joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401464
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push esi
mov esi, dword [sym.imp.user32.dll_LoadIconW]
push edi
push 0x7f00
xor edi, edi
push edi
mov dword [ebp - 0x24], str.Chicken1
mov dword [ebp - 0x44], 0x401186
mov dword [ebp - 0x48], 3
mov dword [ebp - 0x4c], 0x30
call esi
push 0x7f00
push edi
mov dword [ebp - 0x34], eax
call esi
push 0x7f00
push edi
mov dword [ebp - 0x20], eax
call dword [sym.imp.user32.dll_LoadCursorW]
mov esi, dword [sym.imp.kernel32.dll_GetModuleHandleW]
push edi
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x3c], edi
call esi
push edi
mov dword [0x4059e0], eax
mov dword [ebp - 0x38], eax
call dword [sym.imp.gdi32.dll_GetStockObject]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.user32.dll_RegisterClassExW]
test ax, ax
je 0x401583
push 1
push dword [0x4059e0]
call dword [sym.imp.user32.dll_LoadBitmapW]
push edi
push edi
call esi
push eax
push edi
push edi
push 0x80000000
push 0x80000000
push 0x80000000
push 0x80000000
push 0xcf0000
push str.Window
push str.Chicken1
push edi
call dword [sym.imp.user32.dll_CreateWindowExW]
push 0
push eax
mov dword [0x4059e8], eax
call dword [sym.imp.user32.dll_ShowWindow]
mov ecx, dword [0x4059e8]
push ecx
call dword [sym.imp.user32.dll_UpdateWindow]
mov esi, dword [sym.imp.user32.dll_GetMessageW]
push edi
push edi
push edi
lea edx, [ebp - 0x1c]
push edx
call esi
test eax, eax
je 0x401583
mov edi, dword [sym.imp.user32.dll_TranslateMessage]
push ebx
mov ebx, dword [sym.imp.user32.dll_DispatchMessageW]
lea eax, [ebp - 0x1c]
push eax
call edi
lea ecx, [ebp - 0x1c]
push ecx
call ebx
push 0
push 0
push 0
lea edx, [ebp - 0x1c]
push edx
call esi
test eax, eax
jne 0x401566
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x430072
nop
nop
mov ebx, 0x408ecc
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x5849572d
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
loop 0x430060
nop
nop
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4300d2
nop
nop
mov ebx, 0x42e1d0
nop
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x363468be
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
loop 0x4300c0
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x41dc47
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a4487
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x68
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x34]
test eax, eax
je 0x41de2a
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x58], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0x2c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x24], eax
lea eax, [ebp + 0x3c]
mov dword [ebp - 0x54], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x41ddeb
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x41ddb2
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test eax, eax
je 0x41dd05
push 0x24e1
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
jmp 0x41ddb0
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
and dword [ebp - 4], 0
push dword [ebp - 0x4c]
push 0x2143
push 0
push 0x6b97
push dword [ebp - 0x50]
push 0x7927
push 1
push 0x742c
push 1
call fcn.0041e9df
add esp, 0x24
jmp 0x41dda6
or dword [ebp - 4], 0xffffffff
jmp 0x41ddb0
jmp 0x41dde9
push 0x639d
push 0x60f1
push 1
push 1
push 1
push 0x681a
push 0x1848
push 0
push 0
push 0x1b4b
push 0x6912
push 0x1f13
push 1
call fcn.00420365
add esp, 0x34
jmp 0x41de28
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x5c], eax
push 1
push 1
push dword [ebp - 0x5c]
push 0x3794
push 1
push 0xd9b
push 0x6f21
push 0xe8a
push 0x4863
mov eax, dword [ebp - 0x60]
movzx eax, byte [eax]
push eax
call fcn.0040d991
add esp, 0x28
jmp 0x41de7d
lea eax, [ebp + 0x38]
mov dword [ebp - 0x78], eax
lea eax, [ebp + 0x30]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x70], eax
lea eax, [ebp + 0x28]
mov dword [ebp - 0x74], eax
push dword [ebp - 0x64]
push 1
push dword [ebp - 0x68]
push 1
mov eax, dword [ebp - 0x6c]
movzx eax, byte [eax]
push eax
push dword [ebp - 0x70]
mov eax, dword [ebp - 0x74]
movzx eax, byte [eax]
push eax
push 0x5bd2
mov eax, dword [ebp - 0x78]
movzx eax, byte [eax]
push eax
call fcn.0041a6de
add esp, 0x24
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43923a
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x43930e
lea eax, [ebp + 0x10]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x4392d6
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x4392bb
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x4392b9
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0x27d
push 0xe1f
push 0x13cc
push 0x949
push 0
call dword [sym.imp.USER32.dll_TrackPopupMenu]
jmp 0x4392d4
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x4392d4
push 0
push 0xb20
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
jmp 0x43930c
push 0x7c48
push 0
push 0x5e92
push 0x1371
push 0x37b2
push 0x500e
push 0x54e
push 0x3d5c
push 0
push 1
push 0x1d5e
call fcn.00449f5a
add esp, 0x2c
jmp 0x439316
push 0
call fcn.00434d4a
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x4427b1
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x44285e
lea eax, [ebp + 0x20]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x24], eax
lea eax, [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x442833
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x442814
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
jmp 0x442831
push 0
push 0x226c
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPointW]
jmp 0x44285c
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x44284f
push 0
push 0
call dword [sym.imp.GDI32.dll_GetRgnBox]
jmp 0x44285c
push 0x2121
push 0
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x4428c2
lea eax, [ebp + 0x10]
mov dword [ebp - 0x2c], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x4428b4
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x44288e
push 0
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
jmp 0x4428b2
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x4428b2
push 1
push 0x5310
push 1
push 0x292b
push 0
call fcn.004461d9
add esp, 0x14
jmp 0x4428c2
push 1
push 0
push 1
call fcn.00433211
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x444038
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
movzx eax, byte [ebp + 0x28]
test eax, eax
je 0x44407d
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0x10], eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push 1
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
push eax
push dword [ebp - 0x14]
call fcn.0044412e
add esp, 0x14
jmp 0x44412a
lea eax, [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x4440b3
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
push dword [ebp - 0x20]
push 1
call fcn.0044270e
pop ecx
pop ecx
jmp 0x44412a
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x4440d5
push 0
push 0
call dword [sym.imp.USER32.dll_EnumWindows]
jmp 0x44412a
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [eax], 1
jmp 0x4440f7
mov eax, dword [ebp - 4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jl 0x44412a
push 0x543e
push 0x363c
push 0x347
push 1
push 0x2640
push 0x638d
push 0
push 0
push 1
call fcn.004424b5
add esp, 0x24
jmp 0x4440ec
mov esp, ebp
pop ebp
ret

Function at 0x445a98
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 8]
test eax, eax
je 0x445ab3
push 1
call fcn.00445b48
pop ecx
jmp 0x445b44
lea eax, [ebp + 0x10]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x445ad9
push 0x79ef
push 1
call fcn.00439381
pop ecx
pop ecx
jmp 0x445b44
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x445b37
mov byte [ebp - 1], 0
lea eax, [ebp - 1]
push eax
push 0x48ab
push 0x4433
push 1
push 0x3c37
push 0
push 0x5586
push 0x467c
push 0x7824
push 0x646c
push 1
push 0x776f
push 0x309c
push 1
push 0x15f8
push 1
call fcn.0044b990
add esp, 0x40
jmp 0x445b44
push 0x831
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov esp, ebp
pop ebp
ret
Function at 0x44a1db
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x44a27d
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x44a233
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push 1
call fcn.0044a2e7
add esp, 0xc
jmp 0x44a27b
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x44a266
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x44a264
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_TranslateMDISysAccel]
jmp 0x44a27b
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [eax], 0xfffffffd
jmp 0x44a2e3
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x3c], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 0x40], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test eax, eax
je 0x44a2db
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
movzx eax, byte [eax]
test eax, eax
je 0x44a2ca
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
add eax, 5
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
jmp 0x44a2d9
push 0x1319
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
jmp 0x44a2e3
push 0
call fcn.00436e1f
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x45823f
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x4582e2
mov eax, dword [ebp + 0x28]
mov dword [ebp - 8], eax
lea eax, [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x4582d8
mov eax, dword [ebp - 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x4582af
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x4582ad
push 0
call fcn.0045f782
pop ecx
jmp 0x4582d6
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x4582d6
push 0x15a3
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
jmp 0x4582e0
push 0
call fcn.004585a5
pop ecx
jmp 0x458316
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x3c], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x34], eax
push 0
push dword [ebp - 0x30]
push 1
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
push eax
push dword [ebp - 0x38]
push dword [ebp - 0x3c]
call fcn.0045f52b
add esp, 0x18
mov esp, ebp
pop ebp
ret

Function at 0x45890b
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x45894e
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x10], eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push 0x6877
push 1
push dword [ebp - 0x14]
call fcn.004589a5
add esp, 0x18
jmp 0x4589a1
lea eax, [ebp + 0x14]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x458999
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x45897e
push 0
call dword [sym.imp.USER32.dll_DestroyIcon]
jmp 0x458997
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x458997
push 0x2121
push 0
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x4589a1
push 0
call fcn.0045f48f
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x45a799
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
movzx eax, byte [ebp + 0x2c]
test eax, eax
je 0x45a8cc
lea eax, [ebp + 0x24]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x28], eax
lea eax, [ebp + 0x28]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x45a894
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x45a821
push 0
call dword [sym.imp.KERNEL32.dll_ResetEvent]
jmp 0x45a892
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x58]
mov ecx, dword [ecx]
mov dword [eax], ecx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x5c]
mov ecx, dword [ecx]
mov dword [eax], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
cmp dword [eax], ecx
je 0x45a886
mov dword [ebp - 0xc], 1
jmp 0x45a88a
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 0x60]
mov ecx, dword [ebp - 0xc]
mov dword [eax], ecx
jmp 0x45a8ca
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x68]
movzx eax, byte [eax]
test eax, eax
je 0x45a8bd
push 0x2564
push 0x1a06
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CheckDlgButton]
jmp 0x45a8ca
push 0x831
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
jmp 0x45a8e5
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x6c], eax
push 1
push 0
mov eax, dword [ebp - 0x6c]
movzx eax, byte [eax]
push eax
call fcn.0045c14f
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x45e2d4
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
movzx eax, byte [ebp + 8]
test eax, eax
je 0x45e357
lea eax, [ebp + 0x14]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x45e33f
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x45e327
mov byte [ebp - 1], 0
push 0x59d4
push 1
push 1
push 0
lea eax, [ebp - 1]
push eax
push 1
call fcn.0045c091
add esp, 0x18
jmp 0x45e33d
mov byte [ebp - 2], 0
movzx eax, byte [ebp - 2]
test eax, eax
je 0x45e33d
push 0
push 0
call dword [sym.imp.USER32.dll_EnumWindows]
jmp 0x45e355
push 0x5578
push 0
push 0x2430
push 0
call fcn.00453962
add esp, 0x10
jmp 0x45e3d2
lea eax, [ebp + 0x20]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x45e3b4
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x45e3a0
push 0
push 0x345
push 0
call dword [sym.imp.GDI32.dll_GetBitmapBits]
jmp 0x45e3b2
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
and dword [eax], 0
jmp 0x45e3d2
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
push 1
push 1
push 0
push dword [ebp - 0x34]
push 1
push 0x280c
call fcn.00453e5f
add esp, 0x18
mov esp, ebp
pop ebp
ret
Function at 0x45f558
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
movzx eax, byte [ebp + 0x20]
test eax, eax
je 0x45f676
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 0x2c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x45f5f8
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x45f5dd
mov byte [ebp - 1], 0
push 0x6b90
push 0
push 0x42e7
push 1
lea eax, [ebp - 1]
push eax
push 0x1107
push 0
push 1
push 0x2dc0
push 0x34dd
push 1
call fcn.0045ce80
add esp, 0x2c
jmp 0x45f5f6
mov byte [ebp - 2], 0
movzx eax, byte [ebp - 2]
test eax, eax
je 0x45f5f6
push 0x831
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
jmp 0x45f674
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x45f653
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x40]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x44]
add eax, dword [ecx]
mov ecx, dword [ebp - 0x48]
mov ecx, dword [ecx]
mov byte [ecx + eax], 0
jmp 0x45f674
mov byte [ebp - 3], 0
movzx eax, byte [ebp - 3]
test eax, eax
je 0x45f674
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0
push 0
call dword [sym.imp.USER32.dll_DialogBoxParamA]
jmp 0x45f69f
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x4c]
movzx eax, byte [eax]
push eax
push 0
push dword [ebp - 0x50]
push dword [ebp - 0x54]
call fcn.0045e9cd
add esp, 0x10
mov esp, ebp
pop ebp
ret