joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401040
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x401059
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x401094
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x401090
lea ebx, [ebx]
cmp esi, eax
jae 0x401094
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x401080
cmp esi, eax
jb 0x40109a
pop esi
pop edi
xor eax, eax
pop ebx
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x402d30
Capabilities:
Create directory

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push esi
mov esi, dword [esp + 0x14]
xor ebx, ebx
push edi
mov dword [esp + 0x10], ebx
xor edi, edi
lea eax, [edi + 1]
test eax, eax
jl 0x402da5
mov ecx, dword [esi]
cmp eax, dword [ecx - 0xc]
jge 0x402da5
add ecx, eax
push 0x2f
push ecx
call fcn.00449bad
add esp, 8
test eax, eax
je 0x402da5
sub eax, dword [esi]
mov edi, eax
cmp edi, 0xffffffff
je 0x402da5
push edi
lea eax, [esp + 0x1c]
push eax
mov ecx, esi
call fcn.00402a30
mov ecx, dword [eax]
push 0
push ecx
call ebp
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x402d47
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x402d47
cmp byte [esp + 0x1c], bl
jne 0x402db9
mov ecx, dword [esi]
push 0
push ecx
call ebp
mov esi, dword [esi]
push 0
push esi
jmp 0x402de8
mov eax, dword [esi]
push 0x2f
push eax
call fcn.00449c80
add esp, 8
test eax, eax
jne 0x402dcf
or eax, 0xffffffff
jmp 0x402dd1
sub eax, dword [esi]
push eax
lea edx, [esp + 0x20]
push edx
mov ecx, esi
call fcn.00402a30
mov eax, dword [eax]
push 0
mov ebx, 1
push eax
call fcn.0044a2c0
add esp, 8
mov esi, eax
neg esi
sbb esi, esi
inc esi
test bl, 1
je 0x402e1c
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402e1c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
Function at 0x402f70
Capabilities:
Get common file path
Get program files directory

Disassembly:
push 0xffffffffffffffff
push 0x45e5fd
mov eax, dword fs:[0]
push eax
sub esp, 0x118
mov eax, dword [0x4739a8]
xor eax, esp
mov dword [esp + 0x114], eax
push esi
push edi
mov eax, dword [0x4739a8]
xor eax, esp
push eax
lea eax, [esp + 0x124]
mov dword fs:[0], eax
mov dword [esp + 0x10], ecx
mov esi, dword [esp + 0x134]
mov dword [esp + 0x12c], 0
mov dword [esp + 0x14], esi
mov dword [esp + 0xc], 0
call fcn.0042c542
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x402fe5
push 0x80004005
call fcn.00401020
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea edi, [eax + 0x10]
mov dword [esp + 0x18], edi
mov dword [esp + 0x12c], 1
call fcn.0042c542
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40301a
push 0x80004005
call fcn.00401020
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi], eax
lea ecx, [esp + 0x1c]
push ecx
push 0
push 0
push 0x26
push 0
mov dword [esp + 0x20], 1
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jl 0x40306b
push 0x461a14
lea edx, [esp + 0x20]
push edx
push str._s_s
push esi
call fcn.00401710
mov ecx, dword [esp + 0x20]
add esp, 0x10
push 0
push esi
call fcn.00402d30
lea eax, [edi - 0x10]
mov byte [esp + 0x12c], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40308f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x124]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.004492d4
add esp, 0x124
ret 4
Function at 0x407810
Capabilities:
Resume thread

Disassembly:
sub esp, 0x10
push esi
push 0x32
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 4]
push eax
mov ecx, esi
call fcn.0042ce08
mov edx, dword [esi + 0x20]
push 1
lea ecx, [esp + 8]
push ecx
push edx
call dword [sym.imp.USER32.dll_InvalidateRect]
push 0
push 4
push 0
push 0
push esi
push 0x407800
call fcn.00437f2f
pop esi
test eax, eax
je 0x407866
mov eax, dword [eax + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, 1
add esp, 0x10
ret
push 0
push 0x10
push str.Couldnt_create_worker_thread_
call fcn.00433f2f
xor eax, eax
add esp, 0x10
ret
Function at 0x407e50
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x45ee08
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x4739a8]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov ecx, dword [esp + 0x1c]
mov dword [esi + 4], ecx
mov edx, dword [esp + 0x20]
mov dword [esi], vtable.CSelTextColor.0
mov dword [esi + 8], 0xffffffff
mov eax, dword [ecx]
mov eax, dword [eax + 0x30]
push edx
mov dword [esp + 0x18], 0
call eax
cmp dword [esi + 8], 0xffffffff
jne 0x407ea9
mov dword [esi + 8], eax
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 8

Function at 0x4084d0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x45ee73
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4739a8]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
call fcn.0042cbde
xor ecx, ecx
lea ebp, [esi + 0x10]
mov dword [esi], vtable.CMemDC.0
mov dword [esp + 0x28], ecx
mov dword [ebp + 4], ecx
mov dword [ebp], vtable.CBitmap.0
mov ebx, dword [esp + 0x30]
xor eax, eax
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x18], ecx
cmp dword [ebx + 0xc], ecx
mov byte [esp + 0x28], 1
sete al
mov dword [esi + 0x30], eax
cmp eax, ecx
je 0x4085ed
mov eax, dword [esp + 0x34]
lea edi, [esi + 0x20]
cmp eax, ecx
je 0x408552
push eax
push edi
call dword [sym.imp.USER32.dll_CopyRect]
jmp 0x40855c
mov eax, dword [ebx]
mov edx, dword [eax + 0x50]
push edi
mov ecx, ebx
call edx
mov eax, dword [ebx + 4]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push eax
mov ecx, esi
call fcn.0042d08a
mov eax, dword [edi + 0xc]
sub eax, dword [edi + 4]
mov ecx, dword [edi + 8]
sub ecx, dword [edi]
push eax
mov eax, dword [ebx + 4]
push ecx
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
mov ecx, ebp
call fcn.0042d346
test ebp, ebp
je 0x408594
mov ebp, dword [ebp + 4]
mov ecx, dword [esi + 4]
push ebp
push ecx
call fcn.0042d3d5
mov edx, dword [esi + 0x24]
mov dword [esi + 0x18], eax
mov eax, dword [edi]
push edx
push eax
lea ecx, [esp + 0x20]
push ecx
mov ecx, esi
call fcn.0042ccfa
cmp dword [esp + 0x38], 0
je 0x4085ff
mov ebx, dword [edi]
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 8]
mov ebp, dword [esi + 0x1c]
sub eax, dword [edi + 4]
mov edx, dword [esi + 0x24]
sub ecx, ebx
test ebp, ebp
je 0x4085d5
mov ebp, dword [ebp + 4]
push 0xcc0020
push edx
push ebx
push ebp
push eax
push ecx
push edx
mov edx, dword [esi + 4]
push ebx
push edx
call dword [sym.imp.GDI32.dll_BitBlt]
jmp 0x4085ff
mov eax, dword [ebx + 0xc]
mov dword [esi + 0xc], eax
mov ecx, dword [ebx + 4]
mov dword [esi + 4], ecx
mov edx, dword [ebx + 8]
mov dword [esi + 8], edx
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 0xc
Function at 0x409cf0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebx
push edi
mov edi, dword [esp + 0xc]
mov ebx, ecx
test edi, edi
je 0x409d7b
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x409d7b
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x409d23
and al, 0x10
xor ecx, ecx
cmp al, 0x10
sete cl
pop edi
pop ebx
mov eax, ecx
ret 4
push esi
push edi
call fcn.0044aebb
mov esi, eax
push 0x5c
push esi
call fcn.0044ae00
add esp, 0xc
test eax, eax
je 0x409d70
push esi
mov ecx, ebx
mov byte [eax], 0
call fcn.00409cf0
push esi
test eax, eax
jne 0x409d5b
call fcn.0044ae2d
add esp, 4
pop esi
pop edi
xor eax, eax
pop ebx
ret 4
call fcn.0044ae2d
add esp, 4
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x409d53
pop esi
pop edi
mov eax, 1
pop ebx
ret 4
pop edi
xor eax, eax
pop ebx
ret 4

Function at 0x409dd0
Capabilities:
Timestomp file

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x28
push edi
push 0
push 0
push 3
push 0
push 0
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
test edi, edi
jne 0x409dfb
pop edi
add esp, 0x28
ret 8
push esi
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x30]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
mov esi, eax
dec esi
neg esi
sbb esi, esi
add esi, 1
je 0x409e64
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0x10]
push ecx
push eax
shr eax, 0x10
push eax
call dword [sym.imp.KERNEL32.dll_DosDateTimeToFileTime]
mov esi, eax
test esi, esi
je 0x409e64
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
mov esi, eax
test esi, esi
je 0x409e64
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x1c]
push edx
mov eax, ecx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
pop edi
add esp, 0x28
ret 8

Function at 0x409f50
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
push edi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x409f6f
test al, 0x10
jne 0x409f6f
pop edi
xor eax, eax
pop esi
ret 4
push edi
lea eax, [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push edi
mov ecx, esi
call fcn.00409cf0
pop edi
pop esi
ret 4
Function at 0x40a050
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x5340
call fcn.0044aa60
mov eax, dword [0x4739a8]
xor eax, esp
mov dword [esp + 0x533c], eax
push esi
mov esi, dword [esp + 0x5348]
push edi
mov edi, ecx
cmp dword [edi + 4], 0
jne 0x40a080
xor eax, eax
jmp 0x40a208
test esi, esi
jne 0x40a087
lea esi, [edi + 8]
push esi
call fcn.00409cf0
test eax, eax
je 0x40a079
push ebx
lea eax, [esp + 0x10]
push eax
mov ecx, edi
call fcn.00409be0
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ecx, [esp + 0x10]
push ecx
call ebx
lea edx, [esp + 0x10]
dec edx
cmp byte [eax + edx], 0x5c
jne 0x40a0c0
mov eax, 1
jmp 0x40a207
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x248]
push eax
call esi
lea ecx, [esp + 0x244]
push ecx
call ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [esp + 0x244]
dec edx
cmp byte [eax + edx], 0x5c
je 0x40a0fe
push 0x461af4
lea eax, [esp + 0x248]
push eax
call ebx
cmp dword [esp + 0x5354], 0
je 0x40a124
lea ecx, [esp + 0x10]
push 0x5c
push ecx
call fcn.0044ae00
add esp, 8
test eax, eax
je 0x40a124
inc eax
push eax
lea edx, [esp + 0x14]
push edx
call esi
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x248]
push ecx
call ebx
lea edx, [esp + 0x244]
push edx
mov ecx, edi
call fcn.00409d90
test eax, eax
je 0x40a17a
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
lea eax, [esp + 0x25c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x40a17a
mov ecx, dword [edi + 4]
push ecx
call fcn.0040b750
test eax, eax
je 0x40a181
xor eax, eax
jmp 0x40a207
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x40a190
mov eax, dword [edi + 4]
push 0x5000
lea edx, [esp + 0x350]
push edx
push eax
call fcn.0040b0c0
mov esi, eax
test esi, esi
jle 0x40a1d4
push 0
lea ecx, [esp + 0x14]
push ecx
push esi
lea edx, [esp + 0x358]
push edx
push ebx
mov dword [esp + 0x24], 0
call ebp
test eax, eax
je 0x40a1d1
cmp dword [esp + 0x10], esi
je 0x40a190
or esi, 0xffffffff
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [edi + 4]
push eax
call fcn.0040b2c0
pop ebp
test esi, esi
jne 0x40a200
mov ecx, dword [esp + 0x228]
push ecx
lea edx, [esp + 0x248]
push edx
mov ecx, edi
call fcn.00409dd0
xor eax, eax
test esi, esi
sete al
pop ebx
mov ecx, dword [esp + 0x5344]
pop edi
pop esi
xor ecx, esp
call fcn.004492d4
add esp, 0x5340
ret 8
Function at 0x40a3d0
Capabilities:
Set registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 8
push ebx
mov ebx, dword [esp + 0x1c]
lea eax, [esp + 8]
push eax
lea ecx, [esp + 8]
push ecx
push 0
push 0x20006
push 0
push 0
push 0
push edx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x40a406
xor eax, eax
pop ebx
add esp, 8
ret
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
mov eax, dword [eax + 0xc]
push esi
push edi
push ecx
mov ecx, dword [esp + 0x20]
push edx
mov edx, dword [esp + 0x14]
push eax
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, eax
mov eax, dword [esp + 0xc]
push eax
call edi
push ebx
call edi
xor eax, eax
pop edi
test esi, esi
pop esi
sete al
pop ebx
add esp, 8
ret

Function at 0x40a570
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0xc
push ebp
mov ebp, dword [esp + 0x20]
lea eax, [esp + 4]
push eax
push 0x20019
push 0
push ecx
push ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x40a59b
xor eax, eax
pop ebp
add esp, 0xc
ret
mov ecx, dword [esp + 4]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push edi
mov edi, dword [esp + 0x20]
lea edx, [esp + 0x10]
push edx
push 0
lea eax, [esp + 0x1c]
push eax
push 0
push edi
push ecx
call ebx
test eax, eax
je 0x40a5d5
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop ebx
xor eax, eax
pop ebp
add esp, 0xc
ret
mov eax, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0x28]
push eax
mov ecx, esi
call fcn.0040a4c0
lea ecx, [esp + 0x14]
push ecx
push eax
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x20]
push edx
push 0
push edi
push eax
call ebx
test eax, eax
je 0x40a620
mov ecx, dword [esp + 0x10]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
call edi
push ebp
call edi
mov ecx, esi
call fcn.0040a500
pop esi
pop edi
pop ebx
xor eax, eax
pop ebp
add esp, 0xc
ret
mov edx, dword [esp + 0x18]
push edx
mov ecx, esi
call fcn.0040a4b0
mov eax, dword [esp + 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call esi
push ebp
call esi
pop esi
pop edi
pop ebx
mov eax, 1
pop ebp
add esp, 0xc
ret
Function at 0x40b8c0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
jne 0x40b8cf
xor eax, eax
pop esi
ret 0xc
mov eax, dword [0x4713f0]
test eax, eax
je 0x40b8dd
call fcn.0040b770
mov edx, dword [esp + 0x10]
cmp edx, 8
mov eax, dword [esp + 8]
not eax
jb 0x40b9d1
push ebx
push edi
mov edi, edx
shr edi, 3
xor ecx, ecx
mov cl, byte [esi]
mov ebx, eax
shr ebx, 8
sub edx, 8
xor ecx, eax
and ecx, 0xff
mov eax, dword [ecx*4 + 0x475a10]
xor eax, ebx
xor ecx, ecx
mov cl, byte [esi + 1]
inc esi
xor ecx, eax
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x475a10]
shr eax, 8
xor ecx, eax
xor eax, eax
mov al, byte [esi + 1]
inc esi
xor eax, ecx
and eax, 0xff
mov eax, dword [eax*4 + 0x475a10]
shr ecx, 8
xor eax, ecx
xor ecx, ecx
mov cl, byte [esi + 1]
inc esi
xor ecx, eax
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x475a10]
shr eax, 8
xor ecx, eax
xor eax, eax
mov al, byte [esi + 1]
inc esi
xor eax, ecx
and eax, 0xff
mov eax, dword [eax*4 + 0x475a10]
shr ecx, 8
xor eax, ecx
xor ecx, ecx
mov cl, byte [esi + 1]
inc esi
xor ecx, eax
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x475a10]
shr eax, 8
xor ecx, eax
xor eax, eax
mov al, byte [esi + 1]
inc esi
xor eax, ecx
and eax, 0xff
mov eax, dword [eax*4 + 0x475a10]
shr ecx, 8
xor eax, ecx
xor ecx, ecx
mov cl, byte [esi + 1]
inc esi
xor ecx, eax
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x475a10]
shr eax, 8
xor eax, ecx
inc esi
dec edi
jne 0x40b8f7
pop edi
pop ebx
test edx, edx
je 0x40b9f1
xor ecx, ecx
mov cl, byte [esi]
xor ecx, eax
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x475a10]
shr eax, 8
xor eax, ecx
inc esi
dec edx
jne 0x40b9d5
not eax
pop esi
ret 0xc
Function at 0x40e370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, dword [esp + 8]
test ebp, ebp
jne 0x40e37f
xor eax, eax
pop ebp
ret 0x14
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
push eax
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
je 0x40e3be
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40e3be
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push ebx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
test edi, edi
jne 0x40e3c7
pop edi
pop esi
pop ebx
xor eax, eax
pop ebp
ret 0x14
mov edx, dword [esp + 0x18]
push eax
push edi
push edx
push ebp
call fcn.0040e320
pop edi
pop esi
pop ebx
pop ebp
ret 0x14
Function at 0x411ef0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push ebp
mov ebx, ecx
xor ebp, ebp
cmp dword [ebx + 4], ebp
je 0x411f55
mov eax, dword [ebx + 4]
mov ecx, dword [eax + 0x3c]
push esi
mov esi, dword [ecx + eax + 0x78]
push edi
add esi, eax
xor edi, edi
cmp dword [esi + 0x18], edi
jbe 0x411f4c
mov ecx, dword [ebx + 4]
mov edx, dword [esi + 0x20]
lea eax, [edx + edi*4]
mov eax, dword [eax + ecx]
add eax, ecx
mov ecx, dword [esp + 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x411f46
mov edx, dword [esi + 0x24]
mov eax, dword [ebx + 4]
lea ecx, [edx + edi*2]
movzx edx, word [ecx + eax]
mov ecx, dword [esi + 0x1c]
lea edx, [ecx + edx*4]
mov ebp, dword [edx + eax]
add ebp, eax
inc edi
cmp edi, dword [esi + 0x18]
jb 0x411f10
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
ret 4
mov eax, ebp
pop ebp
pop ebx
ret 4
Function at 0x428e02
Capabilities:
Rebuild import table

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push edi
mov ecx, ebx
mov dword [esi + 0x18], 0x463024
call fcn.0042b760
lea edi, [esi + 0x28]
mov ecx, edi
call fcn.0042b4d0
mov dword [esi], 0x4631b8
mov dword [esi + 4], 0x463140
mov dword [esi + 8], 0x463118
mov dword [esi + 0xc], 0x463100
mov dword [esi + 0x10], 0x4630c4
mov dword [esi + 0x14], 0x4630b0
mov dword [esi + 0x18], 0x463094
mov dword [ebx], 0x46308c
mov dword [edi], 0x463084
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor ebx, ebx
mov dword [esi + 0x3c], eax
push ebx
mov dword [esi + 0x40], ebx
call fcn.0042bbbe
push 1
mov dword [esi + 0x40], ebx
call fcn.0042bb84
mov ebp, dword [sym.imp.USER32.dll_RegisterWindowMessageA]
add esp, 8
mov dword [esi + 0x40], eax
push str.DEF_SET_CONTEXT__44DC0B36_ACE9_4861_BB29_7951E0BB2066
mov byte [eax], bl
call ebp
mov ecx, dword [esp + 0x18]
mov dword [esi + 0x44], eax
mov eax, 1
mov dword [esi + 0x4c], ecx
lea ecx, [esi + 0xb8]
mov dword [esi + 0x48], eax
mov dword [esi + 0x60], ebx
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x70], ebx
mov dword [esi + 0x74], eax
mov dword [esi + 0x78], ebx
mov dword [esi + 0x7c], ebx
mov dword [esi + 0x80], eax
mov dword [esi + 0x84], ebx
mov dword [esi + 0x88], ebx
mov dword [esi + 0x90], ebx
mov dword [esi + 0x94], ebx
mov dword [esi + 0xb4], ebx
call fcn.0042a810
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.UpdateLayeredWindow
push eax
mov dword [esi + 0xd0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esi + 0xd4], eax
mov dword [esi + 0xe4], ebx
mov dword [esi + 0xe8], ebx
mov dword [esi + 0xec], ebx
mov dword [esi + 0xf0], ebx
mov dword [esi + 0xf4], ebx
mov dword [esi + 0xf8], ebx
mov dword [esi + 0x100], ebx
mov dword [esi + 0x104], ebx
mov eax, 0xff
mov dword [esi + 0xd8], eax
mov byte [esi + 0xfc], al
mov dword [esi + 0x108], ebx
mov dword [esi + 0x10c], ebx
mov dword [esi + 0x110], ebx
mov dword [esi + 0x114], ebx
mov dword [esi + 0x118], ebx
mov dword [esi + 0x11c], ebx
mov dword [esi + 0x120], ebx
mov dword [esi + 0x124], ebx
mov dword [esi + 0x128], ebx
mov dword [esi + 0x12c], ebx
mov dword [esi + 0x130], ebx
push str.DEF_PRIVATE_MESSAGE__SET_EVENT_LISTENER__cfde4500_A1B5_422b_AC7E_AFCD35AB3671
mov dword [esi + 0x134], ebx
call ebp
push str.DEF_PRIVATE_MESSAGE__CALL_LOAD_EXTERNAL_RESOURCE__4006D732_0800_4a8e_BD45_8D7A153facff
mov dword [esi + 0x138], eax
call ebp
push str.DEF_PRIVATE_MESSAGE__GET_OBJECT_PTR__A4679BFB_0972_46ae_A032_1A46711970F9
mov dword [esi + 0x13c], eax
call ebp
lea ecx, [esi + 0x144]
mov dword [esi + 0x140], eax
call fcn.004194e0
mov edx, dword [esp + 0x14]
push 1
push edx
mov ecx, edi
mov dword [esi + 0xe0], ebx
mov dword [esi + 0xdc], ebx
call fcn.0042b590
mov eax, dword [esi + 0x104]
pop edi
mov dword [esi + 0x158], eax
mov eax, esi
pop esi
pop ebp
pop ebx
ret 8
Function at 0x42b590
Capabilities:
Allocate or change rwx memory

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x18]
push esi
push edi
mov edi, dword [esp + 0x1c]
push 0x40
mov esi, ecx
push 0x1000
mov dword [esi + 8], eax
mov al, 0x68
push 0xd
push 0
mov dword [esi + 0x10], edi
mov byte [esp + 0x18], 0x58
mov byte [esp + 0x19], al
mov dword [esp + 0x1a], esi
mov byte [esp + 0x1e], 0x50
mov byte [esp + 0x1f], al
mov dword [esp + 0x20], 0x42b540
mov byte [esp + 0x24], 0xc3
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 0xd
lea ecx, [esp + 0xc]
push ecx
push eax
mov dword [esi + 4], eax
call fcn.00411e80
mov edx, dword [esi + 4]
add esp, 0xc
push 0xd
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
push 0xfffffffffffffffc
push edi
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov dword [esi + 0xc], eax
mov eax, dword [esi + 4]
push eax
push 0xfffffffffffffffc
push edi
call dword [sym.imp.USER32.dll_SetWindowLongA]
pop edi
pop esi
add esp, 0x10
ret 8

Function at 0x42b760
Capabilities:
Allocate or change rwx memory
Log keystrokes via application hook
Set global application hook

Disassembly:
sub esp, 0x10
push esi
push 0x40
push 0x1000
mov esi, ecx
mov al, 0x68
push 0xd
push 0
mov dword [esi], 0x4632e8
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov byte [esp + 0x14], 0x58
mov byte [esp + 0x15], al
mov dword [esp + 0x16], esi
mov byte [esp + 0x1a], 0x50
mov byte [esp + 0x1b], al
mov dword [esp + 0x1c], 0x42b720
mov byte [esp + 0x20], 0xc3
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 0xd
lea ecx, [esp + 8]
push ecx
push eax
mov dword [esi + 8], eax
call fcn.00411e80
mov edx, dword [esi + 8]
add esp, 0xc
push 0xd
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
mov eax, dword [esi + 8]
push 0
push eax
push 3
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov dword [esi + 4], eax
mov eax, esi
pop esi
add esp, 0x10
ret

Function at 0x4329ef
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x432a36
call fcn.00435941
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x432a36
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x432a52
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.00432569
mov esi, eax
test edi, edi
je 0x432a50
test ebx, ebx
je 0x432a50
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4