joyce8/EMBER2024-capa huggingface dataset:
Function at 0x415e9d
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x639d1e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1b0
mov dword [ebp - 0x1b8], ecx
push 0xa
mov ecx, dword [ebp - 0x1b8]
add ecx, 0x44
call fcn.004186a0
mov dword [ebp - 4], 0
push 0xa
mov ecx, dword [ebp - 0x1b8]
add ecx, 0x60
call fcn.004186a0
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x1b8]
mov dword [eax], 0x66f3b4
mov ecx, 1
test ecx, ecx
je 0x415f0d
mov dword [ebp - 0x1bc], 0
jmp 0x415f27
mov edx, dword [ebp - 0x1b8]
push edx
push str.CIOCPServer_p_n
call fcn.00411220
add esp, 8
mov dword [ebp - 0x1bc], eax
lea eax, [ebp - 0x19c]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov ecx, dword [ebp - 0x1b8]
add ecx, 0xc
push ecx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov edx, dword [ebp - 0x1b8]
mov dword [edx + 0x84], 0
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov ecx, dword [ebp - 0x1b8]
mov dword [ecx + 0x80], eax
mov edx, dword [ebp - 0x1b8]
mov dword [edx + 0x30], 0
mov eax, dword [ebp - 0x1b8]
mov byte [eax + 0x8c], 0
mov ecx, dword [ebp - 0x1b8]
mov byte [ecx + 0x3d], 0
mov edx, dword [ebp - 0x1b8]
mov dword [edx + 0x7c], 0
mov eax, dword [ebp - 0x1b8]
mov dword [eax + 0x88], 0
mov ecx, dword [ebp - 0x1b8]
mov byte [ecx + 0x3c], 0
mov edx, dword [ebp - 0x1b8]
mov dword [edx + 0x24], 0
mov eax, dword [ebp - 0x1b8]
mov dword [eax + 0x28], 0
mov ecx, dword [ebp - 0x1b8]
mov dword [ecx + 0x98], 0
mov edx, dword [ebp - 0x1b8]
mov dword [edx + 0x2c], 0x2710
mov eax, dword [ebp - 0x1b8]
mov dword [eax + 0x90], 0x2bf20
mov ecx, dword [ebp - 0x1b8]
mov dword [ecx + 0x94], 0x1388
mov edx, dword [ebp - 0x1b8]
mov dword [edx + 8], 0
mov byte [ebp - 0x1b4], 0x68
mov byte [ebp - 0x1b3], 0x78
mov byte [ebp - 0x1b2], 0x20
push 3
lea eax, [ebp - 0x1b4]
push eax
mov ecx, dword [ebp - 0x1b8]
add ecx, 0x3e
push ecx
call fcn.004ac230
add esp, 0xc
mov byte [ebp - 0x1b0], 0x45
mov byte [ebp - 0x1af], 0x77
mov byte [ebp - 0x1ae], 0x69
mov byte [ebp - 0x1ad], 0x6e
mov byte [ebp - 0x1ac], 0x68
mov byte [ebp - 0x1ab], 0x50
mov byte [ebp - 0x1aa], 0x72
mov byte [ebp - 0x1a9], 0x6f
mov byte [ebp - 0x1a8], 0x74
mov byte [ebp - 0x1a7], 0x6f
mov byte [ebp - 0x1a6], 0x63
mov byte [ebp - 0x1a5], 0x6f
mov byte [ebp - 0x1a4], 0x6c
mov byte [ebp - 0x1a3], 0x48
mov byte [ebp - 0x1a2], 0x6f
mov byte [ebp - 0x1a1], 0x73
mov byte [ebp - 0x1a0], 0x74
mov byte [ebp - 0x19f], 0x79
mov byte [ebp - 0x19e], 0
lea edx, [ebp - 0x1b0]
push edx
call fcn.004ad170
add esp, 4
push eax
lea eax, [ebp - 0x1b0]
push eax
mov ecx, dword [ebp - 0x1b8]
add ecx, 0x9c
push ecx
mov ecx, dword [ebp - 0x1b8]
call fcn.00418180
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1b8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x41680a
Capabilities:
Create tcp socket
Create thread
Create udp socket
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov dword [ebp - 0x3c], ecx
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x41682f
xor al, al
jmp 0x4168fc
push 0
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov ecx, dword [ebp - 0x3c]
mov dword [ecx + 0x88], eax
mov edx, dword [ebp - 0x3c]
cmp dword [edx + 0x88], 0
jne 0x416865
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
xor al, al
jmp 0x4168fc
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
lea edx, [ebp - 0x30]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x1c]
lea ecx, [eax + eax + 2]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x3c]
mov dword [edx + 0x38], 0
mov dword [ebp - 0x34], 0
jmp 0x41689f
mov eax, dword [ebp - 0x34]
add eax, 1
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x34]
cmp ecx, dword [ebp - 8]
jae 0x4168fa
lea edx, [ebp - 0x38]
push edx
push 0
mov eax, dword [ebp - 0x3c]
push eax
push 0x416941
push 0
push 0
call fcn.004add40
add esp, 0x18
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4168df
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ecx + 0x88]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x4168fc
mov eax, dword [ebp - 0x3c]
mov ecx, dword [eax + 0x38]
add ecx, 1
mov edx, dword [ebp - 0x3c]
mov dword [edx + 0x38], ecx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x416896
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x416900
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [ebp - 0xc]
push ecx
push 0x4163c9
push 0
push 0
call fcn.004add40
add esp, 0x18
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x416931
xor al, al
jmp 0x41693d
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x416b20
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x639d7c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
mov dword [ebp - 0x2c], ecx
push 0x18
call fcn.0061431c
add esp, 4
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0
je 0x416b67
push 1
mov ecx, dword [ebp - 0x24]
call fcn.004184f0
mov dword [ebp - 0x30], eax
jmp 0x416b6e
mov dword [ebp - 0x30], 0
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x1c], 0x8000
push 0
mov edx, dword [ebp - 0x14]
push edx
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x18]
push ecx
push 1
mov edx, dword [ebp + 8]
add edx, 0x50
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.WS2_32.dll_WSARecv]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x416be7
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
je 0x416be7
push 0
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x2c]
call fcn.00417bfd
cmp dword [ebp - 0x14], 0
je 0x416be7
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
push ecx
call fcn.00614345
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x41784a
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x639dcf
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
mov dword [ebp - 0x28], ecx
push 0x18
call fcn.0061431c
add esp, 4
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0
je 0x417891
push 2
mov ecx, dword [ebp - 0x20]
call fcn.004184f0
mov dword [ebp - 0x2c], eax
jmp 0x417898
mov dword [ebp - 0x2c], 0
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], 0x8000
push 3
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax + 0x34]
push ecx
mov edx, dword [ebp - 0x28]
call dword [edx + 4]
push 0
mov ecx, dword [ebp + 8]
add ecx, 4
call fcn.0040410e
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x3205c], eax
mov ecx, dword [ebp + 8]
add ecx, 4
call fcn.00403d9c
mov edx, dword [ebp + 8]
mov dword [edx + 0x32058], eax
push 0
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp + 8]
add edx, 0x32058
push edx
push 1
mov eax, dword [ebp + 8]
add eax, 0x32058
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
call dword [sym.imp.WS2_32.dll_WSASend]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x41796e
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
je 0x41796e
mov eax, 1
test eax, eax
je 0x417942
mov dword [ebp - 0x30], 0
jmp 0x417952
push 0x6dbffc
call fcn.00411220
add esp, 4
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x14], 0
je 0x41796a
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x24]
push edx
call fcn.00614345
add esp, 4
xor eax, eax
jmp 0x417973
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x417983
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x639dd9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x28
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0
xor eax, eax
mov al, byte [0x76bf40]
and eax, 1
test eax, eax
jne 0x4179d7
mov cl, byte [0x76bf40]
or cl, 1
mov byte [0x76bf40], cl
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x76bf38], eax
mov edx, dword [0x76bf48]
add edx, dword [ebp + 0xc]
mov dword [0x76bf48], edx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x76bf38]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x3e8
jb 0x417a37
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x76bf38], eax
mov eax, dword [0x76bf48]
imul eax, eax, 0x3e8
xor edx, edx
div dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x1c]
add ecx, 0x24
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov dword [0x76bf48], 0
cmp dword [ebp + 0xc], 0
jbe 0x417ae1
mov edx, dword [ebp + 0xc]
push edx
mov ecx, dword [ebp + 8]
add ecx, 4
call fcn.004041ac
mov ecx, dword [ebp + 8]
add ecx, 4
call fcn.00403d9c
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jbe 0x417a9a
mov eax, 1
test eax, eax
je 0x417a76
mov dword [ebp - 0x24], 0
jmp 0x417a8c
push 0x6dc008
call fcn.00411220
add esp, 4
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x1c]
call fcn.0041784a
jmp 0x417add
mov eax, 1
test eax, eax
je 0x417aac
mov dword [ebp - 0x2c], 0
jmp 0x417ac2
push 0x6dc01c
call fcn.00411220
add esp, 4
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x2c], ecx
mov ecx, dword [ebp + 8]
add ecx, 4
call fcn.00403ff7
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x32060]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov al, 1
jmp 0x417b1a
mov ecx, 1
test ecx, ecx
je 0x417af3
mov dword [ebp - 0x34], 0
jmp 0x417b09
push 0x6dc034
call fcn.00411220
add esp, 4
mov dword [ebp - 0x38], eax
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x34], edx
jmp 0x417b11
mov dword [ebp - 4], 0xffffffff
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x417bfd
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x639df5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov dword [ebp - 0x20], ecx
push str.RemoveStaleClient
lea ecx, [ebp - 0x1c]
call fcn.00618dec
mov dword [ebp - 4], 0
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x20]
add ecx, 0xc
push ecx
lea ecx, [ebp - 0x14]
call fcn.00418390
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1c]
call fcn.00618d7e
mov edx, 1
test edx, edx
je 0x417c60
mov dword [ebp - 0x24], 0
jmp 0x417c70
push str.CIOCPServer::RemoveStaleClient_n
call fcn.00411220
add esp, 4
mov dword [ebp - 0x24], eax
cmp dword [ebp + 0xc], 0
jne 0x417c9e
mov word [ebp - 0x18], 1
mov word [ebp - 0x16], 0
push 4
lea eax, [ebp - 0x18]
push eax
push 0x80
push 0xffff
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
call dword [sym.imp.WS2_32.dll_setsockopt]
push 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x20]
add ecx, 0x44
call fcn.00418960
test eax, eax
je 0x417d08
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_CancelIo]
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
mov edx, dword [ebp + 8]
mov dword [edx], 0xffffffff
mov eax, dword [ebp + 8]
cmp dword [eax], 0x103
jne 0x417ce9
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x417cd4
push 2
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x20]
mov eax, dword [edx + 0x34]
push eax
mov ecx, dword [ebp - 0x20]
call dword [ecx + 4]
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x20]
call fcn.00417dd8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00418400
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8

Function at 0x4180b7
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], 1
push 4
lea eax, [ebp - 4]
push eax
push 8
push 0xffff
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x418108
mov edx, 1
test edx, edx
je 0x4180f4
mov dword [ebp - 0x1c], 0
jmp 0x418104
push str.setsockopt_SO_UPDATE_ACCEPT_CONTEXT_
call fcn.00411220
add esp, 4
mov dword [ebp - 0x1c], eax
xor eax, eax
jmp 0x41817a
mov dword [ebp - 0x14], 0
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x14], 1
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0xc], edx
push 0
push 0
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 0x98000004
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
je 0x418175
mov eax, 1
test eax, eax
je 0x418161
mov dword [ebp - 0x20], 0
jmp 0x418171
push str.WSAIoctl_SIO_KEEPALIVE_VALS_
call fcn.00411220
add esp, 4
mov dword [ebp - 0x20], eax
xor eax, eax
jmp 0x41817a
mov eax, 1
mov esp, ebp
pop ebp
ret 0xc
Function at 0x418271
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0
jmp 0x4182a1
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp + 0x10]
jae 0x418354
mov edx, dword [ebp - 0xc]
add edx, 1
and edx, 0x800000ff
jns 0x4182c3
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 0xc], edx
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0xc]
xor ecx, ecx
mov cl, byte [eax]
mov edx, dword [ebp - 0x14]
add edx, ecx
and edx, 0x800000ff
jns 0x4182e5
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 0x14], edx
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0xc]
mov cl, byte [eax]
mov byte [ebp - 4], cl
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x14]
mov cl, byte [eax]
mov byte [edx], cl
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0x14]
mov al, byte [ebp - 4]
mov byte [edx], al
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x14]
xor ecx, ecx
mov cl, byte [eax]
add edx, ecx
and edx, 0x800000ff
jns 0x418334
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
add eax, dword [ebp - 8]
mov cl, byte [edx]
xor cl, byte [eax]
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 0x10]
mov byte [edx], cl
jmp 0x418298
mov esp, ebp
pop ebp
ret 0xc
Function at 0x42d18c
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x74], 0
jne 0x42d1c7
mov ecx, 1
test ecx, ecx
je 0x42d1b0
mov dword [ebp - 0x14], 0
jmp 0x42d1c0
push str.Call_one_of_the_CPictureEx::Load___member_functions_before_calling_Draw___n
call fcn.00411220
add esp, 4
mov dword [ebp - 0x14], eax
xor eax, eax
jmp 0x42d2e3
mov ecx, dword [ebp - 0x10]
call fcn.0042e676
test eax, eax
je 0x42d241
lea edx, [ebp - 4]
push edx
push 4
mov eax, dword [ebp - 0x10]
push eax
push 0x42dbaf
push 0
push 0
call fcn.004add40
add esp, 0x18
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x90], eax
mov edx, dword [ebp - 0x10]
cmp dword [edx + 0x90], 0
jne 0x42d22c
mov eax, 1
test eax, eax
je 0x42d215
mov dword [ebp - 0x18], 0
jmp 0x42d225
push str.Draw:_Couldnt_start_a_GIF_animation_thread_n
call fcn.00411220
add esp, 4
mov dword [ebp - 0x18], eax
xor eax, eax
jmp 0x42d2e3
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x90]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x42d2e1
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x98], 0
je 0x42d2e1
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x98]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x98]
mov ecx, dword [edx]
push eax
call dword [ecx + 0x18]
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x98]
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x98]
mov edx, dword [eax]
push ecx
call dword [edx + 0x1c]
push 0
mov eax, dword [ebp - 8]
neg eax
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 8]
push edx
push 0
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x50]
push ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x4c]
push eax
push 0
push 0
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x78]
push edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x98]
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x98]
mov edx, dword [eax]
push ecx
call dword [edx + 0x20]
test eax, eax
jne 0x42d2e1
push 0
mov ecx, dword [ebp - 0x10]
call fcn.004036c0
mov eax, 1
jmp 0x42d2e3
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x42d54f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00409410
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x42d58e
mov edx, dword [ebp - 0xc]
push edx
call fcn.00409410
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x42d5bb
mov eax, 1
test eax, eax
je 0x42d5a0
mov dword [ebp - 0x24], 0
jmp 0x42d5b4
mov ecx, dword [ebp + 8]
push ecx
push str.Load__resource_:_Error_loading_resource__s_n
call fcn.00411220
add esp, 8
mov dword [ebp - 0x24], eax
xor eax, eax
jmp 0x42d6be
mov edx, dword [ebp - 0xc]
push edx
call fcn.00409410
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
push eax
push 0x22
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x42d616
mov ecx, 1
test ecx, ecx
je 0x42d5f5
mov dword [ebp - 0x28], 0
jmp 0x42d605
push str.Load__resource_:_Error_allocating_memory_n
call fcn.00411220
add esp, 4
mov dword [ebp - 0x28], eax
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_FreeResource]
xor eax, eax
jmp 0x42d6be
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x42d63c
cmp dword [ebp - 0x10], 0
jne 0x42d676
mov edx, 1
test edx, edx
je 0x42d64e
mov dword [ebp - 0x2c], 0
jmp 0x42d65e
push str.Load__resource_:_Error_locking_memory_n
call fcn.00411220
add esp, 4
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeResource]
xor eax, eax
jmp 0x42d6be
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.004ac230
add esp, 0xc
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x18]
push edx
mov ecx, dword [ebp - 0x20]
call fcn.0042cb36
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8
Function at 0x4379b6
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x4379cd
jmp 0x437a2f
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov eax, dword [ebp + 0xc]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x437a29
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 8], eax
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.004ac230
add esp, 0xc
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [ebp - 4]
push eax
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov esp, ebp
pop ebp
ret 8

Function at 0x437a35
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x1c], ecx
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x437a4f
jmp 0x437b01
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x437a6b
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x437b01
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalSize]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 8]
push edx
call fcn.0061431c
add esp, 4
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov byte [ecx], 0xa
mov edx, dword [ebp - 8]
sub edx, 1
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0xc]
add ecx, 1
push ecx
call fcn.004ac230
add esp, 0xc
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
push 0
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 0x1b8]
push eax
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ecx + 0x1bc]
call fcn.00416bf7
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
push eax
call fcn.00614345
add esp, 4
mov esp, ebp
pop ebp
ret