ax
jne 0x425225
test si, si
je 0x425227
xor ebx, ebx
cmp dword [edi + 0x54], 0
je 0x425236
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret
Function at 0x425488
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x42edd9
call fcn.0041911c
sub esp, 0x18
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x58]
mov ebx, dword [esi + 0x5c]
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], eax
call fcn.0042bb92
cmp dword [esi + 0x54], 0
mov edi, dword [eax + 0xc]
je 0x4254d6
call fcn.0042bb92
mov edi, dword [eax + 0xc]
push 5
push dword [esi + 0x54]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x4254e7
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
jne 0x4254f3
or eax, 0xffffffff
jmp 0x4255f6
mov ecx, esi
call fcn.00424fca
mov dword [ebp - 0x14], eax
call fcn.00426c70
and dword [ebp - 0x20], 0
cmp dword [ebp - 0x14], 0
je 0x425536
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp dword [ebp - 0x14], eax
je 0x425536
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x425536
push 0
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [ebp - 0x20], 1
and dword [ebp - 4], 0
push esi
call fcn.00427e42
push dword [ebp - 0x14]
call fcn.00426bc8
push edi
push eax
push ebx
mov ecx, esi
call fcn.0042527b
xor ebx, ebx
cmp eax, ebx
je 0x4255aa
test byte [esi + 0x38], 0x10
je 0x425578
push 4
pop edi
mov ecx, esi
call fcn.00428b12
test ah, 1
je 0x425570
push 5
pop edi
push edi
mov ecx, esi
call fcn.0042666c
cmp dword [esi + 0x1c], ebx
je 0x4255aa
push 0x97
push ebx
push ebx
push ebx
push ebx
push ebx
mov ecx, esi
call fcn.00428c0f
jmp 0x4255aa
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x20], ebx
je 0x4255be
push 1
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
cmp dword [ebp - 0x14], ebx
je 0x4255d7
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [esi + 0x1c]
jne 0x4255d7
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x60]
mov ecx, esi
call fcn.00425004
cmp dword [esi + 0x54], ebx
je 0x4255f3
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [esi + 0x40]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret

Function at 0x4287af
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push esi
push edi
xor edi, edi
xor ebx, ebx
cmp dword [esp + 0x14], edi
mov ebp, ecx
je 0x4287f2
call fcn.0042bb92
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x4287f2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x42880d
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
push ebx
mov ecx, ebp
call fcn.00427923
test ebx, ebx
mov esi, eax
je 0x42880b
test edi, edi
je 0x42880b
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x42a231
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
mov eax, dword [0x43e974]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
xor eax, ebp
push edi
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, eax
mov eax, pe_nt_image_headers32
cmp ebx, eax
ja 0x42a284
push eax
lea eax, [ebp - 0x204]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextW]
cmp eax, ebx
jne 0x42a284
push edi
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x42a28c
push edi
push esi
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004190d6
leave
ret 8

Function at 0x42a7a2
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x43e974]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
xor eax, ebp
mov esi, ecx
cmp dword [esi + 0x50], 0
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], eax
je 0x42a7f3
push edi
call fcn.0042c739
mov esi, eax
test esi, esi
je 0x42a817
push 4
lea eax, [ebp + 0x10]
push eax
push 4
push 0
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push esi
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test edi, edi
sete al
jmp 0x42a817
push dword [ebp + 0x10]
lea eax, [ebp - 0x24]
push 0x4370fc
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push dword [esi + 0x64]
lea eax, [ebp - 0x24]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004190d6
leave
ret 0xc

Function at 0x42ad38
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x43e974]
xor eax, ebp
cmp dword [ebp + 8], 0x800
mov dword [ebp - 4], eax
push esi
mov esi, ecx
lea eax, [ebp - 0xc]
jne 0x42ad68
push 0x435a78
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x42ad7a
push 4
push eax
push 3
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x42adac
lea eax, [ebp - 0xc]
push eax
push esi
mov esi, 0x112
lea eax, [ebp - 0x230]
push esi
push eax
call fcn.00419035
add esp, 0x10
cmp eax, 0xffffffff
je 0x42adac
cmp eax, esi
jae 0x42adac
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
jmp 0x42adae
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004190d6
leave
ret