joyce8/EMBER2024-capa huggingface dataset:
Function at 0x413060
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57e378
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
push esi
mov eax, dword [0x5e4fcc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
test esi, esi
je 0x413219
cmp word [esi], 0
je 0x413219
lea ecx, [ebp - 0x3c]
call fcn.0040a610
mov dword [ebp - 4], 0
lea edx, [ebp - 0x3c]
mov ecx, esi
call fcn.00413230
mov esi, eax
movzx eax, word [esi]
test ax, ax
je 0x4131ab
cmp eax, 0x5c
jne 0x4130d1
cmp word [esi + 2], 0
je 0x4131ab
cmp word [esi + 2], 0x3a
jne 0x4130f5
movzx eax, word [esi + 4]
test ax, ax
je 0x4131ab
cmp eax, 0x5c
jne 0x4130f5
cmp word [esi + 6], 0
je 0x4131ab
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x4131ab
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x4131ab
cmp eax, 3
jne 0x4131a7
push 0x5c
push esi
call fcn.0055f968
mov edx, eax
add esp, 8
test edx, edx
je 0x4131a7
cmp word [edx + 2], 0
jne 0x413155
sub edx, 2
cmp edx, esi
jb 0x4131a7
nop
cmp word [edx], 0x5c
je 0x413151
sub edx, 2
cmp edx, esi
jae 0x413140
xor esi, esi
jmp 0x4131b0
cmp edx, esi
jb 0x4131a7
lea ecx, [ebp - 0x68]
call fcn.0040a610
mov byte [ebp - 4], 1
sub edx, esi
sar edx, 1
lea ecx, [ebp - 0x68]
push edx
push esi
call fcn.00415540
lea ecx, [ebp - 0x68]
call fcn.00415240
mov ecx, eax
call fcn.00413060
test eax, eax
je 0x41319b
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov esi, eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x68]
call fcn.0040a290
jmp 0x4131b0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x68]
call fcn.0040a290
xor esi, esi
jmp 0x4131b0
mov esi, 1
mov dword [ebp - 4], 2
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x2c], vtable.CVolMem.0
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x4131d9
push eax
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x2c]
call dword [eax + 0xc]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
mov byte [ebp - 4], 2
mov dword [ebp - 0x2c], vtable.CVolObject.0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov dword [ebp - 0x3c], vtable.CVolObject.0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4132a0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57e3b8
mov eax, dword fs:[0]
push eax
sub esp, 0x70
push esi
mov eax, dword [0x5e4fcc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
test esi, esi
je 0x4133e7
cmp word [esi], 0
je 0x4133e7
push 0x44
lea eax, [ebp - 0x7c]
push 0
push eax
call fcn.00560bf0
or dword [ebp - 0x50], 1
xor eax, eax
mov dword [ebp - 0x38], vtable.CVolCommonBaseWithMemManager.0
add esp, 0xc
mov dword [ebp - 0x7c], 0x44
mov word [ebp - 0x4c], ax
mov dword [ebp - 0x38], vtable.CVolObject.0
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x38], vtable.CVolMem.0
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x20], 0x40
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x38]
push esi
call fcn.00414180
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
cmp dword [ebp - 0x24], ecx
cmove eax, ecx
lea ecx, [ebp - 0x1c]
push ecx
lea ecx, [ebp - 0x7c]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x413369
xor esi, esi
jmp 0x41338c
push 0x1f4
push dword [ebp - 0x1c]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
push dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x1c]
call esi
mov esi, 1
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x38], vtable.CVolMem.0
mov dword [ebp - 4], 2
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x4133b2
push eax
mov eax, dword [ebp - 0x38]
lea ecx, [ebp - 0x38]
call dword [eax + 0xc]
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov dword [ebp - 0x38], vtable.CVolObject.0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x413400
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57e40c
mov eax, dword fs:[0]
push eax
sub esp, 0x23c
mov eax, dword [0x5e4fcc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
test esi, esi
je 0x4135d7
cmp word [esi], 0
je 0x4135d7
lea ecx, [ebp - 0x244]
call fcn.0040a610
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x228]
mov dword [ebp - 0x238], 0
test eax, eax
je 0x413477
push eax
mov eax, dword [ebp - 0x234]
lea ecx, [ebp - 0x234]
call dword [eax + 0xc]
movzx eax, word [esi]
mov dword [ebp - 0x228], 0
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x224], 0
cmp eax, 0x5c
je 0x4134b0
test ax, ax
je 0x4134e2
cmp word [esi + 2], 0x3a
jne 0x4134e2
cmp word [esi + 4], 0x5c
jne 0x4134e2
push 0x5c
push esi
call fcn.0055f968
add esp, 8
test eax, eax
je 0x4134e2
cmp eax, esi
jbe 0x4134ce
cmp word [eax - 2], 0x3a
lea ecx, [eax - 2]
cmovne eax, ecx
sub eax, esi
lea ecx, [ebp - 0x244]
add eax, 2
sar eax, 1
push eax
push esi
call fcn.00415540
mov edi, dword [ebp - 0x238]
test edi, edi
jne 0x413505
cmp dword [ebp - 0x220], edi
jne 0x4134fb
mov edi, 0x5bfe9c
jmp 0x413505
mov edi, dword [ebp - 0x228]
test edi, edi
je 0x413535
cmp word [edi], 0
je 0x413535
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x413535
cmp word [edi], 0
je 0x41352e
push edi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov edi, 1
jmp 0x413537
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test edi, edi
je 0x41355b
cmp word [ebp - 0x218], 0
je 0x41355b
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov dword [ebp - 4], 1
lea eax, [ebp - 0x234]
mov dword [ebp - 0x248], eax
mov dword [ebp - method.CVolBaseInputStream.virtual_0], vtable.CVolMem.0
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x228]
test eax, eax
je 0x413596
push eax
mov eax, dword [ebp - 0x234]
lea ecx, [ebp - 0x234]
call dword [eax + 0xc]
mov dword [ebp - 0x228], 0
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x224], 0
mov byte [ebp - 4], 1
mov dword [ebp - method.CVolBaseInputStream.virtual_0], vtable.CVolObject.0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov dword [ebp - method.CVolBaseInputStream.virtual_0], vtable.CVolObject.0
jmp 0x4135d9
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0055e352
mov esp, ebp
pop ebp
ret
Function at 0x413fc0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov ecx, dword [ebp + 8]
cmp ecx, dword [esi + 0x14]
jne 0x413fd9
mov eax, dword [esi + 0xc]
pop esi
mov esp, ebp
pop ebp
ret 4
push edi
mov edi, dword [esi + 0xc]
test ecx, ecx
jne 0x41400c
test edi, edi
je 0x413fed
mov eax, dword [esi]
mov ecx, esi
push edi
call dword [eax + 0xc]
pop edi
mov dword [esi + 0xc], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
pop esi
mov esp, ebp
pop ebp
ret 4
test edi, edi
jne 0x414020
push ecx
mov ecx, esi
call fcn.00413f60
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
push ebx
mov ebx, dword [esi + 0x18]
mov eax, 0x40
test ebx, ebx
cmovle ebx, eax
mov eax, dword [esi + 0x10]
cmp eax, ecx
jl 0x414049
sub eax, ecx
cmp eax, ebx
jg 0x414049
pop ebx
mov eax, edi
mov dword [esi + 0x14], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
mov eax, ecx
cdq
idiv ebx
mov eax, dword [esi]
sub ebx, edx
add ebx, ecx
mov edx, dword [eax + 8]
cmp eax, vtable.CVolMem.0
jne 0x4140fc
cmp edi, dword [0x5ee9bc]
jb 0x4140c7
cmp edi, dword [0x5ee9c0]
jae 0x4140c7
cmp ebx, dword [0x5ee9c8]
jle 0x4140da
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 4], eax
test eax, eax
je 0x4140f5
push dword [0x5ee9c8]
push edi
push eax
call fcn.005600f0
push 0x5ee9cc
call fcn.00414800
mov eax, dword [0x5ee9c4]
add esp, 0x10
mov dword [edi], eax
mov dword [0x5ee9c4], edi
mov edi, dword [ebp - 4]
mov dword [0x5ee9cc], 1
jmp 0x4140da
push ebx
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov edi, eax
test edi, edi
je 0x4140f5
mov eax, dword [ebp + 8]
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], eax
mov eax, edi
pop ebx
mov dword [esi + 0xc], edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
push 0xffffffffffffffff
call fcn.00563a38
push ebx
push edi
mov ecx, esi
call edx
mov edi, eax
jmp 0x4140de
Function at 0x418c9a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor esi, esi
mov eax, ecx
push edi
mov edi, esi
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], esi
je 0x418ce4
call fcn.004218c9
push 0xf0
push dword [ebp + 0xc]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x418ce1
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x418d34
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
mov eax, dword [ebp - 4]
xor ebx, ebx
inc ebx
test esi, esi
je 0x418d11
mov ecx, dword [eax]
push dword [ebp + 0x10]
push esi
mov esi, dword [ecx + 0x20]
mov ecx, esi
push dword [ebp + 8]
call dword [0x58d9e8]
mov ecx, dword [ebp - 4]
call esi
mov ebx, eax
test edi, edi
je 0x418d11
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp + 8]
mov edi, dword [eax + 0x70]
test edi, edi
je 0x418d32
mov eax, dword [edi]
push dword [ebp + 0x10]
mov esi, dword [eax + 0xa0]
mov ecx, esi
call dword [0x58d9e8]
mov ecx, edi
call esi
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x41c8c1
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
push edi
cmp dword [ecx + 0x58], esi
je 0x41c914
push esi
push dword [ebp + 8]
call fcn.0041caaa
mov edi, eax
test edi, edi
je 0x41c90f
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp + 0xc]
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x41c90f
mov eax, dword [ebp - 8]
jmp 0x41c926
mov eax, dword [ebp + 0x10]
jmp 0x41c926
push dword [ecx + 0x6c]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
pop edi
pop esi
leave
ret 0xc

Function at 0x423acc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 4], ecx
mov esi, edi
cmp dword [ebp + 8], esi
je 0x423b11
call fcn.004218c9
push 0xf0
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x423b11
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x423b2d
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.0047b99a
mov ebx, eax
test edi, edi
je 0x423b2b
test esi, esi
je 0x423b2b
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x424527
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
je 0x4245e5
cmp dword [esi + 0x20], 0
je 0x4245e5
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4245e5
cmp dword [ebp + 8], 0
je 0x4245e5
xor eax, eax
mov ebx, eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], ebx
mov edi, eax
call fcn.004218c9
push 0x58fef0
push dword [ebp + 8]
mov eax, dword [eax + 0xc]
push eax
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x4245b6
mov edi, dword [ebp - 0xc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp - 0x10]
mov dword [ebp - 4], eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x4245e5
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov dword [ebp - 8], eax
push dword [ebp - 4]
push ebx
push esi
call fcn.0047c43b
add esp, 0xc
mov ebx, eax
cmp dword [ebp - 8], 0
je 0x4245d6
test edi, edi
je 0x4245d6
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
test ebx, ebx
je 0x4245e1
mov ecx, esi
call fcn.004242c9
mov eax, ebx
jmp 0x4245e7
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x4338ba
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
push edi
test esi, esi
jne 0x4338d4
call fcn.004218c9
mov esi, dword [eax + 0xc]
push 0x590b84
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x43392a
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x43392a
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
test eax, eax
jne 0x433909
xor esi, esi
jmp 0x43391f
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 8]
push eax
push dword [ebp - 4]
call fcn.00433933
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
jmp 0x43392c
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x457d74
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x57eada
call fcn.0055eaf4
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x74], ebx
jne 0x457d9a
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x457dfa
call fcn.004213c7
push eax
lea ecx, [ebp - 0x10]
call fcn.004167fa
mov edi, dword [edi + 0x74]
lea ecx, [ebp - 0x10]
push ecx
mov dword [ebp - 4], ebx
mov eax, dword [edi]
mov esi, dword [eax + 0x8c]
mov ecx, esi
call dword [0x58d9e8]
mov ecx, edi
call esi
mov esi, dword [ebp + 8]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push esi
call fcn.0056ab6e
push eax
call fcn.00416bc8
add esp, 0x14
test esi, esi
je 0x457ded
push esi
call fcn.0056a304
pop ecx
mov ebx, eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.004164d0
mov eax, ebx
call fcn.0055eabd
ret 8
Function at 0x47ca80
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, ecx
push edi
mov edi, dword [ebp + 8]
mov dword [ebx + 0x84], edi
test edi, 0xffff0000
jne 0x47caab
cmp dword [ebx + 0x80], 0
jne 0x47caab
movzx eax, di
mov dword [ebx + 0x80], eax
call fcn.004218c9
push 5
push edi
mov esi, dword [eax + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov edi, eax
mov ecx, ebx
push edi
call fcn.0047cd41
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x47cae5
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor esi, esi
call fcn.004218c9
push 5
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x47cb1c
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
mov ecx, dword [ebp - 4]
push ebx
push dword [ebp + 0xc]
push esi
call fcn.0047cb3b
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8

Function at 0x47ec35
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
mov dword [ebp - 4], ebx
test byte [esi + 4], 1
mov edi, dword [esi + 0xc]
jne 0x47ec8b
push 5
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x47ec64
call fcn.00465810
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x47ec79
call fcn.00465810
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x47ec8b
call fcn.00465810
call fcn.004218c9
cmp dword [eax + 0x3c], 0
je 0x47eca0
push edi
mov ecx, ebx
call fcn.0047e365
mov edi, eax
push dword [ebp + 0xc]
push edi
call fcn.0047ee72
mov ebx, eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x88]
test ecx, ecx
je 0x47ecc9
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 4]
and dword [eax + 0x88], 0
test ebx, ebx
je 0x47ecd5
mov edi, ebx
mov dword [eax + 0x88], ebx
or dword [esi + 4], 1
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x50ed02
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
mov ecx, dword [edi + 4]
call fcn.0045798c
push 0xfffffffffffffff0
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
push dword [ebp + 0xc]
mov esi, eax
mov ecx, edi
and esi, 3
call fcn.0050ef1b
cmp esi, 3
je 0x50ed40
mov dword [edi + 0xc], 1
cmp dword [edi], 0
je 0x50ed89
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov esi, dword [ebp + 0x10]
test eax, eax
jle 0x50ed63
lea ecx, [eax + 1]
push ecx
push eax
mov ecx, esi
call fcn.004210ac
jmp 0x50ed74
push 0xff
mov ecx, esi
call fcn.0041786c
push 0x100
push eax
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0xffffffffffffffff
mov ecx, esi
call fcn.0041cbe6
jmp 0x50edad
mov esi, dword [ebp + 0x10]
push dword [esi]
push 0xffffffffffffffff
push 0x14d
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
jne 0x50edad
push dword [esi]
push dword [ebp - 4]
call fcn.0046233c
pop edi
pop esi
leave
ret 0xc

Function at 0x50ee72
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
push edi
push dword [ebp + 0xc]
call fcn.0050ef1b
cmp dword [esi], 0
mov edi, eax
mov dword [esi + 0xc], 1
je 0x50eeba
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.004210ac
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.0041cbe6
jmp 0x50eec5
mov eax, dword [ebp + 0x10]
push dword [eax]
push edi
call fcn.0046233c
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x510220
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
call fcn.0056edb3
pop ecx
test eax, eax
jne 0x510262
push dword [ebp - 4]
push dword [ebp + 0xc]
push dword [ebp + 8]
push str._s_s_X.tmp
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.0041ce6f
add esp, 0x18
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x510228
leave
ret
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
leave
ret

Function at 0x54a4f7
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, ecx
call fcn.0055aaca
call fcn.0042191d
cmp dword [eax + 0x14], 0
jne 0x54a512
mov ecx, esi
pop esi
jmp fcn.0054981f
pop esi
ret

Function at 0x54b3ae
Capabilities:
Get common file path
Get file system object information

Disassembly:
push esi
mov esi, ecx
call fcn.00402440
call fcn.0042191d
cmp dword [eax + 0x14], 0
jne 0x54b3c9
mov ecx, esi
pop esi
jmp fcn.0054ac2a
pop esi
ret

Function at 0x576696
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00576313
Function at 0x10001118
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], esp
mov eax, 0
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 0
push 0xffffffff
push 0x1000eab8
push 0
push 0
xor eax, eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
nop
nop
cmp dword [ebp - 4], esp
je 0x1000116f
push 0x13
push 0x4010001
push 6
call fcn.10010853
add esp, 0xc
mov eax, 0
jmp 0x10001179
mov esp, ebp
pop ebp
ret

Function at 0x10001da1
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
fild dword [0x10030333]
fstp qword [ebp - 0xc]
fld qword [ebp - 0xc]
fadd qword [0x1002f2da]
fstp qword [ebp - 0x14]
fld qword [ebp - 0x14]
call fcn.1000117d
mov dword [ebp - 4], eax
push 0x10002516
call fcn.10001e43
mov dword [ebp - 8], eax
push 1
push 0x1003035b
push dword [ebp - 8]
push dword [ebp - 4]
push 0x10030357
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0xc]
mov dword [ebp - 8], esp
mov eax, 0
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0x40
push 0x64
push dword [0x1003035b]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
nop
nop
cmp dword [ebp - 8], esp
je 0x10001e3f
push 0x7b
push 0x4012aaa
push 6
call fcn.10010853
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x100023ec
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
cmp dword [ebp + 0x14], 0
jne 0x1000241a
mov dword [ebp + 0x10], 4
mov dword [ebp - 0xc], esp
push dword [ebp + 0x10]
push dword [ebp + 8]
xor eax, eax
call dword [0x10030507]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x10002449
push 0x85
push 0x401bb8b
push 6
call fcn.10010853
add esp, 0xc
test eax, eax
je 0x10002456
jmp 0x100024ff
mov dword [ebp - 0xc], esp
lea eax, [ebp - 8]
push eax
push 0x40
push dword [ebp + 0x10]
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x1000248e
push 0xbd
push 0x401bb8b
push 6
call fcn.10010853
add esp, 0xc
push 0x80000301
push 0
lea eax, [ebp - 4]
push eax
push 1
mov ebx, 0xc
mov eax, 0x100134e0
call fcn.10010cd0
add esp, 0x10
mov dword [ebp - 0xc], eax
push dword [ebp + 0x10]
push dword [ebp - 0xc]
push dword [ebp + 8]
call fcn.10001d86
mov dword [ebp - 0xc], esp
mov eax, 0
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 8]
push dword [ebp + 0x10]
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x100024ff
push 0x129
push 0x401bb8b
push 6
call fcn.10010853
add esp, 0xc
mov esp, ebp
pop ebp
ret 0x10