joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4573af
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
cmp dword [0x4c0158], 0
jne 0x4573d0
mov eax, 8
jmp 0x45760b
cmp dword [ebx + 0x90], 0
jne 0x4573e3
mov eax, 0x11
jmp 0x45760b
test eax, eax
je 0x4573f4
mov dword [ebx + 0x4c], eax
mov eax, 0x10
jmp 0x45760b
xor edx, edx
mov dword [ebx + 0x80], edx
mov dword [ebx + 0xde], edx
mov dword [ebx + 0x106], edx
cmp dword [ebx + 0x44], 0
je 0x457413
xor eax, eax
mov dword [ebx + 0x48], eax
cmp dword [ebx + 0x74], 0
jne 0x45743a
mov dword [ebx + 0x74], 1
push 0
call fcn.004ac2e8
pop ecx
mov esi, eax
mov dword [ebx + 0x78], esi
test esi, esi
jg 0x457465
mov dword [ebx + 0x78], 0xffffffe7
jmp 0x457465
push 0
call fcn.004ac2e8
pop ecx
sub eax, dword [ebx + 0x78]
cmp eax, 0xf
jle 0x457465
push ebx
call fcn.00457876
pop ecx
push 0x19
push 6
push ebx
call fcn.004586f8
add esp, 0xc
xor eax, eax
jmp 0x45760b
mov eax, dword [0x4c0164]
mov edx, dword [ebx + 0xc]
mov esi, ebx
cmp dword [0x4c0168], 0
jne 0x457485
push 0
push 0
push eax
push edx
call sub.WSOCK32.dll_WSAAsyncSelect
jmp 0x457491
push 0
push 0
push eax
push edx
push esi
call fcn.0045b6b2
cmp dword [ebx + 0x10], 7
jne 0x457528
mov ax, word [ebx + 0x7c]
cmp dword [0x4c0168], 0
mov word [ebp - 4], ax
mov edx, ebx
mov word [ebp - 2], 0x1e
mov eax, dword [ebx + 0xc]
jne 0x4574cf
push 4
lea ecx, [ebp - 4]
push ecx
push 0x80
push 0xffff
push eax
call sub.WSOCK32.dll_setsockopt
jmp 0x4574e6
push 4
lea ecx, [ebp - 4]
push ecx
push 0x80
push 0xffff
push eax
push edx
call fcn.0045a663
mov eax, dword [ebx + 0xc]
mov edx, ebx
cmp dword [0x4c0168], 0
jne 0x4574fe
push 0
push eax
call sub.WSOCK32.dll_shutdown
jmp 0x457507
push 0
push eax
push edx
call fcn.0045a9d0
mov eax, dword [ebx + 0xc]
mov edx, ebx
cmp dword [0x4c0168], 0
jne 0x45751f
push 1
push eax
call sub.WSOCK32.dll_shutdown
jmp 0x457528
push 1
push eax
push edx
call fcn.0045a9d0
mov ecx, dword [ebx + 0xc]
lea eax, [ebp - 8]
mov dword [ebp - 8], ecx
push eax
push 0x4d3004
mov esi, ebx
call fcn.0045d8d0
add esp, 8
cmp dword [0x4c0168], 0
jne 0x457554
push dword [ebp - 8]
call sub.WSOCK32.dll_closesocket
jmp 0x45755d
push dword [ebp - 8]
push esi
call fcn.00459a3b
mov esi, eax
inc esi
jne 0x4575ed
mov esi, ebx
cmp dword [0x4c0168], 0
jne 0x457578
call sub.WSOCK32.dll_WSAGetLastError
jmp 0x45757e
push esi
call fcn.0045adc4
mov esi, eax
cmp esi, 0x2733
jne 0x4575a4
push 0
push dword [ebx + 4]
push 0x403
push dword [0x4c0164]
call sub.USER32.dll_PostMessageA
mov eax, 0x10
jmp 0x45760b
cmp dword [ebx + 0x7c], 0
jne 0x4575cd
mov dword [ebx + 0x7c], 1
push 0
push dword [ebx + 4]
push 0x403
push dword [0x4c0164]
call sub.USER32.dll_PostMessageA
mov eax, 0x10
jmp 0x45760b
push ebx
call fcn.00457876
pop ecx
push 0x18
push 6
push ebx
call fcn.004586f8
add esp, 0xc
push esi
push ebx
call fcn.0045861f
add esp, 8
jmp 0x45760b
push 0x17
push 6
push ebx
call fcn.004586f8
xor edx, edx
add esp, 0xc
mov dword [ebx + 0x90], edx
xor eax, eax
mov dword [ebx + 0xc], 0xffffffff
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x457876
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov ebx, dword [ebp + 8]
mov edx, dword [ebx + 0xc]
cmp edx, 0xffffffff
je 0x457980
mov eax, dword [0x4c0164]
mov esi, ebx
cmp dword [0x4c0168], 0
jne 0x4578aa
push 0
push 0
push eax
push edx
call sub.WSOCK32.dll_WSAAsyncSelect
jmp 0x4578b6
push 0
push 0
push eax
push edx
push esi
call fcn.0045b6b2
cmp dword [ebx + 0x10], 7
jne 0x45794b
mov word [ebp - 4], 1
mov word [ebp - 2], 0
mov eax, dword [ebx + 0xc]
mov edx, ebx
cmp dword [0x4c0168], 0
jne 0x4578f2
push 4
lea ecx, [ebp - 4]
push ecx
push 0x80
push 0xffff
push eax
call sub.WSOCK32.dll_setsockopt
jmp 0x457909
push 4
lea ecx, [ebp - 4]
push ecx
push 0x80
push 0xffff
push eax
push edx
call fcn.0045a663
mov eax, dword [ebx + 0xc]
mov edx, ebx
cmp dword [0x4c0168], 0
jne 0x457921
push 0
push eax
call sub.WSOCK32.dll_shutdown
jmp 0x45792a
push 0
push eax
push edx
call fcn.0045a9d0
mov eax, dword [ebx + 0xc]
mov edx, ebx
cmp dword [0x4c0168], 0
jne 0x457942
push 1
push eax
call sub.WSOCK32.dll_shutdown
jmp 0x45794b
push 1
push eax
push edx
call fcn.0045a9d0
mov ecx, dword [ebx + 0xc]
lea eax, [ebp - 8]
mov dword [ebp - 8], ecx
push eax
push 0x4d3004
mov esi, ebx
call fcn.0045d8d0
add esp, 8
cmp dword [0x4c0168], 0
jne 0x457977
push dword [ebp - 8]
call sub.WSOCK32.dll_closesocket
jmp 0x457980
push dword [ebp - 8]
push esi
call fcn.00459a3b
mov dword [ebx + 0xc], 0xffffffff
xor edx, edx
xor eax, eax
mov dword [ebx + 0x80], edx
mov dword [ebx + 0xde], edx
mov dword [ebx + 0x106], edx
mov dword [ebx + 0x90], eax
xor ecx, ecx
xor eax, eax
mov dword [ebx + 0xfa], ecx
mov dword [ebx + 0x12a], eax
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x457a01
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
cmp dword [ebx + 0xc], 0xffffffff
jne 0x457a17
xor eax, eax
jmp 0x457a70
mov dword [ebp - 4], 0x10
mov esi, dword [ebx + 0xc]
mov edi, ebx
cmp dword [0x4c0168], 0
jne 0x457a3c
lea edx, [ebp - 4]
lea ecx, [ebp - 0x14]
push edx
push ecx
push esi
call sub.WSOCK32.dll_getsockname
jmp 0x457a4b
lea eax, [ebp - 4]
push eax
lea edx, [ebp - 0x14]
push edx
push esi
push edi
call fcn.00459d12
inc eax
jne 0x457a52
xor eax, eax
jmp 0x457a70
mov si, word [ebp - 0x12]
cmp dword [0x4c0168], 0
mov edi, ebx
jne 0x457a69
push esi
call sub.WSOCK32.dll_ntohs
jmp 0x457a70
push esi
push edi
call fcn.0045a35c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x459ac9
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff44
push ebx
push esi
push edi
xor edi, edi
mov eax, dword [ebp + 8]
xor esi, esi
test eax, eax
je 0x459ae3
mov esi, dword [eax + 4]
test eax, eax
je 0x459aea
mov edi, dword [eax + 8]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.WSOCK32.dll_connect
mov ebx, eax
call sub.WSOCK32.dll_WSAGetLastError
mov dword [0x4d3000], eax
lea eax, [ebp - 0xbc]
push eax
push dword [0x4d3000]
call fcn.0045ae3b
add esp, 8
lea edx, [ebp - 0xbc]
push edx
push ebx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
push str.Sock_ID_lu_connect__u_0x_p__d_______d___s_
lea ecx, [ebp - 0xa0]
push ecx
call fcn.004a00a0
add esp, 0x20
lea eax, [ebp - 0xa0]
push eax
push edi
push dword [0x4c0170]
push dword [0x4c016c]
call sub.USER32.dll_SendMessageA
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x459b63
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff30
push ebx
push esi
push edi
xor edi, edi
mov eax, dword [ebp + 8]
xor esi, esi
test eax, eax
je 0x459b7d
mov esi, dword [eax + 4]
test eax, eax
je 0x459b84
mov edi, dword [eax + 8]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.WSOCK32.dll_ioctlsocket
mov ebx, eax
call sub.WSOCK32.dll_WSAGetLastError
mov dword [0x4d3000], eax
lea eax, [ebp - 0xd0]
push eax
push dword [0x4d3000]
call fcn.0045ae3b
add esp, 8
mov edx, dword [ebp + 0x10]
sub edx, 0x8004667e
je 0x459bd0
sub edx, 0xc0000001
je 0x459be5
sub edx, 0xc88
je 0x459bfb
jmp 0x459c13
push esi
push edi
mov esi, str.FIONBIO
lea edi, [ebp - 0xb4]
mov eax, edi
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
jmp 0x459c2a
push esi
push edi
mov esi, str.FIONREAD
lea edi, [ebp - 0xb4]
mov eax, edi
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
pop edi
pop esi
jmp 0x459c2a
push esi
push edi
mov esi, str.SIOCATMARK
lea edi, [ebp - 0xb4]
mov eax, edi
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
pop edi
pop esi
jmp 0x459c2a
push dword [ebp + 0x10]
push 0x4c0c5e
lea edx, [ebp - 0xb4]
push edx
call fcn.004a00a0
add esp, 0xc
lea ecx, [ebp - 0xd0]
lea eax, [ebp - 0xb4]
push ecx
push ebx
push dword [ebp + 0x14]
push eax
lea edx, [ebp - 0xa0]
push dword [ebp + 0xc]
push esi
push str.Sock_ID_lu_ioctlsocket__u__s_0x_p_______d___s_
push edx
call fcn.004a00a0
add esp, 0x20
lea ecx, [ebp - 0xa0]
push ecx
push edi
push dword [0x4c0170]
push dword [0x4c016c]
call sub.USER32.dll_SendMessageA
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x459d12
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff44
push ebx
push esi
push edi
xor edi, edi
mov eax, dword [ebp + 8]
xor esi, esi
test eax, eax
je 0x459d2c
mov esi, dword [eax + 4]
test eax, eax
je 0x459d33
mov edi, dword [eax + 8]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.WSOCK32.dll_getsockname
mov ebx, eax
call sub.WSOCK32.dll_WSAGetLastError
mov dword [0x4d3000], eax
lea eax, [ebp - 0xbc]
push eax
push dword [0x4d3000]
call fcn.0045ae3b
add esp, 8
lea edx, [ebp - 0xbc]
push edx
push ebx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
push str.Sock_ID_lu_getsockname__u_0x_p_0x_p_______d___s_
lea ecx, [ebp - 0xa0]
push ecx
call fcn.004a00a0
add esp, 0x20
lea eax, [ebp - 0xa0]
push eax
push edi
push dword [0x4c0170]
push dword [0x4c016c]
call sub.USER32.dll_SendMessageA
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x45a3cb
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff44
push ebx
push esi
push edi
xor edi, edi
mov eax, dword [ebp + 8]
xor esi, esi
test eax, eax
je 0x45a3e5
mov esi, dword [eax + 4]
test eax, eax
je 0x45a3ec
mov edi, dword [eax + 8]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.WSOCK32.dll_recv
mov ebx, eax
call sub.WSOCK32.dll_WSAGetLastError
mov dword [0x4d3000], eax
lea eax, [ebp - 0xbc]
push eax
push dword [0x4d3000]
call fcn.0045ae3b
add esp, 8
lea edx, [ebp - 0xbc]
push edx
push ebx
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
push str.Sock_ID_lu_recv__u_0x_p__d__d_______d___s_
lea ecx, [ebp - 0xa0]
push ecx
call fcn.004a00a0
add esp, 0x24
lea eax, [ebp - 0xa0]
push eax
push edi
push dword [0x4c0170]
push dword [0x4c016c]
call sub.USER32.dll_SendMessageA
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14

Function at 0x45a46b
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff44
push ebx
push esi
push edi
xor edi, edi
mov eax, dword [ebp + 8]
xor esi, esi
test eax, eax
je 0x45a485
mov esi, dword [eax + 4]
test eax, eax
je 0x45a48c
mov edi, dword [eax + 8]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.WSOCK32.dll_recvfrom
mov ebx, eax
call sub.WSOCK32.dll_WSAGetLastError
mov dword [0x4d3000], eax
lea eax, [ebp - 0xbc]
push eax
push dword [0x4d3000]
call fcn.0045ae3b
add esp, 8
lea edx, [ebp - 0xbc]
push edx
push ebx
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
push str.Sock_ID_lu_recvfrom__u_0x_p__d__d_0x_p_0x_p_______d___s_
lea ecx, [ebp - 0xa0]
push ecx
call fcn.004a00a0
add esp, 0x2c
lea eax, [ebp - 0xa0]
push eax
push edi
push dword [0x4c0170]
push dword [0x4c016c]
call sub.USER32.dll_SendMessageA
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x45a517
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff44
push ebx
push esi
push edi
xor edi, edi
mov eax, dword [ebp + 8]
xor esi, esi
test eax, eax
je 0x45a531
mov esi, dword [eax + 4]
test eax, eax
je 0x45a538
mov edi, dword [eax + 8]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.WSOCK32.dll_send
mov ebx, eax
call sub.WSOCK32.dll_WSAGetLastError
mov dword [0x4d3000], eax
lea eax, [ebp - 0xbc]
push eax
push dword [0x4d3000]
call fcn.0045ae3b
add esp, 8
lea edx, [ebp - 0xbc]
push edx
push ebx
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
push str.Sock_ID_lu_send__u_0x_p__d__d_______d___s_
lea ecx, [ebp - 0xa0]
push ecx
call fcn.004a00a0
add esp, 0x24
lea eax, [ebp - 0xa0]
push eax
push edi
push dword [0x4c0170]
push dword [0x4c016c]
call sub.USER32.dll_SendMessageA
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14

Function at 0x45a5b7
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff44
push ebx
push esi
push edi
xor edi, edi
mov eax, dword [ebp + 8]
xor esi, esi
test eax, eax
je 0x45a5d1
mov esi, dword [eax + 4]
test eax, eax
je 0x45a5d8
mov edi, dword [eax + 8]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.WSOCK32.dll_sendto
mov ebx, eax
call sub.WSOCK32.dll_WSAGetLastError
mov dword [0x4d3000], eax
lea eax, [ebp - 0xbc]
push eax
push dword [0x4d3000]
call fcn.0045ae3b
add esp, 8
lea edx, [ebp - 0xbc]
push edx
push ebx
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
push str.Sock_ID_lu_sendto__u_0x_p__d__d_0x_p__d_______d___s_
lea ecx, [ebp - 0xa0]
push ecx
call fcn.004a00a0
add esp, 0x2c
lea eax, [ebp - 0xa0]
push eax
push edi
push dword [0x4c0170]
push dword [0x4c016c]
call sub.USER32.dll_SendMessageA
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x45ab82
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff44
push ebx
push esi
push edi
xor edi, edi
mov eax, dword [ebp + 8]
xor esi, esi
test eax, eax
je 0x45ab9c
mov esi, dword [eax + 4]
test eax, eax
je 0x45aba3
mov edi, dword [eax + 8]
push dword [ebp + 0xc]
call sub.WSOCK32.dll_gethostbyname
mov ebx, eax
call sub.WSOCK32.dll_WSAGetLastError
mov dword [0x4d3000], eax
lea eax, [ebp - 0xbc]
push eax
push dword [0x4d3000]
call fcn.0045ae3b
add esp, 8
lea edx, [ebp - 0xbc]
push edx
push ebx
push dword [ebp + 0xc]
push esi
push str.Sock_ID_lu_gethostbyname__s______0x_p___s_
lea ecx, [ebp - 0xa0]
push ecx
call fcn.004a00a0
add esp, 0x18
lea eax, [ebp - 0xa0]
push eax
push edi
push dword [0x4c0170]
push dword [0x4c016c]
call sub.USER32.dll_SendMessageA
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x45ac10
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff44
push ebx
push esi
push edi
xor edi, edi
mov eax, dword [ebp + 8]
xor esi, esi
test eax, eax
je 0x45ac2a
mov esi, dword [eax + 4]
test eax, eax
je 0x45ac31
mov edi, dword [eax + 8]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.WSOCK32.dll_gethostname
mov ebx, eax
call sub.WSOCK32.dll_WSAGetLastError
mov dword [0x4d3000], eax
lea eax, [ebp - 0xbc]
push eax
push dword [0x4d3000]
call fcn.0045ae3b
add esp, 8
lea edx, [ebp - 0xbc]
push edx
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
push str.Sock_ID_lu_gethostname__s__d_______d___s_
lea ecx, [ebp - 0xa0]
push ecx
call fcn.004a00a0
add esp, 0x1c
lea eax, [ebp - 0xa0]
push eax
push edi
push dword [0x4c0170]
push dword [0x4c016c]
call sub.USER32.dll_SendMessageA
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x45aca4
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff44
push ebx
push esi
push edi
xor edi, edi
mov eax, dword [ebp + 8]
xor esi, esi
test eax, eax
je 0x45acbe
mov esi, dword [eax + 4]
test eax, eax
je 0x45acc5
mov edi, dword [eax + 8]
push dword [ebp + 0x10]
mov ax, word [ebp + 0xc]
push eax
call sub.WSOCK32.dll_WSAStartup
mov ebx, eax
call sub.WSOCK32.dll_WSAGetLastError
mov dword [0x4d3000], eax
lea eax, [ebp - 0xbc]
push eax
push dword [0x4d3000]
call fcn.0045ae3b
add esp, 8
lea edx, [ebp - 0xbc]
push edx
push ebx
push dword [ebp + 0x10]
movzx ecx, word [ebp + 0xc]
push ecx
push esi
push str.Sock_ID_lu_WSAStartup_0x_X_0x_p_______d___s_
lea eax, [ebp - 0xa0]
push eax
call fcn.004a00a0
add esp, 0x1c
lea edx, [ebp - 0xa0]
push edx
push edi
push dword [0x4c0170]
push dword [0x4c016c]
call sub.USER32.dll_SendMessageA
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x45ec0f
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
push ebx
xor edx, edx
mov eax, dword [ebp + 0xc]
mov dl, al
mov ecx, edx
mov ebx, edx
sar ebx, 1
sar ecx, 0
and bl, 1
and cl, 1
shl ecx, 5
shl ebx, 3
add cl, bl
mov ebx, edx
sar ebx, 2
and bl, 1
shl ebx, 2
add cl, bl
mov ebx, edx
sar ebx, 3
and bl, 1
add ebx, ebx
add cl, bl
mov ebx, edx
sar edx, 5
sar ebx, 4
and dl, 1
and bl, 1
shl edx, 4
add cl, bl
add cl, dl
mov edx, dword [ebp + 8]
shl edx, 6
mov eax, ecx
and eax, 0xff
lea ecx, [edx + 0x4c2604]
xor edx, edx
mov al, byte [ecx + eax]
xor ecx, ecx
mov dl, al
mov cl, al
sar ecx, 2
sar edx, 3
and cl, 1
add ecx, ecx
and dl, 1
add dl, cl
xor ecx, ecx
mov cl, al
and eax, 0xff
sar ecx, 1
sar eax, 0
and cl, 1
shl ecx, 2
and al, 1
shl eax, 3
add dl, cl
add dl, al
mov eax, edx
pop ebx
pop ebp
ret
Function at 0x477946
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
mov ebx, dword [ebp + 0xc]
mov eax, 0x4c74dc
call fcn.0049d698
mov word [ebp - 0x14], 8
push dword [ebp + 8]
call fcn.00476918
pop ecx
push dword [ebp + 0x10]
push ebx
call sub.USER32.dll_LoadIconA
mov edx, dword [ebp + 8]
mov dword [edx], eax
test ebx, ebx
setne cl
and ecx, 1
mov eax, dword [ebp + 8]
mov byte [eax + 4], cl
push 0x7fe3
push dword [ebp + 8]
call fcn.0047697b
add esp, 8
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
mov eax, dword [ebp + 8]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4830bf
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, dword [ebp + 8]
cmp word [ebx + 0x10], 0xffff
je 0x48312f
mov eax, dword [ebx + 0x10]
shr eax, 0x10
test ax, ax
je 0x4830e3
push dword [ebx + 0x10]
call fcn.004a789c
pop ecx
push dword [ebx + 0xc]
call sub.USER32.dll_GetWindowTextLengthA
mov esi, eax
test esi, esi
jge 0x483105
push 0
push 0x4c9bfe
call fcn.00499bbc
add esp, 8
mov dword [ebx + 0x10], eax
jmp 0x48312f
lea eax, [esi + 1]
push eax
call fcn.004a78f4
pop ecx
mov dword [ebx + 0x10], eax
mov edx, dword [ebx + 0x10]
mov byte [edx], 0
mov ecx, dword [ebx + 0x10]
mov byte [ecx + esi], 0
lea eax, [esi + 1]
mov edx, dword [ebx + 0x10]
push eax
push edx
push dword [ebx + 0xc]
call sub.USER32.dll_GetWindowTextA
pop esi
pop ebx
pop ebp
ret

Function at 0x48aea9
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push dword [edi + 0x10]
mov eax, dword [edi]
push dword [eax + 0xc]
push 0x7ff8
push dword [edi]
call fcn.00482f2d
add esp, 0x10
test eax, eax
je 0x48aedf
test eax, eax
setg dl
and edx, 1
mov eax, edx
jmp 0x48af95
mov bl, 1
cmp dword [edi + 0x10], 0
je 0x48af93
mov esi, dword [edi + 0x10]
mov dword [ebp - 4], esi
push 0xf0
push dword [ebp - 4]
mov eax, dword [edi]
mov edx, dword [eax + 0x6c]
push dword [edx + 8]
call sub.KERNEL32.dll_FindResourceA
mov esi, eax
test esi, esi
je 0x48af93
mov dword [ebp - 8], esi
push dword [ebp - 8]
mov ecx, dword [edi]
mov eax, dword [ecx + 0x6c]
push dword [eax + 8]
call sub.KERNEL32.dll_LoadResource
test eax, eax
je 0x48af93
push eax
call sub.KERNEL32.dll_LockResource
mov esi, eax
test esi, esi
je 0x48af88
jmp 0x48af7f
mov ax, word [esi]
mov word [ebp - 0xa], ax
add esi, 2
mov dx, word [esi]
mov word [ebp - 0xc], dx
add esi, 2
mov ecx, dword [esi]
mov dword [ebp - 0x10], ecx
add esi, 4
mov dword [ebp - 0x14], esi
movzx eax, word [ebp - 0xc]
mov dword [ebp - 0x18], eax
movzx edx, word [ebp - 0xa]
mov dword [ebp - 0x1c], edx
push dword [ebp - 0x14]
push 0
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
mov ecx, dword [edi]
push dword [ecx + 0xc]
call sub.USER32.dll_SendDlgItemMessageA
inc eax
jne 0x48af7c
xor ebx, ebx
add esi, dword [ebp - 0x10]
test bl, bl
je 0x48af88
cmp byte [esi], 0
jne 0x48af35
mov eax, dword [edi]
push dword [eax + 0x68]
call fcn.0048596d
pop ecx
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48b43a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
cmp dword [ebx + 5], 0
jne 0x48b463
cmp byte [ebx + 0x1b], 0
je 0x48b459
push dword [ebx]
call sub.KERNEL32.dll_LockResource
mov dword [ebx + 5], eax
jmp 0x48b463
push dword [ebx]
call sub.KERNEL32.dll_GlobalLock
mov dword [ebx + 5], eax
mov eax, dword [ebx + 5]
cmp dword [eax], 0x28
je 0x48b481
push dword [ebx]
call sub.KERNEL32.dll_GlobalUnlock
push 0
push 0x7fdc
call fcn.00476b6d
add esp, 8
mov edx, dword [ebx + 5]
cmp dword [edx + 0x10], 3
jne 0x48b49e
mov ecx, dword [ebx + 5]
add ecx, 0x28
mov dword [ebx + 9], ecx
mov eax, dword [ebx + 5]
add eax, 0x34
mov dword [ebx + 0xd], eax
jmp 0x48b4ac
xor edx, edx
mov dword [ebx + 9], edx
mov ecx, dword [ebx + 5]
add ecx, 0x28
mov dword [ebx + 0xd], ecx
mov eax, dword [ebx + 5]
cmp dword [eax + 0x20], 0
je 0x48b4bd
mov edx, dword [ebx + 5]
mov ecx, dword [edx + 0x20]
jmp 0x48b4cd
mov eax, dword [ebx + 5]
mov dx, word [eax + 0xe]
push edx
call fcn.00499cc8
pop ecx
mov ecx, eax
mov dword [ebx + 0x15], ecx
mov eax, dword [ebx + 0x15]
shl eax, 2
add eax, dword [ebx + 0xd]
mov dword [ebx + 0x11], eax
cmp dword [ebx + 0x15], 0
jne 0x48b4e7
xor edx, edx
mov dword [ebx + 0xd], edx
mov word [ebx + 0x19], 0
pop ebx
pop ebp
ret

Function at 0x48bc2d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push 2
push dword [ebp + 0x10]
push edi
call sub.KERNEL32.dll_FindResourceA
mov esi, eax
test esi, esi
je 0x48bc53
push esi
push edi
call sub.KERNEL32.dll_LoadResource
jmp 0x48bc55
xor eax, eax
mov dword [ebx], eax
cmp dword [ebx], 0
jne 0x48bc60
xor eax, eax
jmp 0x48bc74
mov byte [ebx + 0x1b], 1
push ebx
call fcn.0048b43a
pop ecx
push ebx
call fcn.0048b4f0
pop ecx
mov al, 1
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x48c99b
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push 0xfffffffffffffff0
mov eax, dword [ebx]
push dword [eax + 0xc]
call sub.USER32.dll_GetWindowLongA
test al, 4
je 0x48c9e3
call fcn.0049a550
mov edi, eax
mov edx, dword [edi + 0x10]
cmp edx, 1
sete cl
and ecx, 1
test cl, cl
jne 0x48c9e3
call fcn.0049a550
mov edi, eax
cmp dword [edi + 0x10], 0
sete al
and eax, 1
test al, al
je 0x48ca11
test esi, esi
jne 0x48c9f4
mov edx, dword [ebx]
push dword [edx + 0xc]
call sub.USER32.dll_GetWindowTextLengthA
mov esi, eax
inc esi
push esi
call fcn.004a78f4
pop ecx
mov edi, eax
mov eax, esi
mov edx, edi
push eax
push edx
mov ecx, dword [ebx]
push dword [ecx + 0xc]
call sub.USER32.dll_GetWindowTextA
mov eax, edi
jmp 0x48ca3f
push 0
push 0
push 0xbd
push dword [ebx]
call fcn.00482f2d
add esp, 0x10
test esi, esi
je 0x48ca39
push 0x42
push esi
push eax
call sub.KERNEL32.dll_LocalReAlloc
test eax, eax
jne 0x48ca39
xor eax, eax
jmp 0x48ca3f
push eax
call sub.KERNEL32.dll_LocalLock
pop edi
pop esi
pop ebx
pop ebp
ret