joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4084b0
Capabilities:
Create thread
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x592a80]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x24], ecx
mov ecx, dword [ebp - 0x24]
call fcn.0041fd2c
push 1
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0x94]
push ecx
mov ecx, dword [ebp - 0x24]
call fcn.00407070
push 0
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + 0x94]
push eax
mov ecx, dword [ebp - 0x24]
call fcn.00407070
mov ecx, dword [ebp - 0x24]
call fcn.00408680
push 0
lea ecx, [ebp - 0x20]
push ecx
push 0
push 0x30
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 8], eax
push 0x20
push 0
push 0
push 0
push 0
push 0
mov ecx, dword [ebp - 0x24]
call fcn.0041c1a8
mov dword [0x5957f0], 0
mov ecx, dword [0x58b244]
and ecx, 0x800
je 0x408558
push 0
push 0
push 0
push 0x408420
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [ebp - 0x24]
mov dword [edx + 0x98], 0
push 0x594e68
push 0
push 0
push 0x23
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40858f
push 0
call fcn.0050a892
xor eax, eax
jmp 0x408666
push 0x11
push 0
push 0x595074
call fcn.00508920
add esp, 0xc
push 0x58b224
push 0x53fa08
push 0x595074
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov byte [0x595084], 0
push 0x208
push 0
push 0x5953e0
call fcn.00508920
add esp, 0xc
push 0x20
push section..share
push 0x5953e0
call fcn.005089a0
add esp, 0xc
push 0x208
push 0
push 0x5955e8
call fcn.00508920
add esp, 0xc
push 0x208
push 0x59d020
push 0x5955e8
call fcn.005089a0
add esp, 0xc
push 0xc00
push 0
mov eax, dword [ebp - 0x24]
add eax, 0x9c
push eax
call fcn.00508920
add esp, 0xc
push 0xc00
push 0x59d228
mov ecx, dword [ebp - 0x24]
add ecx, 0x9c
push ecx
call fcn.005089a0
add esp, 0xc
push 0
push 0x12c
push 1
mov ecx, dword [ebp - 0x24]
call fcn.00407000
push 1
mov ecx, dword [ebp - 0x24]
call fcn.004087d0
mov eax, 1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0050876f
mov esp, ebp
pop ebp
ret
Function at 0x408680
Capabilities:
Delete file
Enumerate files on windows
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x87c
mov eax, dword [0x592a80]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x87c], ecx
lea eax, [ebp - 0x460]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea ecx, [ebp - 0x668]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea edx, [ebp - 0x668]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea eax, [ebp - 0x258]
push eax
push 0x53fa0c
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x66c], eax
cmp dword [ebp - 0x66c], 0xffffffff
je 0x408774
push 0x53fa14
lea ecx, [ebp - 0x22c]
push ecx
call fcn.00509fee
add esp, 8
test eax, eax
je 0x40871f
push 0x53fa18
lea edx, [ebp - 0x22c]
push edx
call fcn.00509fee
add esp, 8
test eax, eax
jne 0x408721
jmp 0x408774
cmp dword [ebp - 0x258], 0x10
jne 0x40872c
jmp 0x408774
push str..9FC
lea eax, [ebp - 0x22c]
push eax
call fcn.0040c020
add esp, 8
test eax, eax
je 0x408774
lea ecx, [ebp - 0x22c]
push ecx
lea edx, [ebp - 0x668]
push edx
push 0x53fa2c
lea eax, [ebp - 0x878]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea ecx, [ebp - 0x878]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea edx, [ebp - 0x258]
push edx
mov eax, dword [ebp - 0x66c]
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x408799
cmp dword [ebp - 0x66c], 0xffffffff
jne 0x4086e2
mov ecx, dword [ebp - 0x66c]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
lea edx, [ebp - 0x460]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0050876f
mov esp, ebp
pop ebp
ret

Function at 0x409d00
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x62c
mov eax, dword [0x592a80]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x62c], ecx
push 0x208
push 0
lea eax, [ebp - 0x628]
push eax
call fcn.00508920
add esp, 0xc
push 0x58b224
push 0x53fcfc
push 0x53fd04
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
cmp dword [ebp + 0xc], 0
je 0x409d7a
push 0x53fd10
push 0x53fd2c
push 0x594e68
push 0x53fd38
lea edx, [ebp - 0x420]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
jmp 0x409d94
push 0x53fd4c
push 0x53fd68
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea ecx, [ebp - 0x420]
push ecx
push 0x104
lea edx, [ebp - 0x628]
push edx
push 0x53fd74
lea eax, [ebp - 0x210]
push eax
push 0x53fd78
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
jne 0x409dd1
xor eax, eax
jmp 0x409e07
lea ecx, [ebp - 0x628]
push ecx
call fcn.00509f9a
add esp, 4
cmp eax, 0x10
je 0x409de9
xor eax, eax
jmp 0x409e07
lea edx, [ebp - 0x628]
push edx
push 0x53fd84
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0050876f
mov esp, ebp
pop ebp
ret 8
Function at 0x409e20
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x82c
mov eax, dword [0x592a80]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x82c], ecx
mov eax, dword [ebp + 8]
push eax
push 0x53fd88
lea ecx, [ebp - 0x828]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 0x58b224
push 0x53fd90
push str._s_S
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push 0x53fda4
push 0x594e68
push str._s_s
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push 0
lea ecx, [ebp - 0x418]
push ecx
call fcn.0050aa0a
add esp, 8
test eax, eax
je 0x409eb4
push 0
lea edx, [ebp - 0x418]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dword [ebp - 4], 0
push 0x53fdbc
push str.IITI
push 0x594e68
push str._s_s_s
lea eax, [ebp - 0x620]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
lea ecx, [ebp - 0x620]
push ecx
lea edx, [ebp - 0x828]
push edx
lea eax, [ebp - 0x210]
push eax
push 0x53fdf8
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
test eax, eax
jne 0x409f0c
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
push str.PubLicKey.ini
push str.D:_s
lea edx, [ebp - 0x620]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x620]
push eax
lea ecx, [ebp - 0x828]
push ecx
lea edx, [ebp - 0x210]
push edx
push str.Info
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
test eax, eax
jne 0x409f53
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 2
jne 0x409f5d
xor eax, eax
jmp 0x409f62
mov eax, 1
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0050876f
mov esp, ebp
pop ebp
ret 4
Function at 0x40c1a0
Capabilities:
Encrypt data using rc6

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov dword [ebp - 0x28], 0xb7e15163
mov dword [ebp - 0xc], 0x9e3779b9
mov eax, dword [ebp + 8]
shr eax, 0x18
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 8]
shr ecx, 8
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
and edx, 0x10
mov dword [ebp - 0x14], edx
mov eax, dword [ebp + 8]
shl eax, 8
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
and ecx, 0x100
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp + 8]
shl edx, 0x18
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 8]
or eax, dword [ebp - 0x14]
or eax, dword [ebp - 0x10]
or eax, dword [ebp - 0x24]
mov dword [ebp + 8], eax
mov ecx, dword [ebp - 0x28]
mov dword [0x595818], ecx
mov dword [ebp - 0x18], 1
jmp 0x40c217
mov edx, dword [ebp - 0x18]
add edx, 1
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x18], 0x24
jae 0x40c236
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax*4 + 0x595814]
add ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x18]
mov dword [edx*4 + 0x595818], ecx
jmp 0x40c20e
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], 0x6c
mov dword [ebp - 0x1c], 1
jmp 0x40c262
mov edx, dword [ebp - 0x1c]
add edx, 1
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 4]
ja 0x40c2e6
push 3
call fcn.0040c0e0
add esp, 4
push eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx*4 + 0x595818]
add edx, dword [ebp - 0x2c]
add edx, dword [ebp - 0x20]
push edx
call fcn.0040c120
add esp, 8
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x30]
mov dword [eax*4 + 0x595818], ecx
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x2c]
add eax, dword [ebp - 0x20]
push eax
call fcn.0040c0e0
add esp, 4
push eax
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x2c]
add ecx, dword [ebp - 0x20]
push ecx
call fcn.0040c120
add esp, 8
mov dword [ebp + 8], eax
mov edx, dword [ebp + 8]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x18]
add eax, 1
xor edx, edx
mov ecx, 0x24
div ecx
mov dword [ebp - 0x18], edx
jmp 0x40c259
mov esp, ebp
pop ebp
ret
Function at 0x40e280
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0
mov ecx, dword [ebp + 8]
mov dword [ecx], 0
mov edi, dword [ebp + 8]
add edi, 8
mov ecx, 8
mov esi, 0x540268
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
pop ebp
ret
Function at 0x413870
Capabilities:
Hash data using sha384

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov eax, dword [ebp + 8]
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov ecx, dword [ebp + 8]
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov edi, dword [ebp + 8]
add edi, 0x10
mov ecx, 0x10
mov esi, 0x540508
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
pop ebp
ret

Function at 0x413bb0
Capabilities:
Hash data using sha512

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov eax, dword [ebp + 8]
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov ecx, dword [ebp + 8]
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov edi, dword [ebp + 8]
add edi, 0x10
mov ecx, 0x10
mov esi, 0x540788
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
pop ebp
ret

Function at 0x413c70
Capabilities:
Hash data using sha256
Hash data using sha384
Hash data using sha512

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0x100
ja 0x413cb1
cmp dword [ebp - 8], 0x100
je 0x413cc8
cmp dword [ebp - 8], 0x20
je 0x413cd1
cmp dword [ebp - 8], 0x30
je 0x413d04
cmp dword [ebp - 8], 0x40
je 0x413d42
jmp 0x413d77
cmp dword [ebp - 8], 0x180
je 0x413cfb
cmp dword [ebp - 8], 0x200
je 0x413d39
jmp 0x413d77
mov edx, dword [ebp + 8]
shr edx, 3
mov dword [ebp - 4], edx
mov eax, dword [ebp + 0xc]
mov dword [eax + 4], 0
mov ecx, dword [ebp + 0xc]
mov dword [ecx], 0
mov edi, dword [ebp + 0xc]
add edi, 8
mov ecx, 8
mov esi, 0x540268
rep movsd dword es:[edi], dword [esi]
jmp 0x413d7e
mov edx, dword [ebp + 8]
shr edx, 3
mov dword [ebp - 4], edx
mov eax, dword [ebp + 0xc]
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov ecx, dword [ebp + 0xc]
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov edi, dword [ebp + 0xc]
add edi, 0x10
mov ecx, 0x10
mov esi, 0x540508
rep movsd dword es:[edi], dword [esi]
jmp 0x413d7e
mov edx, dword [ebp + 8]
shr edx, 3
mov dword [ebp - 4], edx
mov eax, dword [ebp + 0xc]
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov ecx, dword [ebp + 0xc]
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov edi, dword [ebp + 0xc]
add edi, 0x10
mov ecx, 0x10
mov esi, 0x540788
rep movsd dword es:[edi], dword [esi]
jmp 0x413d7e
mov eax, 1
jmp 0x413d8c
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
mov dword [edx + 0xd0], eax
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4149b0
Capabilities:
Encrypt data using xtea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x20]
mov eax, dword [edx + 4]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x1c], 0x9e3779b9
mov dword [ebp - 0xc], 0x20
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 0x14]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
sub eax, 1
mov dword [ebp - 0xc], eax
test edx, edx
jbe 0x414a66
mov ecx, dword [ebp - 0x18]
shl ecx, 4
mov edx, dword [ebp - 0x18]
shr edx, 5
xor ecx, edx
add ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
and eax, 3
mov edx, dword [ebp - 0x10]
mov esi, dword [ebp - 0x14]
add esi, dword [edx + eax*4]
xor ecx, esi
add ecx, dword [ebp - 4]
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x1c]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 4]
shl ecx, 4
mov edx, dword [ebp - 4]
shr edx, 5
xor ecx, edx
add ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x14]
shr eax, 0xb
and eax, 3
mov edx, dword [ebp - 0x10]
mov esi, dword [ebp - 0x14]
add esi, dword [edx + eax*4]
xor ecx, esi
add ecx, dword [ebp - 0x18]
mov dword [ebp - 0x18], ecx
jmp 0x4149f8
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x18]
mov dword [edx + 4], eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x414a80
Capabilities:
Encrypt data using xtea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x20]
mov eax, dword [edx + 4]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0xc6ef3720
mov dword [ebp - 0x1c], 0x9e3779b9
mov dword [ebp - 0xc], 0x20
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0xc]
sub edx, 1
mov dword [ebp - 0xc], edx
test ecx, ecx
jbe 0x414b31
mov eax, dword [ebp - 4]
shl eax, 4
mov ecx, dword [ebp - 4]
shr ecx, 5
xor eax, ecx
add eax, dword [ebp - 4]
mov edx, dword [ebp - 0x14]
shr edx, 0xb
and edx, 3
mov ecx, dword [ebp - 0x10]
mov esi, dword [ebp - 0x14]
add esi, dword [ecx + edx*4]
xor eax, esi
mov edx, dword [ebp - 0x18]
sub edx, eax
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x1c]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x18]
shl ecx, 4
mov edx, dword [ebp - 0x18]
shr edx, 5
xor ecx, edx
add ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
and eax, 3
mov edx, dword [ebp - 0x10]
mov esi, dword [ebp - 0x14]
add esi, dword [edx + eax*4]
xor ecx, esi
mov eax, dword [ebp - 4]
sub eax, ecx
mov dword [ebp - 4], eax
jmp 0x414abf
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 0x14]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov dword [edx], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x18]
mov dword [ecx + 4], edx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x41be53
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x41be9a
call fcn.0041e54c
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x41be9a
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x41beb6
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.0041b953
mov esi, eax
test edi, edi
je 0x41beb4
test ebx, ebx
je 0x41beb4
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x41c295
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x537abb
call fcn.0050ac70
mov esi, ecx
cmp dword [esi + 0x6c], 0
jne 0x41c2ba
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x41c30c
call fcn.0041f371
push eax
lea ecx, [ebp - 0x10]
call fcn.00402650
mov ecx, dword [esi + 0x6c]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0050a3a5
push eax
call fcn.004157b4
add esp, 0x14
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.004026f0
mov eax, esi
call fcn.0050ad48
ret 8

Function at 0x42023e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor ebx, ebx
call fcn.0041e54c
mov esi, dword [eax + 0xc]
push 5
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x420277
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov ecx, dword [ebp - 4]
push esi
push dword [ebp + 0xc]
push ebx
call fcn.0041fe7b
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8

Function at 0x4202d5
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x78], ebx
test ebx, 0xffff0000
jne 0x4202f9
cmp dword [edi + 0x74], 0
jne 0x4202f9
movzx eax, bx
mov dword [edi + 0x74], eax
call fcn.0041e54c
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.00420296
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x422b7a
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push dword [ebp + 0xc]
mov ecx, esi
call fcn.0042281e
cmp dword [esi], 0
mov edi, eax
mov dword [esi + 0xc], 1
je 0x422bc4
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.00419c92
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.00418292
jmp 0x422bcf
mov eax, dword [ebp + 0x10]
push dword [eax]
push edi
call fcn.00422e70
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x422bd5
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 4]
lea eax, [ebp + 8]
push eax
push dword [ebp + 0xc]
call fcn.0041bf5f
push 0xfffffffffffffff0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowLongW]
push dword [ebp + 0xc]
and eax, 3
mov ecx, esi
cmp al, 3
je 0x422c12
call fcn.0042281e
mov dword [esi + 0xc], 1
jmp 0x422c17
call fcn.0042281e
cmp dword [esi], 0
je 0x422c60
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
test eax, eax
jle 0x422c38
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.00419c92
jmp 0x422c4a
mov ecx, dword [ebp + 0x10]
push 0xff
call fcn.004028b0
push 0x100
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.00418292
jmp 0x422c84
mov esi, dword [ebp + 0x10]
push dword [esi]
push 0xffffffffffffffff
push 0x14d
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
jne 0x422c84
push dword [esi]
push dword [ebp + 8]
call fcn.00422e70
pop esi
pop ebp
ret 0xc

Function at 0x46f80f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov dword [ebp - 4], ecx
test esi, esi
jne 0x46f829
call fcn.0041e54c
mov esi, dword [eax + 0xc]
push dword [0x599168]
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x46f847
xor eax, eax
pop edi
pop esi
leave
ret 8
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp + 0xc], eax
test eax, eax
je 0x46f83f
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
jne 0x46f874
xor esi, esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop ebx
jmp 0x46f841
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 4]
push eax
push ebx
call fcn.0046f73d
mov esi, eax
jmp 0x46f866

Function at 0x4e587e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push esi
mov esi, ecx
call fcn.0041a0fd
call fcn.004173d8
cmp eax, esi
pop esi
jne 0x4e589a
mov ecx, 0x597850
jmp fcn.0042aa0e
ret
Function at 0x4eddf9
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
test byte [esi + 4], 1
push edi
mov ebx, ecx
je 0x4ede11
mov edi, dword [esi + 0xc]
jmp 0x4ede51
push 5
push dword [esi + 0xc]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x4ede2a
call fcn.0041cafb
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x4ede3f
call fcn.0041cafb
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x4ede51
call fcn.0041cafb
call fcn.0041e54c
cmp dword [eax + 0x3c], 0
je 0x4ede66
push edi
mov ecx, ebx
call fcn.004eccb5
mov edi, eax
push dword [ebp + 0xc]
push edi
call fcn.004edd13
mov dword [ebp + 8], eax
mov eax, dword [ebx + 0x7c]
test eax, eax
je 0x4ede84
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
and dword [ebx + 0x7c], 0
mov eax, dword [ebp + 8]
test eax, eax
je 0x4ede90
mov edi, eax
mov dword [ebx + 0x7c], eax
or dword [esi + 4], 1
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x50876f
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x592a80]
jne 0x508779
repz ret
jmp fcn.0051100c

Function at 0x50a98b
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x50a9b2
call fcn.0050c552
mov dword [eax], esi
call fcn.0050c53f
push 0x16
pop esi
mov dword [eax], esi
call fcn.00512373
mov eax, esi
jmp 0x50aa07
test dword [ebp + 0xc], 0xfffffff9
jne 0x50a998
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x50a9df
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0050c565
pop ecx
call fcn.0050c53f
mov eax, dword [eax]
jmp 0x50aa07
test al, 0x10
jne 0x50aa05
test al, 1
je 0x50aa05
test byte [ebp + 0xc], 2
je 0x50aa05
call fcn.0050c552
mov dword [eax], 5
call fcn.0050c53f
mov dword [eax], 0xd
jmp 0x50a9d6
xor eax, eax
pop esi
pop ebp
ret