joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405796
Capabilities:
Create process on windows
Self delete

Disassembly:
push 0x10
mov eax, 0x5352a7
call fcn.0050e613
lea eax, [ebp - 0x14]
push eax
mov ecx, str._echo_off_r_ncd_.._r_nFOR__L_____i_IN__1_1_30__DO___r_nping_1.1.1.1__n_1__w_1000_nul_r_n_s__Q___s__r_nif_not_exist___s__goto_end_r_n__r_n:end_r_ndel__F__Q___s_
call fcn.00405b8c
and dword [ebp - 4], 0
lea eax, [ebp - 0x18]
push eax
mov ecx, str.ampru.bat
call fcn.00405b8c
mov byte [ebp - 4], 1
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.0040565f
pop ecx
pop ecx
mov byte [ebp - 4], 3
lea eax, [ebp - 0x18]
push eax
call fcn.00405be5
mov eax, dword [ebp + 8]
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x4057e8
sub eax, ecx
sar eax, 1
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov edi, dword [eax - 0xc]
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax - 0xc]
push 0xc
call fcn.004115b7
mov esi, eax
pop ecx
mov dword [ebp - 0x1c], esi
mov byte [ebp - 4], 4
test esi, esi
je 0x40583b
mov eax, dword [ebp - 0x18]
and dword [esi], 0
and dword [esi + 4], 0
add eax, ebx
lea edi, [eax + edi + 0x30c]
mov dword [esi + 8], 1
call fcn.004060aa
jmp 0x40583d
xor esi, esi
mov byte [ebp - 4], 3
mov dword [ebp - 0x1c], esi
mov byte [ebp - 4], 5
push dword [ebp - 0x10]
mov eax, dword [esi + 4]
push dword [ebp + 8]
mov edi, dword [esi]
push dword [ebp + 8]
push str.del__F
push dword [ebp - 0x14]
call fcn.00402cdd
add esp, 0x14
test eax, eax
jne 0x4058b0
mov ecx, dword [esi]
lea eax, [ebp - 0x18]
push eax
call fcn.00405b8c
mov byte [ebp - 4], 6
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x10]
call fcn.00405554
pop ecx
pop ecx
mov bl, al
mov byte [ebp - 4], 5
lea eax, [ebp - 0x18]
push eax
call fcn.00405be5
test bl, bl
je 0x4058b0
xor ebx, ebx
push ebx
push ebx
push ebx
push dword [ebp - 0x10]
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x4058b2
xor ebx, ebx
mov byte [ebp - 4], 3
dec dword [esi + 8]
jne 0x4058cc
xor edi, edi
call fcn.004060aa
push esi
call fcn.004115f1
pop ecx
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
call fcn.00405be5
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x14]
push eax
call fcn.00405be5
call fcn.0050e6eb
ret
Function at 0x4058ec
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
xor ebx, ebx
xor esi, esi
push edi
mov byte [ebp - 1], 0
cmp dword [ebp + 0x14], ebx
jb 0x40595d
ja 0x405908
cmp dword [ebp + 0x10], ebx
jbe 0x40595d
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 0x14]
sub ecx, esi
sbb eax, ebx
test eax, eax
ja 0x405924
jb 0x405920
cmp ecx, 0x10000
jae 0x405924
mov edi, ecx
jmp 0x405929
mov edi, 0x10000
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp + 0xc]
push edi
add eax, esi
push eax
push dword [ebp + 8]
mov dword [ebp - 8], edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40595d
cmp dword [ebp - 8], edi
jne 0x40595d
add esi, dword [ebp - 8]
adc ebx, 0
cmp ebx, dword [ebp + 0x14]
jb 0x405908
ja 0x40595d
cmp esi, dword [ebp + 0x10]
jb 0x405908
cmp esi, dword [ebp + 0x10]
jne 0x405978
cmp ebx, dword [ebp + 0x14]
jne 0x405978
or esi, ebx
je 0x405974
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov byte [ebp - 1], 1
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40776d
Capabilities:
Check if file exists

Disassembly:
push 8
mov eax, 0x53598a
call fcn.0050e613
mov edi, dword [ebp + 8]
push edi
call fcn.00401758
xor ebx, ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x14]
push eax
call fcn.00402e93
pop ecx
mov byte [ebp - 4], 1
call fcn.00402b48
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x14]
call fcn.00401781
push dword [edi]
mov byte [ebp - 0xd], bl
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4077b8
mov byte [ebp - 0xd], 1
mov eax, dword [edi]
push ebx
push ebx
push 4
push ebx
push 3
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x4077d9
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [ebp - 0xd], bl
je 0x40780c
push dword [edi]
call fcn.00403042
push ebx
call fcn.0050c3e1
pop ecx
pop ecx
push eax
push ecx
mov eax, esp
mov dword [ebp - 0x14], esp
push str.InstallTime
push eax
call fcn.004024e4
mov byte [ebp - 4], 2
push edi
mov byte [ebp - 4], bl
call fcn.004078c1
or dword [ebp - 4], 0xffffffff
mov eax, edi
call fcn.0050e6eb
ret 4

Function at 0x407926
Capabilities:
Set registry value

Disassembly:
push 8
mov eax, 0x5344bc
call fcn.0050e613
xor ebx, ebx
mov byte [ebp - 0xd], bl
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x14], ebx
je 0x407950
push dword [ebp - 0x14]
call esi
mov dword [ebp - 0x14], ebx
push ebx
lea eax, [ebp - 0x14]
push eax
push ebx
push 2
push ebx
push ebx
push ebx
push str.SoftwareClasses3564E8AE_A939_441b_BBD5_BA0F30A336FE
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, ebx
jne 0x407997
push 4
lea eax, [ebp + 8]
push eax
push 4
push 0x563050
push ebx
push dword [ebp - 0x14]
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
cmp eax, ebx
jne 0x407997
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov byte [ebp - 0xd], 1
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], ebx
je 0x4079a5
push dword [ebp - 0x14]
call esi
mov al, byte [ebp - 0xd]
call fcn.0050e6eb
ret
Function at 0x4079ae
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x10
mov eax, 0x534499
call fcn.0050e613
xor esi, esi
push 4
pop ebx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x10], esi
je 0x4079e1
push dword [ebp - 0x10]
call edi
mov dword [ebp - 0x10], esi
lea eax, [ebp - 0x10]
push eax
push 1
push esi
push str.SoftwareClasses3564E8AE_A939_441b_BBD5_BA0F30A336FE
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x407a28
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
push esi
push 0x563050
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, esi
jne 0x407a25
cmp dword [ebp - 0x18], ebx
jne 0x407a25
cmp dword [ebp - 0x1c], esi
jne 0x407a28
mov dword [ebp - 0x14], esi
mov ebx, dword [ebp - 0x14]
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x10], esi
je 0x407a39
push dword [ebp - 0x10]
call edi
mov eax, ebx
call fcn.0050e6eb
ret

Function at 0x407d62
Capabilities:
Set registry value

Disassembly:
push ebp
sub esp, 0x208
lea ebp, [esp - 4]
mov eax, dword [0x588710]
xor eax, ebp
mov dword [ebp + 0x208], eax
push 0xc
mov eax, 0x536163
call fcn.0050e613
mov ebx, 0x5900c0
xor esi, esi
push esi
mov ecx, ebx
mov dword [ebp - 0x18], ebx
call fcn.00424b4d
mov dword [ebp - 4], esi
push 0x407d5d
mov dword [0x5900c0], 0x563f44
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
call fcn.00404e18
push ecx
mov eax, esp
mov dword [ebp - 0x10], esp
push 0x563eb0
push eax
call fcn.004024e4
mov byte [ebp - 4], 1
mov byte [ebp - 4], 0
call fcn.00404aa7
xor eax, eax
mov word [ebp], ax
mov dword [esp], 0x206
lea eax, [ebp + 2]
push esi
push eax
call fcn.0050d860
add esp, 0xc
push 0x104
lea eax, [ebp]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.004024e4
mov byte [ebp - 4], 2
push 4
lea eax, [ebp - 0x10]
push eax
push 4
push dword [ebp - 0x14]
mov dword [ebp - 0x10], 1
push str.SoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsCompatibility_AssistantPersisted
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00401781
call fcn.0040c13b
push 0x58
mov eax, 0x407
push esi
mov esi, dword [sym.imp.USER32.dll_GetDC]
mov dword [0x589f78], eax
mov dword [0x589f7c], eax
call esi
mov edi, dword [sym.imp.GDI32.dll_GetDeviceCaps]
push eax
call edi
push 0x5a
push 0
call esi
push eax
call edi
push 0x58
push 0
call esi
push eax
call edi
mov dword [ebp - 0x10], eax
fild dword [ebp - 0x10]
push 0
push 0x589fac
fstp dword [0x58fff4]
push 0x58fff8
call sub.gdiplus.dll_GdiplusStartup
or dword [ebp - 4], 0xffffffff
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.0050be6b
add ebp, 0x20c
leave
ret
Function at 0x40bda5
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 0x18]
sub eax, dword [ebp + 0x10]
mov ecx, dword [esi + 0x84]
xor edx, edx
div ecx
mov dword [ebp - 8], eax
test edx, edx
je 0x40bdc4
inc dword [ebp - 8]
mov eax, dword [ebp + 0x1c]
sub eax, dword [ebp + 0x14]
mov ecx, dword [esi + 0x88]
xor edx, edx
div ecx
push ebx
mov ebx, eax
test edx, edx
je 0x40bddc
inc ebx
and dword [ebp - 4], 0
cmp dword [ebp - 8], 0
jle 0x40be2a
push edi
xor edi, edi
test ebx, ebx
jle 0x40be1e
mov eax, dword [esi + 0x88]
mov ecx, dword [esi + 0x84]
push 0xcc0020
push 0
push 0
push dword [ebp + 0xc]
push eax
imul eax, edi
push ecx
imul ecx, dword [ebp - 4]
push eax
push ecx
push dword [ebp + 8]
call dword [sym.imp.GDI32.dll_BitBlt]
inc edi
cmp edi, ebx
jl 0x40bded
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
jl 0x40bde7
pop edi
pop ebx
leave
ret 0x18
Function at 0x40e595
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 8
mov eax, 0x535404
call fcn.0050e613
mov eax, dword [0x589f78]
push 0x564b30
cmp eax, 0x411
jne 0x40e5bc
push 0x272a
jmp 0x40e661
cmp eax, 0x40c
jne 0x40e5cd
push 0xa094
jmp 0x40e661
cmp eax, 0x407
jne 0x40e5de
push 0xa095
jmp 0x40e661
cmp eax, 0x400a
jne 0x40e5ec
push 0xa097
jmp 0x40e661
cmp eax, 0x413
jne 0x40e5fa
push 0xa099
jmp 0x40e661
cmp eax, 0x804
jne 0x40e608
push 0xa096
jmp 0x40e661
cmp eax, 0x410
jne 0x40e616
push 0xa09b
jmp 0x40e661
cmp eax, 0x40b
jne 0x40e624
push 0xa09c
jmp 0x40e661
cmp eax, 0x406
jne 0x40e632
push 0xa09d
jmp 0x40e661
cmp eax, 0x416
jne 0x40e640
push 0xa09e
jmp 0x40e661
cmp eax, 0x81d
jne 0x40e64e
push 0xa09f
jmp 0x40e661
cmp eax, 0x414
jne 0x40e65c
push 0xa0a0
jmp 0x40e661
push 0x89
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x40e6ee
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40e6ee
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x40e6ee
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
lea eax, [esi + 1]
push eax
call fcn.004115e6
push esi
mov edi, eax
push ebx
push edi
call fcn.0050d1c0
add esp, 0xc
mov eax, esp
mov dword [ebp - 0x14], esp
push edi
push eax
mov byte [edi + esi], 0
call fcn.00405d0d
and dword [ebp - 4], 0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00402d94
pop ecx
mov dword [ebp - 4], 1
mov ecx, dword [ebp + 8]
push dword [eax]
add ecx, 0x84
call fcn.00420853
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00401781
call fcn.0050e6eb
ret 4
Function at 0x40e740
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x533f44
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov eax, dword [0x588710]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
mov ebp, dword [esp + 0x38]
xor ebx, ebx
mov dword [esp + 0x30], ebx
push 0xc
mov dword [esp + 0x18], ebx
call fcn.004115b7
add esp, 4
mov dword [esp + 0x18], eax
mov ecx, 1
mov dword [esp + 0x30], ecx
cmp eax, ebx
je 0x40e79c
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ecx
jmp 0x40e79e
xor eax, eax
mov byte [esp + 0x30], bl
mov dword [ebp], eax
mov dword [esp + 0x30], ebx
mov eax, dword [esp + 0x40]
push ebx
lea edx, [esp + 0x24]
push edx
push eax
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x50]
push eax
mov dword [esp + 0x30], ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x40e844
mov edi, dword [ebp]
cmp esi, dword [edi + 4]
je 0x40e805
mov eax, dword [edi]
push esi
push eax
call fcn.0050c54b
mov ecx, dword [edi + 4]
add esp, 8
mov dword [edi], eax
cmp esi, ecx
jbe 0x40e802
mov edx, esi
sub edx, ecx
push edx
add ecx, eax
push ebx
push ecx
call fcn.0050d860
add esp, 0xc
mov dword [edi + 4], esi
mov eax, dword [ebp]
mov edx, dword [esp + 0x3c]
push ebx
lea ecx, [esp + 0x44]
push ecx
mov dword [esp + 0x48], esi
mov eax, dword [eax]
push esi
push eax
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40e82b
cmp dword [esp + 0x40], esi
je 0x40e844
mov esi, dword [ebp]
cmp dword [esi + 4], ebx
je 0x40e844
mov eax, dword [esi]
push ebx
push eax
call fcn.0050c54b
add esp, 8
mov dword [esi], eax
mov dword [esi + 4], ebx
mov eax, ebp
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret

Function at 0x40e860
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0x18]
push ebp
push esi
xor esi, esi
xor ebp, ebp
push edi
test ebx, ebx
jb 0x40e8d6
ja 0x40e879
cmp esi, dword [esp + 0x20]
jae 0x40e8da
mov ecx, dword [esp + 0x20]
sub ecx, esi
mov eax, ebx
sbb eax, ebp
test eax, eax
ja 0x40e895
jb 0x40e891
cmp ecx, 0x10000
jae 0x40e895
mov edi, ecx
jmp 0x40e89a
mov edi, 0x10000
mov ecx, dword [esp + 0x1c]
push 0
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0x20]
push edi
lea edx, [esi + ecx]
push edx
push eax
mov dword [esp + 0x24], edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40e8d6
mov eax, dword [esp + 0x10]
cmp eax, edi
jne 0x40e8d6
add esi, eax
adc ebp, 0
cmp ebp, ebx
jb 0x40e879
ja 0x40e8d6
cmp esi, dword [esp + 0x20]
jb 0x40e879
cmp esi, dword [esp + 0x20]
jne 0x40e8f7
cmp ebp, ebx
jne 0x40e8f7
or esi, ebp
je 0x40e8ef
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret
Function at 0x40ed30
Capabilities:
Enumerate pe sections
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [ecx + 0x10]
push ebx
push ebp
mov ebp, dword [ecx + 0x14]
xor ebx, ebx
test ebp, ebp
ja 0x40ed47
cmp eax, 0x40
jbe 0x40ee27
push edi
mov edi, dword [ecx + 0xc]
mov eax, 0x5a4d
cmp word [edi], ax
jne 0x40ee2f
push esi
mov byte [ecx + 0x18], 1
mov edx, dword [edi + 0x3c]
xor esi, esi
lea eax, [edx + 0xf8]
cmp ebp, esi
jb 0x40ee1d
ja 0x40ed7c
cmp dword [ecx + 0x10], eax
jbe 0x40ee1d
add edx, edi
mov dword [ecx + 8], edx
cmp dword [edx], 0x4550
jne 0x40ee35
mov eax, 0x2000
test word [edx + 0x16], ax
jne 0x40ed9c
mov byte [ecx + 0x24], 1
movzx eax, word [edx + 0x18]
mov edx, 0x10b
cmp ax, dx
jne 0x40edb9
mov eax, dword [ecx + 8]
mov dword [ecx + 0x20], 1
add eax, 0x78
jmp 0x40edd2
mov edx, 0x20b
cmp ax, dx
jne 0x40edd5
mov eax, dword [ecx + 8]
mov dword [ecx + 0x20], 2
add eax, 0x88
mov dword [ecx + 4], eax
cmp dword [ecx + 4], ebx
je 0x40ee35
mov edx, dword [ecx + 8]
movzx edx, word [edx + 6]
mov dword [ecx + 0x1c], edx
test edx, edx
je 0x40ee35
mov eax, dword [ecx + 8]
movzx esi, word [eax + 0x14]
lea edx, [edx + edx*4]
add edx, edx
add edx, edx
add edx, edx
sub edx, edi
add edx, esi
lea edi, [edx + eax + 0x18]
xor edx, edx
cmp ebp, edx
jb 0x40ee1d
ja 0x40ee0d
cmp dword [ecx + 0x10], edi
jbe 0x40ee1d
lea eax, [esi + eax + 0x18]
pop esi
pop edi
pop ebp
mov dword [ecx], eax
mov eax, 1
pop ebx
ret
pop esi
pop edi
pop ebp
mov eax, 2
pop ebx
ret
pop ebp
mov eax, 2
pop ebx
ret
pop edi
pop ebp
mov eax, ebx
pop ebx
ret
pop esi
pop edi
pop ebp
mov eax, ebx
pop ebx
ret
Function at 0x40f030
Capabilities:
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x533f04
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebp
push esi
push edi
mov eax, dword [0x588710]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x38]
xor esi, esi
mov dword [esp + 0x30], esi
push 0xc
mov dword [esp + 0x18], esi
call fcn.004115b7
add esp, 4
mov dword [esp + 0x1c], eax
mov ecx, 1
mov dword [esp + 0x30], ecx
cmp eax, esi
je 0x40f089
mov dword [eax], esi
mov dword [eax + 4], esi
mov dword [eax + 8], ecx
jmp 0x40f08b
xor eax, eax
mov byte [esp + 0x30], 0
mov dword [ebp], eax
mov dword [esp + 0x30], esi
mov esi, dword [ebx]
mov edi, dword [ebp]
mov eax, dword [ebx + 4]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x20], eax
cmp esi, dword [edi + 4]
je 0x40f0d6
mov eax, dword [edi]
push esi
push eax
call fcn.0050c54b
mov ecx, dword [edi + 4]
add esp, 8
mov dword [edi], eax
cmp esi, ecx
jbe 0x40f0d3
mov edx, esi
sub edx, ecx
push edx
add ecx, eax
push 0
push ecx
call fcn.0050d860
add esp, 0xc
mov dword [edi + 4], esi
mov eax, dword [ebp]
mov ecx, dword [eax + 4]
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x10], ecx
push 5
add edx, 0xfffffff3
mov dword [esp + 0x1c], edx
mov eax, dword [eax]
lea ecx, [ebx + 8]
push ecx
lea edx, [esp + 0x20]
push edx
add ecx, 5
push ecx
lea ecx, [esp + 0x20]
push ecx
push eax
call fcn.0040f2c0
mov esi, dword [ebp]
test eax, eax
jne 0x40f156
mov edi, dword [esp + 0x10]
cmp edi, dword [esi + 4]
je 0x40f172
mov eax, dword [esi]
push edi
push eax
call fcn.0050c54b
mov ecx, dword [esi + 4]
add esp, 8
mov dword [esi], eax
cmp edi, ecx
jbe 0x40f13e
mov edx, edi
sub edx, ecx
push edx
add ecx, eax
push 0
push ecx
call fcn.0050d860
add esp, 0xc
mov dword [esi + 4], edi
mov eax, ebp
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x24
ret
cmp dword [esi + 4], 0
je 0x40f172
mov eax, dword [esi]
push 0
push eax
call fcn.0050c54b
add esp, 8
mov dword [esi], eax
mov dword [esi + 4], 0
mov eax, ebp
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x24
ret

Function at 0x414b7d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor ebx, ebx
call fcn.00423ffa
mov esi, dword [eax + 0xc]
push 5
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x414bb6
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov ecx, dword [ebp - 4]
push esi
push dword [ebp + 0xc]
push ebx
call fcn.004147c9
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8
Function at 0x414c14
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x58], ebx
test ebx, 0xffff0000
jne 0x414c38
cmp dword [edi + 0x54], 0
jne 0x414c38
movzx eax, bx
mov dword [edi + 0x54], eax
call fcn.00423ffa
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.00414bd5
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x417e17
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
cmp dword [0x58c180], 0
mov dword [ebp - 4], ecx
jne 0x417e2d
xor eax, eax
jmp 0x417e67
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
jne 0x417e3d
call fcn.00423ffa
mov esi, dword [eax + 0xc]
push edi
push dword [0x58a4fc]
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x417e63
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp + 0xc], eax
test eax, eax
jne 0x417e6b
xor eax, eax
pop edi
pop esi
leave
ret 8
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
jne 0x417e89
xor esi, esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop ebx
jmp 0x417e65
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 4]
push eax
push ebx
call fcn.00417d38
mov esi, eax
jmp 0x417e7b
Function at 0x4196f7
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push 0x54
mov eax, 0x5278d8
call fcn.0050e646
mov esi, ecx
xor ebx, ebx
push ebx
lea ecx, [ebp - 0x60]
mov dword [ebp - 4], ebx
call fcn.00413823
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 1
call fcn.00413030
push ebx
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 2
call fcn.00406fef
mov edi, vtable.CBitmap.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], edi
push dword [esi + 0x54]
lea eax, [ebp - 0x60]
push dword [esi + 0x50]
lea ecx, [ebp - 0x20]
push eax
mov byte [ebp - 4], 3
call fcn.0040bfb1
cmp eax, ebx
jne 0x41978e
push 0xffffffffffffffff
push ebx
push 0x3e8a
call fcn.00427b5b
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 2
mov dword [ebp - 0x20], edi
call fcn.00401622
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 1
call fcn.0041377b
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], bl
call fcn.00413877
xor eax, eax
call fcn.0050e6eb
ret 4
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x3c]
call fcn.00406fd5
mov ecx, dword [esi + 0x50]
mov dword [ebp - 0x14], eax
mov eax, dword [esi + 0x54]
mov dword [ebp - 0x40], eax
push 0x58c09c
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x44], ecx
push eax
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], ebx
call fcn.00407a41
push ebx
push ecx
push ecx
mov eax, esp
mov dword [eax], ebx
mov dword [eax + 4], ebx
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x18], esp
push eax
mov ecx, esi
call fcn.004173a5
push 0xff
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp + 8]
lea eax, [ebp - 0x3c]
push ebx
push ebx
push eax
mov ecx, esi
call fcn.00418c5b
lea eax, [ebp - 0x2c]
push eax
mov ecx, esi
call fcn.00415af8
push dword [ebp - 0x14]
lea ecx, [ebp - 0x3c]
call fcn.00406fd5
call fcn.00408ec8
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x419751
call dword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
jne 0x419840
push 0xffffffffffffffff
push ebx
push 0x3e8a
call fcn.00427b5b
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x41975e
lea ecx, [ebp - 0x20]
call fcn.004139fa
push eax
push 2
call dword [sym.imp.USER32.dll_SetClipboardData]
cmp eax, ebx
jne 0x419862
push 0xffffffffffffffff
push ebx
push 0x3e8a
call fcn.00427b5b
call dword [sym.imp.USER32.dll_CloseClipboard]
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 2
mov dword [ebp - 0x20], edi
call fcn.00401622
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 1
call fcn.0041377b
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], bl
call fcn.00413877
xor eax, eax
inc eax
jmp 0x419786
Function at 0x42065b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x4206a2
call fcn.00423ffa
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x4206a2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x4206be
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.004201d3
mov esi, eax
test edi, edi
je 0x4206bc
test ebx, ebx
je 0x4206bc
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x420ec2
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x52f45c
call fcn.0050e613
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x420ee7
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x420f2d
lea ecx, [ebp - 0x10]
call fcn.00411b60
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004117cd
add esp, 0x10
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.004017c9
mov eax, esi
call fcn.0050e6eb
ret 8