joyce8/EMBER2024-capa huggingface dataset:
Function at 0x55c8f0
Capabilities:
Create shortcut via ishelllink

Disassembly:
sub esp, 0x210
lea eax, [esp]
push eax
push 0xbc4400
push 1
push 0
push 0xbc43f0
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jge 0x55c91e
xor eax, eax
add esp, 0x210
ret 8
mov eax, dword [esp]
mov edx, dword [esp + 0x214]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
mov eax, dword [esp]
lea edx, [esp + 4]
push edx
push 0xbc44a0
mov ecx, dword [eax]
push eax
call dword [ecx]
test eax, eax
jge 0x55c952
xor eax, eax
add esp, 0x210
ret 8
mov ecx, dword [esp + 0x218]
lea eax, [esp + 8]
push 0x104
push eax
push 0xffffffffffffffff
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [esp + 4]
lea ecx, [esp + 8]
push 2
push ecx
mov edx, dword [eax]
push eax
call dword [edx + 0x18]
mov eax, dword [esp + 4]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [esp]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, 1
add esp, 0x210
ret 8

Function at 0x574b6f
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x574ba7
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00572bbf
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00572b97
jmp 0x574bb3
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x576265
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x5762a7
call fcn.0057c10c
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x5762a7
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x57629e
xor eax, eax
jmp 0x5762af
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.005762b5
pop edi
pop esi
pop ebx
ret 4

Function at 0x57c63c
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x57c66a
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x57c688
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0057c5a2
jmp 0x57c688
mov eax, dword [esi + 0x14]
test eax, eax
je 0x57c688
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0057c5a2
test edi, edi
mov eax, edi
jne 0x57c672
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x410000
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
mov eax, dword [0x451bc5]
shl eax, 2
mov dword [0x451bc9], eax
push edi
push ecx
xor eax, eax
mov edi, section.TLSCBA_1
mov ecx, 0x451b6c
cmp ecx, edi
jbe 0x410024
sub ecx, edi
cld
rep stosb byte es:[edi], al
pop ecx
pop edi
mov edx, dword fs:[4]
mov eax, dword [edx - 8]
mov dword [0x451bcd], eax
mov eax, dword [edx - 4]
mov dword [0x451bd1], eax
sub edx, 4
mov dword [0x451740], edx
sub edx, 4
cmp edx, esp
jae 0x41004e
mov esp, edx
push 0
call fcn.0042d18b
pop ecx
push 0x451b98
push 0
call sub.KERNEL32.dll_GetModuleHandleA
mov dword [0x451bd6], eax
push 0
jmp fcn.0042fb04
Function at 0x410074
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, 0x451bf4
lea eax, [ebx + 9]
push eax
push 0xa
lea eax, [esi + 0x107]
push eax
push dword [ebp + 0xc]
lea eax, [ebx + 4]
push eax
push ebx
call sub.KERNEL32.dll_GetPrivateProfileStringA
lea eax, [ebx + 0x1b]
push eax
push 0x51
lea eax, [esi + 0x125]
push eax
push dword [ebp + 0x18]
lea eax, [ebx + 0x14]
push eax
lea eax, [ebx + 0x10]
push eax
call sub.KERNEL32.dll_GetPrivateProfileStringA
lea eax, [ebx + 0x2f]
push eax
push 0xa
lea eax, [esi + 0x11b]
push eax
push dword [ebp + 0x14]
lea eax, [ebx + 0x26]
push eax
lea eax, [ebx + 0x22]
push eax
call sub.KERNEL32.dll_GetPrivateProfileStringA
lea eax, [ebx + 0x43]
push eax
push 0xa
lea eax, [esi + 0x111]
push eax
push dword [ebp + 0x10]
lea eax, [ebx + 0x3a]
push eax
lea eax, [ebx + 0x36]
push eax
call sub.KERNEL32.dll_GetPrivateProfileStringA
lea eax, [ebx + 0x53]
push eax
push 5
lea eax, [esi + 0x176]
push eax
push dword [ebp + 0x1c]
lea eax, [ebx + 0x4e]
push eax
lea eax, [ebx + 0x4a]
push eax
call sub.KERNEL32.dll_GetPrivateProfileStringA
lea eax, [ebx + 0x6e]
push eax
push 0xff
push 0x4508fc
lea eax, [ebx + 0x66]
push eax
lea eax, [ebx + 0x5e]
push eax
lea eax, [ebx + 0x5a]
push eax
call sub.KERNEL32.dll_GetPrivateProfileStringA
lea eax, [ebx + 0x7f]
push eax
push 1
lea eax, [ebx + 0x79]
push eax
lea eax, [ebx + 0x75]
push eax
call sub.KERNEL32.dll_GetPrivateProfileIntA
mov dword [esi + 0x30b], eax
lea eax, [ebx + 0x92]
push eax
push 1
lea eax, [ebx + 0x8a]
push eax
lea eax, [ebx + 0x86]
push eax
call sub.KERNEL32.dll_GetPrivateProfileIntA
mov dword [esi + 0x30f], eax
lea eax, [ebx + 0xb4]
push eax
push 0xf
push 0x450190
lea eax, [ebx + 0xab]
push eax
lea eax, [ebx + 0x9f]
push eax
lea eax, [ebx + 0x99]
push eax
call sub.KERNEL32.dll_GetPrivateProfileStringA
lea eax, [ebx + 0xd6]
push eax
push 0xf
push 0x45019f
lea eax, [ebx + 0xcd]
push eax
lea eax, [ebx + 0xc1]
push eax
lea eax, [ebx + 0xbb]
push eax
call sub.KERNEL32.dll_GetPrivateProfileStringA
lea eax, [ebx + 0xf6]
push eax
push 0xf
push 0x4501ae
lea eax, [ebx + 0xed]
push eax
lea eax, [ebx + 0xe3]
push eax
lea eax, [ebx + 0xdd]
push eax
call sub.KERNEL32.dll_GetPrivateProfileStringA
lea eax, [ebx + 0x105]
push eax
push 0xff
push 0x4507fd
lea eax, [ebx + 0xfd]
push eax
call sub.KERNEL32.dll_GetPrivateProfileSectionA
test eax, eax
je 0x410210
call fcn.00411015
xor eax, eax
mov dword [0x451bec], eax
jmp 0x41021a
mov dword [0x451bec], 1
mov word [esi + 0xc], 0
mov eax, dword [0x451740]
inc dword [eax]
mov eax, esi
pop esi
pop ebx
pop ebp
ret
Function at 0x4103a3
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Get hostname
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov si, 0x1a0b
cmp word [ebx + 0xc], 1
jne 0x4103d6
push dword [ebx + 0x103]
call sub.WSOCK32.dll_closesocket
mov word [ebx + 0xc], 0
push 0x451daa
push ebx
call fcn.00410fbf
add esp, 8
push 0
push 1
push 2
call sub.WSOCK32.dll_socket
mov dword [ebx + 0x103], eax
test eax, eax
jbe 0x4104df
mov word [ebx + 0x9f], 2
push esi
call sub.WSOCK32.dll_htons
mov word [ebx + 0xa1], ax
push 0x4567dc
call fcn.0042d494
pop ecx
lea eax, [ebx + 0x125]
push eax
call fcn.00410ce5
pop ecx
mov dword [ebx + 0xa3], eax
test eax, eax
je 0x4104d8
push 0
push 0
push 0x80
push 0xffff
push dword [ebx + 0x103]
call sub.WSOCK32.dll_setsockopt
push 0
push 0
push 4
push 0xffff
push dword [ebx + 0x103]
call sub.WSOCK32.dll_setsockopt
push 0
push 0
push 8
push 0xffff
push dword [ebx + 0x103]
call sub.WSOCK32.dll_setsockopt
push 0x4567dc
call fcn.0042d494
pop ecx
push 0x10
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebx + 0x103]
call sub.WSOCK32.dll_WSAAsyncSelect
push 0x10
lea eax, [ebx + 0x9f]
push eax
push dword [ebx + 0x103]
call sub.WSOCK32.dll_connect
test eax, eax
je 0x4104cb
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2734
je 0x4104c5
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x4104c5
mov eax, 1
jmp 0x410504
mov word [ebx + 0xc], 2
push 0x40
add ebx, 0x5f
push ebx
call sub.WSOCK32.dll_gethostname
jmp 0x410504
mov eax, 1
jmp 0x410504
call sub.WSOCK32.dll_WSAGetLastError
push eax
call fcn.0042b328
pop ecx
push eax
push 0x451dba
push edi
call fcn.0042d854
add esp, 0xc
push edi
push ebx
call fcn.004110b6
add esp, 8
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x410509
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
push 0x451e34
push 0x451e30
lea eax, [ebx + 0x107]
push eax
lea eax, [ebx + 0x11b]
push eax
lea eax, [ebx + 0x111]
push eax
lea eax, [ebx + 0x111]
push eax
lea eax, [ebx + 0x111]
push eax
push 0x451de6
lea eax, [ebx + 0x17b]
push eax
call fcn.0042d854
add esp, 0x24
lea eax, [ebx + 0x17b]
push eax
call fcn.0042b1f8
pop ecx
mov esi, eax
push 0
push esi
lea eax, [ebx + 0x17b]
push eax
push dword [ebx + 0x103]
call sub.WSOCK32.dll_send
cmp esi, eax
jne 0x41059e
mov word [ebx + 0xc], 1
push 0x451e3e
lea eax, [ebx + 0x17b]
push eax
call fcn.0042d854
add esp, 8
push ebx
call fcn.004106a7
pop ecx
jmp 0x4105c3
call sub.WSOCK32.dll_WSAGetLastError
push eax
call fcn.0042b328
pop ecx
push eax
push 0x451e45
push edi
call fcn.0042d854
add esp, 0xc
push edi
push ebx
call fcn.004110b6
add esp, 8
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4105ec
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf8
push ebx
push esi
mov ebx, dword [ebp + 8]
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x27
je 0x4106a1
cmp word [ebx + 0xc], 2
jne 0x41062c
lea eax, [ebp - 0x208]
push eax
push dword [ebx + 0x103]
call sub.WSOCK32.dll___WSAFDIsSet
test eax, eax
je 0x41062c
push ebx
call fcn.00410509
pop ecx
push 0
mov eax, dword [0x451be8]
sub eax, section.TLSCBA_1
mov edx, 0x190
sub edx, eax
dec edx
push edx
push dword [0x451be8]
push dword [ebx + 0x103]
call sub.WSOCK32.dll_recv
mov esi, eax
push 0x451e48
push section.TLSCBA_1
call fcn.0042b3d0
add esp, 8
test eax, eax
je 0x410677
push esi
push ebx
call fcn.00410c68
add esp, 8
jmp 0x4106a1
mov eax, dword [0x451be8]
add eax, esi
sub eax, section.TLSCBA_1
mov edx, 0x190
sub edx, eax
dec edx
jge 0x410695
mov eax, section.TLSCBA_1
jmp 0x41069c
mov eax, dword [0x451be8]
add eax, esi
mov dword [0x451be8], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4106a7
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, dword [ebp + 8]
lea eax, [ebx + 0x17b]
push eax
call fcn.0042b1f8
pop ecx
mov esi, eax
push 0
push esi
lea eax, [ebx + 0x17b]
push eax
push dword [ebx + 0x103]
call sub.WSOCK32.dll_send
cmp esi, eax
je 0x4106ed
call sub.WSOCK32.dll_WSAGetLastError
push eax
call fcn.0042b328
pop ecx
push eax
push ebx
call fcn.004110b6
add esp, 8
pop esi
pop ebx
pop ebp
ret

Function at 0x410ce5
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
xor esi, esi
test ebx, ebx
je 0x410d4e
cmp byte [ebx], 0
je 0x410d4e
push ebx
call sub.WSOCK32.dll_inet_addr
mov esi, eax
cmp esi, 0xffffffff
jne 0x410d4e
xor esi, esi
jmp 0x410d28
push 0x451f17
call fcn.0042d80c
pop ecx
push 0x4567dc
call fcn.0042d494
pop ecx
push 1
call fcn.0042fa34
pop ecx
push ebx
call sub.WSOCK32.dll_gethostbyname
mov edi, eax
test edi, edi
jne 0x410d3c
mov eax, esi
inc esi
cmp eax, 3
jl 0x410d0a
cmp esi, 3
jge 0x410d4a
mov eax, dword [edi + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
jmp 0x410d4c
xor eax, eax
mov esi, eax
mov eax, esi
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x410ead
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe70
mov ax, 0x101
lea edx, [ebp - 0x190]
push edx
push eax
call sub.WSOCK32.dll_WSAStartup
mov esp, ebp
pop ebp
ret
Function at 0x41114f
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, 0x451bf4
push dword [ebp + 8]
lea eax, [esi + 0x346]
push eax
lea eax, [ebp - 2]
push eax
call fcn.0042d854
add esp, 0xc
push 0x4508fc
push 0
lea eax, [esi + 0x351]
push eax
lea eax, [esi + 0x349]
push eax
call sub.KERNEL32.dll_GetPrivateProfileIntA
mov ebx, eax
push 0x4508fc
push dword [ebp + 0xc]
lea eax, [ebp - 2]
push eax
lea eax, [esi + 0x359]
push eax
call sub.KERNEL32.dll_WritePrivateProfileStringA
inc ebx
push ebx
lea eax, [esi + 0x367]
push eax
lea eax, [ebp - 4]
push eax
call fcn.0042d854
add esp, 0xc
push 0x4508fc
lea eax, [ebp - 4]
push eax
lea eax, [esi + 0x372]
push eax
lea eax, [esi + 0x36a]
push eax
call sub.KERNEL32.dll_WritePrivateProfileStringA
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x4111da
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff10
push ebx
push esi
push edi
mov esi, 0x451bf4
push 0x4508fc
push 0
lea eax, [esi + 0x382]
push eax
lea eax, [esi + 0x37a]
push eax
call sub.KERNEL32.dll_GetPrivateProfileIntA
mov edi, eax
mov ebx, dword [ebp + 8]
inc ebx
jmp 0x411280
push ebx
lea eax, [esi + 0x38a]
push eax
lea eax, [ebp - 0xa0]
push eax
call fcn.0042d854
add esp, 0xc
push 0x4508fc
push 0x50
lea eax, [ebp - 0x50]
push eax
lea eax, [esi + 0x39b]
push eax
lea eax, [ebp - 0xa0]
push eax
lea eax, [esi + 0x38d]
push eax
call sub.KERNEL32.dll_GetPrivateProfileStringA
lea eax, [ebx - 1]
push eax
lea eax, [esi + 0x3aa]
push eax
lea eax, [ebp - 0xa0]
push eax
call fcn.0042d854
add esp, 0xc
push 0x4508fc
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0xa0]
push eax
lea eax, [esi + 0x3ad]
push eax
call sub.KERNEL32.dll_WritePrivateProfileStringA
inc ebx
lea eax, [edi - 1]
cmp ebx, eax
jl 0x41120d
add edi, 0xfffffffe
push edi
lea eax, [esi + 0x3bb]
push eax
lea eax, [ebp - 0xf0]
push eax
call fcn.0042d854
add esp, 0xc
push 0x4508fc
lea eax, [esi + 0x3cc]
push eax
lea eax, [ebp - 0xf0]
push eax
lea eax, [esi + 0x3be]
push eax
call sub.KERNEL32.dll_WritePrivateProfileStringA
push 0x4508fc
lea eax, [ebp - 0xf0]
push eax
lea eax, [esi + 0x3d5]
push eax
lea eax, [esi + 0x3cd]
push eax
call sub.KERNEL32.dll_WritePrivateProfileStringA
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41e479
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
cmp word [ebx + 0x14], 0xffff
je 0x41e4e6
mov eax, dword [ebx + 0x14]
shr eax, 0x10
test ax, 0xffff
je 0x41e49f
push dword [ebx + 0x14]
call fcn.0042ee80
pop ecx
push dword [ebx + 0x10]
call sub.USER32.dll_GetWindowTextLengthA
mov esi, eax
test esi, esi
jge 0x41e4c1
push 0
push 0x454332
call fcn.0042acb3
add esp, 8
mov dword [ebx + 0x14], eax
jmp 0x41e4e6
lea eax, [esi + 1]
push eax
call fcn.0042efd0
pop ecx
mov edi, eax
mov dword [ebx + 0x14], edi
mov byte [edi], 0
mov byte [edi + esi], 0
lea eax, [esi + 1]
mov edx, edi
push eax
push edx
push dword [ebx + 0x10]
call sub.USER32.dll_GetWindowTextA
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4229e3
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov eax, 0x455379
call fcn.0042d074
cmp esi, dword [0x4545c8]
jne 0x422a15
xor eax, eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x422b9a
push 0
push edi
call fcn.0041d293
add esp, 8
mov dword [ebp - 0x28], eax
push 0
push 0x423135
push 0x42a4ae
cmp dword [ebp - 0x28], 0
je 0x422a3d
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 8]
jmp 0x422a3f
xor eax, eax
push eax
push dword [ebp - 0x28]
call fcn.0042cf18
add esp, 0x14
mov ebx, eax
mov eax, dword [0x455244]
test eax, eax
je 0x422a7d
test ebx, ebx
jne 0x422a7d
cmp esi, 0x1f
je 0x422a7d
cmp esi, 0xa
je 0x422a7d
mov edx, dword [eax]
mov dword [edx + 0x10], edi
push edx
call fcn.0041c5e6
pop ecx
mov ebx, dword [0x455244]
xor eax, eax
mov dword [0x455244], eax
test ebx, ebx
jne 0x422a92
xor eax, eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x422b9a
cmp byte [0x4552f4], 0
jne 0x422aca
inc byte [0x4552f4]
call sub.KERNEL32.dll_GetVersion
test eax, 0x80000000
je 0x422ac0
call sub.KERNEL32.dll_GetVersion
and eax, 0xff
cmp eax, 4
jae 0x422ac0
xor eax, eax
jmp 0x422ac5
mov eax, 1
mov dword [0x4552f0], eax
cmp dword [0x4552f0], 0
je 0x422af3
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push esi
push ebx
mov eax, dword [ebx + 0xc]
call dword [eax + 4]
add esp, 0x10
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x422b9a
mov word [ebp - 0x14], 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push esi
push ebx
mov eax, dword [ebx + 0xc]
call dword [eax + 4]
add esp, 0x10
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x422b9a
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x422e70
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
push dword [ebx + 0x10]
mov eax, dword [ebx]
push dword [eax + 0x10]
push 0x7ff8
push eax
call fcn.0041e29c
add esp, 0x10
test eax, eax
je 0x422ea3
test eax, eax
setg al
and eax, 1
jmp 0x422f5c
mov esi, 1
cmp dword [ebx + 0x10], 0
je 0x422f5a
mov edi, dword [ebx + 0x10]
mov dword [ebp - 4], edi
push 0xf0
push dword [ebp - 4]
mov eax, dword [ebx]
mov eax, dword [eax + 0x6c]
push dword [eax + 0xc]
call sub.KERNEL32.dll_FindResourceA
mov edi, eax
test edi, edi
je 0x422f5a
mov dword [ebp - 8], edi
push dword [ebp - 8]
mov eax, dword [ebx]
mov eax, dword [eax + 0x6c]
push dword [eax + 0xc]
call sub.KERNEL32.dll_LoadResource
test eax, eax
je 0x422f5a
push eax
call sub.KERNEL32.dll_LockResource
mov edi, eax
test edi, edi
je 0x422f4f
jmp 0x422f46
mov ax, word [edi]
add edi, 2
mov word [ebp - 0xa], ax
mov ax, word [edi]
add edi, 2
mov word [ebp - 0xc], ax
mov eax, dword [edi]
add edi, 4
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], edi
movzx eax, word [ebp - 0xc]
mov dword [ebp - 0x18], eax
movzx eax, word [ebp - 0xa]
mov dword [ebp - 0x1c], eax
push dword [ebp - 0x14]
push 0
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
mov eax, dword [ebx]
push dword [eax + 0x10]
call sub.USER32.dll_SendDlgItemMessageA
inc eax
jne 0x422f43
xor esi, esi
add edi, dword [ebp - 0x10]
test esi, esi
je 0x422f4f
cmp byte [edi], 0
jne 0x422efc
mov eax, dword [ebx]
push dword [eax + 0x68]
call fcn.0041fa5b
pop ecx
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42332c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
mov ebx, dword [ebp + 8]
mov eax, 0x455578
call fcn.0042d074
cmp dword [ebx + 8], 0
jne 0x423368
mov al, byte [ebx + 0x1e]
shl eax, 0x1e
sar eax, 0x1f
je 0x42335e
push dword [ebx]
call sub.KERNEL32.dll_LockResource
mov dword [ebx + 8], eax
jmp 0x423368
push dword [ebx]
call sub.KERNEL32.dll_GlobalLock
mov dword [ebx + 8], eax
mov eax, dword [ebx + 8]
cmp dword [eax], 0xc
jne 0x423376
or byte [ebx + 0x1e], 1
jmp 0x4233c4
mov eax, dword [ebx + 8]
cmp dword [eax], 0x28
jne 0x423384
and byte [ebx + 0x1e], 0xfe
jmp 0x4233c4
push dword [ebx]
call sub.KERNEL32.dll_GlobalUnlock
push 0
push 0
push 0
push 1
push 0x423b67
push 0
mov word [ebp - 0x1c], 8
push 0
push 0x7fdc
lea eax, [ebp - 0xc]
push eax
call fcn.00417f45
add esp, 0xc
lea eax, [ebp - 0xc]
push eax
push 0x423b0f
call fcn.0042be44
add esp, 0x20
mov al, byte [ebx + 0x1e]
shl eax, 0x1f
sar eax, 0x1f
je 0x4233fb
mov eax, dword [ebx + 8]
mov ax, word [eax + 0xa]
push eax
call fcn.00414448
pop ecx
mov esi, eax
mov dword [ebx + 0x10], esi
lea eax, [esi + esi*2]
mov edx, dword [ebx + 8]
movzx edx, word [edx + 4]
mov dword [ebx + 0x14], edx
mov edx, dword [ebx + 8]
movzx edx, word [edx + 6]
mov dword [ebx + 0x18], edx
jmp 0x423425
mov eax, dword [ebx + 8]
mov ax, word [eax + 0xe]
push eax
call fcn.00414448
pop ecx
mov esi, eax
mov dword [ebx + 0x10], esi
mov eax, esi
shl eax, 2
mov edx, dword [ebx + 8]
mov edx, dword [edx + 4]
mov dword [ebx + 0x14], edx
mov edx, dword [ebx + 8]
mov edx, dword [edx + 8]
mov dword [ebx + 0x18], edx
mov edx, dword [ebx + 8]
add eax, dword [edx]
add eax, edx
mov dword [ebx + 0xc], eax
mov word [ebx + 0x1c], 0
mov eax, dword [ebp - 0x2c]
mov dword fs:[0], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x423bd8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff88
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov eax, 0x4555ec
call fcn.0042d074
push ebx
call fcn.00417de0
pop ecx
xor eax, eax
mov dword [ebx + 8], eax
xor eax, eax
mov dword [ebx + 0xc], eax
xor eax, eax
mov dword [ebx + 0x10], eax
xor eax, eax
mov dword [ebx + 0x14], eax
xor eax, eax
mov dword [ebx + 0x18], eax
and byte [ebx + 0x1e], 0xfe
and byte [ebx + 0x1e], 0xfd
mov dword [ebp - 0x78], 0x28
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x70], edi
push dword [ebp + 0x14]
call fcn.0041447a
pop ecx
mov word [ebp - 0x6a], ax
mov word [ebp - 0x6c], 1
xor eax, eax
mov dword [ebp - 0x60], eax
xor eax, eax
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x58], eax
xor edx, edx
mov dword [ebp - 0x54], edx
xor edx, edx
mov dword [ebp - 0x68], edx
movzx edx, word [ebp - 0x6a]
imul edx, esi
add edx, 0x1f
test edx, edx
jns 0x423c67
add edx, 0x1f
sar edx, 5
shl edx, 2
imul edx, edi
mov dword [ebp - 0x64], edx
shl eax, 2
mov esi, dword [ebp - 0x78]
add esi, eax
add esi, edx
push esi
push 2
call sub.KERNEL32.dll_GlobalAlloc
mov edi, eax
mov dword [ebx], edi
test edi, edi
jne 0x423cbd
push 0
push 0
push 0
push 1
push 0x423eb5
push 0
mov word [ebp - 0x40], 8
lea eax, [ebp - 0xc]
push eax
call fcn.0041579d
pop ecx
lea eax, [ebp - 0xc]
push eax
push 0x423e5d
call fcn.0042be44
add esp, 0x20
push dword [ebx]
call sub.KERNEL32.dll_GlobalLock
mov esi, eax
mov dword [ebx + 8], esi
push esi
mov edi, esi
lea esi, [ebp - 0x78]
mov ecx, 0xa
rep movsd dword es:[edi], dword [esi]
pop esi
push ebx
call fcn.0042332c
pop ecx
mov ax, word [ebp + 0x18]
mov word [ebx + 0x1c], ax
cmp ax, 1
jne 0x423d03
xor eax, eax
jmp 0x423cf9
mov ecx, dword [ebx + 8]
mov word [ecx + edx*2 + 0x28], ax
inc eax
movzx edx, ax
cmp edx, dword [ebp + 0x14]
jl 0x423cf0
jmp 0x423d6f
mov word [ebp - 0x40], 0x14
lea eax, [ebp - 0x30]
push eax
call fcn.0041ec83
pop ecx
mov eax, dword [ebx + 8]
add eax, 0x28
push eax
push dword [ebp + 0x14]
push 0
push dword [ebp - 0x30]
call sub.GDI32.dll_GetSystemPaletteEntries
xor eax, eax
cmp eax, dword [ebp + 0x14]
jge 0x423d5a
mov ecx, eax
shl ecx, 2
add ecx, dword [ebx + 8]
mov edx, ecx
add edx, 0x28
mov esi, ecx
add esi, 0x2a
mov cl, byte [edx]
xor byte [esi], cl
mov cl, byte [esi]
xor byte [edx], cl
mov dl, byte [edx]
xor byte [esi], dl
mov edx, dword [ebx + 8]
mov byte [edx + eax*4 + 0x2b], 0
inc eax
cmp eax, dword [ebp + 0x14]
jl 0x423d2e
mov eax, dword [0x451740]
dec dword [eax]
push 0
lea eax, [ebp - 0x30]
push eax
call fcn.0041ec34
add esp, 8
mov eax, dword [0x451740]
inc dword [eax]
mov eax, dword [ebp - 0x50]
mov dword fs:[0], eax
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret