joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5525e0
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov ecx, dword [esi]
cmp dword [ecx + 4], 3
jne 0x55260c
mov eax, dword [esi + 0xc]
test eax, eax
jne 0x5525f8
pop edi
pop esi
ret
mov ecx, dword [ecx + 8]
mov edx, dword [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x14]
push edx
push 1
push ecx
call eax
jmp 0x552646
mov eax, dword [esi + 8]
test eax, eax
jne 0x552631
mov edx, dword [ecx + 8]
push 0x5b63b0
push edx
call fcn.0050517b
add esp, 8
mov dword [esi + 8], eax
test eax, eax
jne 0x552631
pop edi
or eax, 0xffffffff
pop esi
ret
mov eax, dword [esi + 8]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push eax
push ecx
push 1
push edx
call fcn.0050796a
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x552668
mov eax, dword [esi + 8]
test eax, eax
je 0x552662
push eax
call fcn.00504aff
add esp, 4
mov dword [esi + 8], edi
mov eax, dword [esi]
mov ecx, dword [eax]
mov dword [esi], ecx
mov eax, edi
pop edi
pop esi
ret

Function at 0x5531b0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x14]
lea eax, [ecx + eax*2 + 0xc]
push eax
call dword [0x5af224]
mov edi, eax
add esp, 4
test edi, edi
jne 0x5531d3
pop edi
pop esi
ret
lea eax, [edi + 0xc]
push ebx
mov dword [edi], esi
mov dword [edi + 4], eax
mov ebx, dword [esi + 0xc]
mov edx, eax
add edx, ebx
mov ebx, dword [esp + 0x18]
mov dword [edi + 8], edx
mov ecx, dword [esi + 0x10]
cmp ebx, ecx
push ebp
jbe 0x55321e
push eax
call dword [esi]
mov eax, dword [esp + 0x1c]
mov ecx, dword [edi + 4]
push ebx
push eax
push ecx
call dword [esi + 4]
mov ebx, dword [edi + 8]
mov eax, dword [esi + 0xc]
mov edx, dword [edi + 4]
add ebx, eax
push edx
push ebx
call dword [esi + 8]
mov eax, dword [esi + 0x14]
add esp, 0x18
mov dword [esp + 0x1c], eax
jmp 0x553222
mov ebx, dword [esp + 0x18]
mov ecx, dword [edi + 4]
push ecx
call dword [esi]
mov edx, dword [edi + 8]
push edx
call dword [esi]
mov eax, dword [esp + 0x24]
add esp, 8
xor ebp, ebp
test eax, eax
jbe 0x553288
mov dword [esp + 0x1c], eax
mov ebp, eax
mov al, byte [ebx]
mov cl, byte [0x58da98]
xor al, cl
lea ecx, [esp + 0x14]
mov byte [esp + 0x14], al
mov edx, dword [edi + 4]
push 1
push ecx
push edx
call dword [esi + 4]
mov al, byte [ebx]
mov dl, byte [0x58da99]
xor al, dl
lea ecx, [esp + 0x20]
mov byte [esp + 0x20], al
mov edx, dword [edi + 8]
push 1
push ecx
push edx
inc ebx
call dword [esi + 4]
mov eax, dword [esp + 0x34]
add esp, 0x18
dec eax
mov dword [esp + 0x1c], eax
jne 0x553241
cmp ebp, dword [esi + 0x10]
jae 0x5532b4
mov eax, dword [edi + 4]
push 1
push 0x58da98
push eax
call dword [esi + 4]
mov ecx, dword [edi + 8]
push 1
push 0x58da99
push ecx
call dword [esi + 4]
mov eax, dword [esi + 0x10]
add esp, 0x18
inc ebp
cmp ebp, eax
jb 0x55328d
pop ebp
mov eax, edi
pop ebx
pop edi
pop esi
ret
Function at 0x4530192b
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x184
push esi
mov esi, ecx
push edi
cmp dword [esi + 4], 0
je 0x45301967
mov eax, dword [ebp + 0xc]
lea edx, [ebp - 0x64]
mov ecx, dword [eax]
call sym.HHA.dll_Ordinal_195
push dword [ebp + 8]
push dword [esi + 0x10]
call dword [sym.imp.USER32.dll_GetDlgItem]
lea ecx, [ebp - 0x64]
push ecx
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
jmp 0x45301a01
push dword [ebp + 8]
mov edi, dword [esi + 0x10]
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
push edi
call esi
lea ecx, [ebp - 0x64]
push 0x63
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea ecx, [ebp - 0x64]
call sym.HHA.dll_Ordinal_196
cmp eax, dword [ebp + 0x10]
jl 0x4530199c
cmp eax, dword [ebp + 0x14]
jg 0x4530199c
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
jmp 0x45301a01
cmp dword [ebp + 0x18], 0
je 0x453019af
push 0
push dword [ebp + 0x18]
push edi
call sym.HHA.dll_Ordinal_74
jmp 0x45301a01
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0x1d725
call sym.HHA.dll_Ordinal_194
push eax
lea eax, [ebp - 0x184]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x184]
push 0
push eax
push edi
call sym.HHA.dll_Ordinal_171
push dword [ebp + 8]
push edi
call esi
push eax
call dword [sym.imp.USER32.dll_SetFocus]
lea eax, [ebp + 8]
push 0x4536a120
push eax
mov dword [ebp + 8], 1
call fcn.45342540
pop edi
pop esi
leave
ret 0x14

Function at 0x45302c9d
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push edi
lea eax, [ebp - 4]
mov edi, dword [esi + 4]
push 0
push eax
push 0x8000
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x45302cd7
mov eax, dword [ebp - 4]
test eax, eax
je 0x45302cd7
add eax, edi
push 1
mov dword [esi + 0xc], eax
mov dword [esi + 8], edi
and byte [eax], 0
pop eax
jmp 0x45302cd9
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x453043c4
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push esi
push edi
mov edi, dword [ebp + 8]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x104]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x5c
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0x104]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call sym.HHA.dll_Ordinal_10
test eax, eax
je 0x45304417
and byte [eax], 0
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
pop edi
pop esi
leave
ret 4

Function at 0x4530450c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, 0x1000
push esi
lea ecx, [ebp - 0x10]
call sym.HHA.dll_Ordinal_27
push dword [ebp - 0x10]
push esi
xor esi, esi
push esi
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x45304585
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0x45363a00
push dword [ebp - 0x10]
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x45304585
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
mov edx, dword [eax + 0x10]
shr edx, 0x10
mov dword [ecx], edx
movzx edx, word [eax + 0x10]
mov dword [ecx + 4], edx
mov edx, dword [eax + 0x14]
movzx eax, word [eax + 0x14]
shr edx, 0x10
cmp dword [ebp - 0x10], esi
mov dword [ecx + 8], edx
mov dword [ecx + 0xc], eax
je 0x45304580
push dword [ebp - 0x10]
call fcn.45341e40
pop ecx
push 1
pop eax
jmp 0x45304595
cmp dword [ebp - 0x10], esi
je 0x45304593
push dword [ebp - 0x10]
call fcn.45341e40
pop ecx
xor eax, eax
pop esi
leave
ret 8

Function at 0x453049fc
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov ebx, dword [esi + 0xc]
mov eax, dword [esi + 0x10]
sub eax, ebx
cmp dword [esi + 4], 0
jne 0x45304a45
test eax, eax
je 0x45304a45
mov edi, dword [esi]
cmp edi, 0xffffffff
je 0x45304a45
lea ecx, [ebp + 8]
push 0
push ecx
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x45304a42
push edi
mov dword [esi + 4], 1
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [esi], 0xffffffff
mov dword [esi + 0x10], ebx
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x45305780
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
test ebx, 0x80000000
je 0x453057c3
lea eax, [ebp + 8]
push eax
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x453057c3
push eax
push dword [ebp + 8]
call sym.HHA.dll_Ordinal_264
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
pop edi
pop esi
pop ebx
leave
ret 8
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov edi, 0x100
lea eax, [ebp - 0x100]
push edi
push eax
push 0
push ebx
call esi
test eax, eax
jne 0x453057bc
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x100]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x4530580d
lea eax, [ebp - 0x100]
push eax
push dword [ebp + 8]
call sym.HHA.dll_Ordinal_264
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x100]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
lea eax, [ebp - 0x100]
push edi
push eax
push 0
push ebx
jmp 0x453057d9
Function at 0x45305828
Capabilities:
Create thread
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
xor ebx, ebx
cmp dword [0x4537f428], ebx
push esi
push edi
mov esi, ecx
jne 0x4530584c
mov eax, dword [0x4537f648]
mov dword [0x4537f428], esi
mov dword [esi + 0x34], eax
jmp 0x4530584f
mov dword [esi + 0x34], ebx
push ebx
push ebx
push 3
push ebx
push 1
pop edi
push edi
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
mov dword [esi + 0xc], eax
je 0x453059bc
cmp dword [esi + 0x34], ebx
je 0x453058ce
cmp dword [0x4537f41c], ebx
mov dword [esi + 0x24], 0x2000
jne 0x453058c7
push ebx
push edi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push ebx
push edi
push edi
push ebx
mov dword [0x4537f41c], eax
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push 0x2002
mov dword [0x4537f434], eax
call fcn.45341d70
pop ecx
mov dword [0x4537f430], eax
push 0x2002
call fcn.45341d70
pop ecx
mov dword [0x4537f42c], eax
mov eax, dword [0x4537f42c]
jmp 0x453058e0
push 0x10002
mov dword [esi + 0x24], 0x10000
call fcn.45341d70
pop ecx
cmp eax, ebx
mov dword [esi + 0x1c], eax
jne 0x453058f8
push str.cstream.cpp
push 0x58
push str.pbuf
call sym.HHA.dll_Ordinal_26
lea eax, [ebp - 4]
push ebx
push eax
mov dword [esi + 0x10], edi
push dword [esi + 0x24]
push dword [esi + 0x1c]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x453059af
cmp dword [ebp - 4], ebx
je 0x453059af
cmp dword [esi + 0x34], ebx
je 0x45305983
cmp dword [0x4537f424], ebx
mov dword [esi + 0x28], 0xfffffffe
jne 0x45305967
lea eax, [esi + 0x30]
push eax
push ebx
push ebx
push 0x45305caa
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, ebx
mov dword [esi + 0x2c], eax
jne 0x4530595f
push str.cstream.cpp
push 0x6d
push str.hthrd
call sym.HHA.dll_Ordinal_26
mov dword [0x4537f424], edi
jmp 0x45305983
push ebx
push edi
push dword [0x4537f41c]
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push ebx
push edi
push dword [0x4537f434]
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
mov eax, dword [esi + 0x1c]
mov ecx, dword [ebp - 4]
push dword [ebp + 8]
mov dword [esi], eax
add eax, ecx
mov dword [esi + 0x18], ebx
mov dword [esi + 4], eax
mov byte [eax + 1], bl
mov eax, dword [ebp - 4]
mov dword [esi + 0x14], eax
call sym.HHA.dll_Ordinal_23
mov dword [esi + 0x20], eax
mov dword [esi + 0x10], edi
mov dword [esi + 8], ebx
jmp 0x453059ca
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [esi + 0xc], 0xffffffff
cmp dword [esi + 0x34], ebx
mov dword [esi + 0x10], ebx
je 0x453059ca
mov dword [0x4537f428], ebx
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x45305a13
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp dword [esi + 0x34], ebx
je 0x45305a6e
call fcn.45305c69
mov eax, dword [0x4537f42c]
cmp dword [esi + 0x1c], eax
jne 0x45305a37
mov eax, dword [0x4537f430]
mov edi, dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push ebx
push 1
mov dword [esi + 0x1c], eax
mov eax, dword [esi + 0x28]
push dword [0x4537f41c]
mov dword [ebp - 4], eax
mov dword [esi + 0x28], 0xfffffffe
call edi
cmp dword [ebp - 4], 0xffffffff
je 0x45305ab1
push ebx
push 1
push dword [0x4537f434]
call edi
mov ecx, dword [ebp - 4]
jmp 0x45305a8d
lea eax, [ebp - 4]
push ebx
push eax
push dword [esi + 0x24]
push dword [esi + 0x1c]
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x45305ab1
mov ecx, dword [ebp - 4]
cmp ecx, ebx
je 0x45305ab1
mov eax, dword [esi + 0x14]
mov dword [esi + 0x18], eax
add eax, ecx
mov dword [esi + 0x14], eax
mov eax, dword [esi + 0x1c]
add ecx, eax
mov dword [esi], eax
mov dword [esi + 4], ecx
mov byte [ecx + 1], bl
cmp dword [ebp - 4], ebx
jne 0x45305ab8
mov dword [esi + 8], 1
or al, 0xff
pop edi
pop esi
pop ebx
leave
ret
lea ecx, [eax + 1]
mov al, byte [eax]
mov dword [esi + 8], ebx
mov dword [esi], ecx
jmp 0x45305ab3

Function at 0x45305b51
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x10], 2
push ebx
push esi
push edi
jne 0x45305b71
push str.cstream.cpp
push 0xed
push str.seek___SK_END
call sym.HHA.dll_Ordinal_26
cmp dword [ebp + 0x10], 1
mov esi, dword [ebp + 8]
jne 0x45305b89
mov eax, dword [esi + 0x18]
mov edi, dword [ebp + 0xc]
sub eax, dword [esi + 0x1c]
add eax, dword [esi]
add edi, eax
jmp 0x45305b8c
mov edi, dword [ebp + 0xc]
mov ebx, dword [esi + 0x18]
cmp edi, ebx
jl 0x45305bc2
cmp edi, dword [esi + 0x14]
jge 0x45305bc2
mov ecx, dword [esi + 0x1c]
mov edx, dword [esi + 4]
sub edi, ebx
lea eax, [edi + ecx]
cmp eax, edx
mov dword [esi], eax
jb 0x45305bb9
mov edi, dword [esi + 0x24]
add edi, ecx
cmp edx, edi
jae 0x45305bb9
mov dword [esi + 8], 1
sub eax, ecx
add eax, ebx
jmp 0x45305c62
xor ebx, ebx
cmp dword [esi + 0x34], ebx
je 0x45305bd0
mov ecx, esi
call fcn.45305c69
mov eax, dword [esi + 0xc]
push ebx
push ebx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edi, dword [esi + 0x1c]
mov ebx, eax
lea eax, [ebp + 0x10]
push 0
push eax
mov dword [esi + 0x18], ebx
push dword [esi + 0x24]
push edi
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x45305c56
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x45305c56
lea ecx, [eax + ebx]
add eax, edi
cmp dword [esi + 0x34], 0
mov dword [esi + 0x14], ecx
mov dword [esi], edi
mov dword [esi + 4], eax
je 0x45305c44
mov edi, dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push 0
push 1
mov dword [esi + 0x28], 0xfffffffe
push dword [0x4537f41c]
call edi
cmp dword [0x4537f424], 0
je 0x45305c44
push 0
push 1
push dword [0x4537f434]
call edi
cmp dword [ebp + 0x10], 0
jne 0x45305c51
mov dword [esi + 8], 1
mov eax, dword [esi + 0x14]
jmp 0x45305c62
mov dword [esi + 8], 1
mov eax, 0xff
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x453073f4
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov esi, dword [ebx]
cmp esi, 0xffffffff
je 0x4530749b
mov eax, dword [ebx + 8]
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebx + 0xc]
lea edi, [edx + eax]
cmp edi, ecx
jae 0x4530743a
mov esi, dword [ebp + 0xc]
mov ecx, edx
mov edi, eax
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
add dword [ebx + 8], edx
push 1
pop eax
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
mov edi, dword [ebx + 4]
lea ecx, [ebp + 8]
push 0
sub eax, edi
push ecx
push eax
push edi
push esi
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
call esi
test eax, eax
jne 0x45307458
push dword [ebx]
jmp 0x45307492
mov eax, dword [ebp + 0x10]
mov dword [ebx + 8], edi
lea ecx, [eax + edi]
cmp ecx, dword [ebx + 0xc]
jae 0x4530747e
mov esi, dword [ebp + 0xc]
mov ecx, eax
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
add dword [ebx + 8], eax
jmp 0x45307430
mov edi, dword [ebx]
lea ecx, [ebp + 0xc]
push 0
push ecx
push eax
push dword [ebp + 0xc]
push edi
call esi
test eax, eax
jne 0x45307430
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [ebx], 0xffffffff
xor eax, eax
jmp 0x45307433

Function at 0x453074e7
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 8]
cmp eax, dword [esi + 0xc]
jb 0x45307521
mov edi, dword [esi + 4]
mov ebx, dword [esi]
lea ecx, [ebp - 4]
push 0
sub eax, edi
push ecx
push eax
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4530751e
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [esi], 0xffffffff
jmp 0x4530752d
mov dword [esi + 8], edi
mov eax, dword [esi + 8]
mov cl, byte [ebp + 8]
mov byte [eax], cl
inc eax
mov dword [esi + 8], eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x45307d38
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [ecx]
push ebx
xor ebx, ebx
push esi
mov eax, dword [eax]
push edi
cmp eax, ebx
mov dword [ebp - 0xc], ecx
je 0x45307d5c
xor ecx, ecx
cmp byte [eax], bl
sete cl
mov eax, ecx
jmp 0x45307d5f
push 1
pop eax
cmp eax, ebx
je 0x45307d75
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_DeleteMenu]
jmp 0x45307e55
xor esi, esi
push esi
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetMenuItemID]
mov edi, dword [ebp + 0xc]
cmp eax, edi
je 0x45307d90
inc esi
cmp esi, 0x64
jl 0x45307d77
jmp 0x45307d93
mov dword [ebp - 4], esi
cmp dword [ebp - 4], 0x64
jge 0x45307e55
xor esi, esi
lea eax, [esi + edi]
push ebx
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_DeleteMenu]
inc esi
cmp esi, 9
jl 0x45307d9f
lea eax, [ebp - 0x220]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp - 0x220]
push eax
call sym.HHA.dll_Ordinal_80
mov dword [ebp - 8], 1
sub dword [ebp - 8], edi
jmp 0x45307de0
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp - 8]
lea esi, [ebx + edi]
add eax, esi
push 0xa
cdq
pop ecx
idiv ecx
lea eax, [ebp - 0x11c]
push edx
push str._u
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x220]
lea edi, [ebp - 0x11c]
or ecx, 0xffffffff
push 1
push eax
xor eax, eax
push ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [ebp + ecx - 0x11c]
mov ecx, dword [ebp - 0xc]
push eax
call fcn.45307cd9
test eax, eax
je 0x45307e55
mov eax, dword [ebp - 4]
lea ecx, [ebp - 0x11c]
inc dword [ebp - 4]
push ecx
push esi
push 0x400
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_InsertMenuA]
inc ebx
cmp ebx, 9
jl 0x45307ddd
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x453080b1
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push ebx
lea eax, [ebp - 8]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
push eax
push str.SOFTWAREMicrosoftShared_ToolsGraphics_FiltersImport
push 0x80000002
xor ebx, ebx
call esi
test eax, eax
jne 0x45308169
push edi
lea eax, [ebp - 0x58]
push 0x50
push eax
push dword [ebp + 8]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x45308163
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x58]
push eax
push dword [ebp - 8]
call esi
test eax, eax
jne 0x45308163
mov eax, dword [ebp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
je 0x45308127
lea ecx, [ebp + 0x10]
mov byte [eax], bl
push ecx
push eax
push ebx
push ebx
push 0x45363bc0
push dword [ebp - 4]
call esi
mov eax, dword [ebp + 0x14]
cmp eax, ebx
je 0x45308141
lea ecx, [ebp + 0x18]
mov byte [eax], bl
push ecx
push eax
push ebx
push ebx
push str.Extensions
push dword [ebp - 4]
call esi
mov eax, dword [ebp + 0x1c]
cmp eax, ebx
je 0x4530815b
lea ecx, [ebp + 0x20]
mov byte [eax], bl
push ecx
push eax
push ebx
push ebx
push str.Path
push dword [ebp - 4]
call esi
push dword [ebp - 4]
call edi
push 1
pop ebx
push dword [ebp - 8]
call edi
pop edi
mov eax, ebx
pop esi
pop ebx
leave
ret 0x1c
Function at 0x45308171
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
xor edi, edi
and byte [esi], 0
cmp dword [ebp + 8], edi
je 0x45308326
push dword [ebp + 8]
call fcn.4530807a
push dword [ebp + 0x10]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x30]
mov dword [ebp + 8], edi
push esi
push 0x28
push eax
push edi
push edi
push edi
call sym.HHA.dll_Ordinal_100
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x453081e7
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 8]
call ebx
test eax, eax
je 0x453081e7
push dword [ebp + 0x10]
and byte [esi], 0
inc dword [ebp + 8]
lea eax, [ebp - 0x30]
push esi
push 0x28
push eax
push edi
push edi
push dword [ebp + 8]
call sym.HHA.dll_Ordinal_100
test eax, eax
jne 0x453081bc
cmp byte [esi], 0
je 0x453081fc
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4530835c
push 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push esi
call sym.HHA.dll_Ordinal_80
mov edi, str.msappsgrphflt_
or ecx, 0xffffffff
xor eax, eax
push str..jpg
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, dword [ebp + 0xc]
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp - 4]
push esi
call ebx
test eax, eax
jne 0x45308252
mov edi, str.JPEGIM32.FLT
jmp 0x45308336
push str..cdr
push esi
call ebx
test eax, eax
jne 0x45308268
mov edi, str.CDRIMP32.FLT
jmp 0x45308336
push str..cgm
push esi
call ebx
test eax, eax
jne 0x4530827e
mov edi, str.CGMIMP32.FLT
jmp 0x45308336
push str..drw
push esi
call ebx
test eax, eax
jne 0x45308294
mov edi, str.DRWIMP32.FLT
jmp 0x45308336
push str..gif
push esi
call ebx
test eax, eax
jne 0x453082aa
mov edi, str.GIFIMP32.FLT
jmp 0x45308336
push str..pcd
push esi
call ebx
test eax, eax
jne 0x453082bd
mov edi, str.PCDIMP32.FLT
jmp 0x45308336
push str..tga
push esi
call ebx
test eax, eax
jne 0x453082d0
mov edi, str.TGAIMP32.FLT
jmp 0x45308336
push str..tif
push esi
call ebx
test eax, eax
jne 0x453082e3
mov edi, str.TIFFIM32.FLT
jmp 0x45308336
push str..pcx
push esi
call ebx
test eax, eax
jne 0x453082f6
mov edi, str.PCXIMP32.FLT
jmp 0x45308336
push str..bmp
push esi
call ebx
test eax, eax
je 0x45308331
push str..dib
push esi
call ebx
test eax, eax
je 0x45308331
push str..pct
push esi
call ebx
test eax, eax
je 0x4530832a
push str..pic
push esi
call ebx
test eax, eax
je 0x4530832a
xor eax, eax
jmp 0x4530835f
mov edi, str.PICTIM32.FLT
jmp 0x45308336
mov edi, str.BMPIMP32.FLT
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, dword [ebp + 0xc]
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret 0xc