joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1025da88
Capabilities:
Packed with generic packer

Disassembly:
pushfd
mov word [esp + 0x9c4], 0x62
mov byte [esp], 0x23
pushfd
mov word [esp + 4], 0xd33d
mov byte [esp + 4], bl
mov word [esp + 0x9ca], 0x69
jmp 0x10258fbd
pushfd
mov byte [esp], 0xf3
call fcn.102531f2
mov word [esp + 0x9fc], 0x74
call fcn.1024e375
jmp 0x1025677a

Function at 0x1025df4e
Capabilities:
Packed with generic packer

Disassembly:
mov word [esp + 0x952], 0x34
lea esp, [esp + 0x78]
jno 0x102705da
mov word [esp + 0x8dc], di
push 0x23b51619
jmp loc.102415d4
mov byte [esp], 0x48
mov word [esp + 0x8e0], di
pushfd
pushfd
mov word [esp + 0x8ea], ax
jmp fcn.10270669
push edx
jmp 0x10267d1d

Function at 0x1025ec64
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov word [esp + 0xc], bx
inc dword [esp + 0x38]
cmc
push edi
lea esp, [esp + 0x28]
jb 0x10268fe7
cmc
cmp dword [esp + 0x14], 5
pushfd
jmp fcn.1024025d
jmp fcn.1025da68

Function at 0x102616eb
Capabilities:
Packed with generic packer

Disassembly:
mov byte [esp], 0xec
lea esp, [esp + 8]
jbe 0x1025a5ac
call fcn.1024f7ea

Function at 0x102620c1
Capabilities:
Packed with generic packer

Disassembly:
cwde
setp ch
mov dword [esp + 0x38], 0xa
pop eax
mov dword [esp + 0x14], ebx
mov ah, 0x91
call fcn.10270dc9

Function at 0x102620df
Capabilities:
Packed with generic packer

Disassembly:
movzx eax, dl
cwde
movsx ax, bl
lea eax, [esp + 0x8ac]
push esp
call fcn.10268e96
mov byte [esp], 0x7c
mov dword [esp + 0xac], 0x20
mov dword [esp], 0xbb4fd452
mov word [esp + 8], 0xf778
mov word [esp + 0x92e], di
mov byte [esp + 0x10], ch
lea esp, [esp + 0xac]
jmp fcn.10269be3

Function at 0x102625ac
Capabilities:
Packed with generic packer

Disassembly:
mov word [esp + 0x8d2], di
call fcn.1024270a
mov word [esp + 0x984], 0x67
pushal
mov word [esp + 0x9a6], ax
mov word [esp], 0xe6bc
pushfd
call fcn.1025c5c6
jmp 0x1025558a

Function at 0x10263b74
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 0x44]
call fcn.10009fc5
bt bx, 0xa
test eax, eax
pushal
pushfd
mov ecx, dword [esp + 0x24]
bswap ecx
mov ecx, dword [esp + 0x28]
mov dword [esp], esp
mov byte [esp + 4], 0x11
lea esp, [esp + 0x2c]
jne 0x1026c1d9
pushfd
pushfd
pushfd
inc dword [esp + 0x20]
push esp
clc
mov word [esp + 8], 0x18f1
cmp dword [esp + 0x24], 3
call fcn.1024d47c

Function at 0x1026442e
Capabilities:
Packed with generic packer

Disassembly:
mov dword [esp], eax
call fcn.10247f39
mov byte [esp], ah
mov byte [esp + 4], al
mov word [esp + 0x8c8], 0x34
mov byte [esp], dl
mov word [esp + 4], 0x93c0
call fcn.102463d3
lea esp, [esp + 0xc]
je 0x10270c5d
mov ah, 0xb7
setp ah
lahf
lahf
lea eax, [esp + 0xc54]
pushfd
jmp 0x1024c26f

Function at 0x10268b67
Capabilities:
Packed with generic packer

Disassembly:
cmp ax, bx
pushal
cmp edi, ebx
mov byte [esp + 0x10], 0xf4
pushal
lea esp, [esp + 0x44]
je 0x10270c5d
lahf
call fcn.10245b68

Function at 0x10268f8d
Capabilities:
Packed with generic packer

Disassembly:
push 0x7dd65dac
lea esp, [esp + 0x14]
je 0x10270c5d
call fcn.1025e1eb

Function at 0x1026950e
Capabilities:
Packed with generic packer

Disassembly:
mov word [esp + 0x904], ax
pushfd
jmp 0x102504fb
Function at 0x1026a836
Capabilities:
Packed with generic packer

Disassembly:
mov byte [esp], al
mov word [esp + 0x96c], di
mov byte [esp], bh
call fcn.10270e41
call fcn.1024dde8
mov word [esp + 0x96a], 0x34
jmp 0x1025a53d

Function at 0x1026c1bc
Capabilities:
Packed with generic packer

Disassembly:
sub esp, 0xfffffffc
jnp 0x1025882f
bt bx, 0xe
stc
test eax, eax
pushal
pushfd
lea esp, [esp + 0x24]
je fcn.1026c1e9

Function at 0x1026e182
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 0x30]
je 0x10240902
jmp fcn.1024392c

Function at 0x102719d6
Capabilities:
Packed with generic packer

Disassembly:
mov word [esp + 0xa36], 0x69
jmp loc.102440ea

Function at 0x10271ddf
Capabilities:
Enumerate processes

Disassembly:
lea esp, [esp + 0x24]
je 0x10270c5d
pushal
pushal
mov al, bh
lahf
mov dword [esp + 0x3c], 0x206
not al
jmp fcn.10247a6d
Function at 0x40b57d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x410920
cmp edx, dword [eax]
je 0x40b59f
add eax, 8
inc ecx
cmp eax, 0x4109b0
jl 0x40b590
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x410920]
jne 0x40b6cd
mov eax, dword [0xf0f8b4]
cmp eax, 1
je 0x40b6a7
test eax, eax
jne 0x40b5d0
cmp dword [0x410248], 1
je 0x40b6a7
cmp edx, 0xfc
je 0x40b6cd
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x40b607
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004088e0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00408ab0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x40b64a
lea eax, [ebp - 0x1a4]
push eax
call fcn.00408ab0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x40f48c
push edi
call fcn.00409000
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004088e0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004088f0
lea eax, [ebp - 0xa0]
push 0x40f46c
push eax
call fcn.004088f0
push dword [esi + 0x410924]
lea eax, [ebp - 0xa0]
push eax
call fcn.004088f0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0040d753
add esp, 0x2c
pop edi
jmp 0x40b6cd
lea eax, [ebp + 8]
lea esi, [esi + 0x410924]
push 0
push eax
push dword [esi]
call fcn.00408ab0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x400c4a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
pushal
mov dword [ebp - 4], 0
mov edi, dword [ebp + 0xc]
mov ecx, 0xffffffff
xor al, al
cld
repne scasb al, byte es:[edi]
mov ecx, edi
sub ecx, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
mov esi, dword [ebp + 8]
add esi, dword [esi + 0x3c]
mov esi, dword [esi + 0x78]
add esi, dword [ebp + 8]
mov ebx, dword [esi + 0x20]
add ebx, dword [ebp + 8]
xor edx, edx
push esi
mov edi, dword [ebx]
add edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
repe cmpsb byte [esi], byte es:[edi]
jne 0x400c94
pop esi
jmp 0x400ca0
pop esi
add ebx, 4
inc edx
cmp edx, dword [esi + 0x18]
jb 0x400c81
jmp 0x400cc2
sub ebx, dword [esi + 0x20]
sub ebx, dword [ebp + 8]
shr ebx, 1
add ebx, dword [esi + 0x24]
add ebx, dword [ebp + 8]
movzx eax, word [ebx]
shl eax, 2
add eax, dword [esi + 0x1c]
add eax, dword [ebp + 8]
mov eax, dword [eax]
add eax, dword [ebp + 8]
mov dword [ebp - 4], eax
popal
mov eax, dword [ebp - 4]
leave
ret 8

Function at 0x400cca
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
and eax, 0xfffff000
cmp word [eax], 0x5a4d
je 0x400ce4
sub eax, 0x1000
jmp 0x400cd6
mov ecx, eax
add ecx, dword [eax + 0x3c]
cmp dword [ecx], 0x4550
je 0x400cf8
sub eax, 0x1000
jmp 0x400cd6
pop ecx
leave
ret 4
Function at 0x100042c1
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10013a80]
jne 0x100042cb
repz ret
jmp fcn.10006f7c

Function at 0x10005699
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x10013ac8]
je 0x100056b4
inc edi
cmp edi, 0x17
jb 0x100056a5
cmp edi, 0x17
jae 0x10005834
push ebp
push 3
call fcn.1000ad5d
cmp eax, 1
pop ecx
je 0x10005800
push 3
call fcn.1000ad5d
test eax, eax
pop ecx
jne 0x100056e8
cmp dword [0x100154ec], 1
je 0x10005800
cmp ebx, 0xfc
je 0x10005833
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x100154f8
push ebp
call fcn.1000a48b
add esp, 0xc
test eax, eax
je 0x1000571e
push esi
push esi
push esi
push esi
push esi
call fcn.10008537
add esp, 0x14
push 0x104
mov esi, 0x10015511
push esi
push 0
mov byte [0x10015615], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x10005762
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.1000a48b
add esp, 0xc
test eax, eax
je 0x10005762
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.10008537
add esp, 0x14
push esi
call fcn.1000a400
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x100057a7
push esi
call fcn.1000a400
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x1001580c
push 0x1000fafc
sub ecx, eax
push ecx
push eax
call fcn.1000acaa
add esp, 0x14
test eax, eax
je 0x100057a7
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.10008537
add esp, 0x14
jmp 0x100057a9
xor esi, esi
push 0x1000faf8
push ebx
push ebp
call fcn.1000ac39
add esp, 0xc
test eax, eax
je 0x100057c9
push esi
push esi
push esi
push esi
push esi
call fcn.10008537
add esp, 0x14
push dword [edi*8 + 0x10013acc]
push ebx
push ebp
call fcn.1000ac39
add esp, 0xc
test eax, eax
je 0x100057eb
push esi
push esi
push esi
push esi
push esi
call fcn.10008537
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.1000aa7c
add esp, 0xc
jmp 0x10005833
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x10005833
cmp ebp, 0xffffffff
je 0x10005833
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x10013acc]
push dword [esi]
call fcn.1000a400
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x1000aa7c
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.1000594c
xor ebx, ebx
cmp dword [0x10015ea0], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x1000ab52
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x1000ac32
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x1000ac32
push eax
call fcn.100058de
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x10015ea0], eax
call esi
push eax
call fcn.100058de
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x10015ea4], eax
call esi
push eax
call fcn.100058de
mov dword [0x10015ea8], eax
lea eax, [ebp - 0xc]
push eax
call fcn.10008700
test eax, eax
pop ecx
pop ecx
je 0x1000ab20
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.10008537
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x1000ab52
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.100058de
cmp eax, ebx
pop ecx
mov dword [0x10015eb0], eax
je 0x1000ab52
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.100058de
pop ecx
mov dword [0x10015eac], eax
mov eax, dword [0x10015eac]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x1000abd7
cmp dword [0x10015eb0], ecx
je 0x1000abd7
push eax
call fcn.10005955
push dword [0x10015eb0]
mov esi, eax
call fcn.10005955
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x1000abd7
cmp edi, ebx
je 0x1000abd7
call esi
cmp eax, ebx
je 0x1000aba4
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x1000aba4
test byte [ebp - 0x18], 1
jne 0x1000abd7
lea eax, [ebp - 0x10]
push eax
call fcn.10008737
test eax, eax
pop ecx
je 0x1000abbf
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.10008537
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x1000abce
or dword [ebp + 0x10], 0x200000
jmp 0x1000ac12
or dword [ebp + 0x10], 0x40000
jmp 0x1000ac12
mov eax, dword [0x10015ea4]
cmp eax, dword [ebp - 8]
je 0x1000ac12
push eax
call fcn.10005955
cmp eax, ebx
pop ecx
je 0x1000ac12
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x1000ac12
mov eax, dword [0x10015ea8]
cmp eax, dword [ebp - 8]
je 0x1000ac12
push eax
call fcn.10005955
cmp eax, ebx
pop ecx
je 0x1000ac12
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x10015ea0]
call fcn.10005955
cmp eax, ebx
pop ecx
je 0x1000ac32
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x1000ac34
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x410c56
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
push edi
cmp dword [ecx + 0x58], esi
je 0x410ca9
push esi
push dword [ebp + 8]
call fcn.00410e3c
mov edi, eax
test edi, edi
je 0x410ca4
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp + 0xc]
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x410ca4
mov eax, dword [ebp - 8]
jmp 0x410cbb
mov eax, dword [ebp + 0x10]
jmp 0x410cbb
push dword [ecx + 0x6c]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
pop edi
pop esi
leave
ret 0xc

Function at 0x412ae7
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor esi, esi
mov eax, ecx
push edi
mov edi, esi
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], esi
je 0x412b31
call fcn.0041671c
push 0xf0
push dword [ebp + 0xc]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x412b2e
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x412b81
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
mov eax, dword [ebp - 4]
xor ebx, ebx
inc ebx
test esi, esi
je 0x412b5e
mov ecx, dword [eax]
push dword [ebp + 0x10]
push esi
mov esi, dword [ecx + 0x20]
mov ecx, esi
push dword [ebp + 8]
call dword [0x5739c8]
mov ecx, dword [ebp - 4]
call esi
mov ebx, eax
test edi, edi
je 0x412b5e
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp + 8]
mov edi, dword [eax + 0x70]
test edi, edi
je 0x412b7f
mov eax, dword [edi]
push dword [ebp + 0x10]
mov esi, dword [eax + 0xa0]
mov ecx, esi
call dword [0x5739c8]
mov ecx, edi
call esi
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x418931
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 4], ecx
mov esi, edi
cmp dword [ebp + 8], esi
je 0x418976
call fcn.0041671c
push 0xf0
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x418976
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x418992
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.004b1bdc
mov ebx, eax
test edi, edi
je 0x418990
test esi, esi
je 0x418990
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x4193ab
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
je 0x419469
cmp dword [esi + 0x20], 0
je 0x419469
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x419469
cmp dword [ebp + 8], 0
je 0x419469
xor eax, eax
mov ebx, eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], ebx
mov edi, eax
call fcn.0041671c
push 0x575b68
push dword [ebp + 8]
mov eax, dword [eax + 0xc]
push eax
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x41943a
mov edi, dword [ebp - 0xc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp - 0x10]
mov dword [ebp - 4], eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x419469
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov dword [ebp - 8], eax
push dword [ebp - 4]
push ebx
push esi
call fcn.004b267d
add esp, 0xc
mov ebx, eax
cmp dword [ebp - 8], 0
je 0x41945a
test edi, edi
je 0x41945a
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
test ebx, ebx
je 0x419465
mov ecx, esi
call fcn.0041914d
mov eax, ebx
jmp 0x41946b
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x41de09
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x565b47
call fcn.00548364
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x74], ebx
jne 0x41de2f
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x41de8f
call fcn.0041f6b5
push eax
lea ecx, [ebp - 0x10]
call fcn.00403038
mov edi, dword [edi + 0x74]
lea ecx, [ebp - 0x10]
push ecx
mov dword [ebp - 4], ebx
mov eax, dword [edi]
mov esi, dword [eax + 0x8c]
mov ecx, esi
call dword [0x5739c8]
mov ecx, edi
call esi
mov esi, dword [ebp + 8]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push esi
call fcn.005508f6
push eax
call fcn.00403776
add esp, 0x14
test esi, esi
je 0x41de82
push esi
call fcn.0054d100
pop ecx
mov ebx, eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.0040b6d1
mov eax, ebx
call fcn.0054832d
ret 8

Function at 0x427048
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
push edi
test esi, esi
jne 0x427062
call fcn.0041671c
mov esi, dword [eax + 0xc]
push 0x5761dc
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov ebx, eax
test ebx, ebx
je 0x4270b8
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x4270b8
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
test eax, eax
jne 0x427097
xor esi, esi
jmp 0x4270ad
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 8]
push eax
push dword [ebp - 4]
call fcn.004270c1
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
jmp 0x4270ba
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x4b2cc2
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, ecx
push edi
mov edi, dword [ebp + 8]
mov dword [ebx + 0x84], edi
test edi, 0xffff0000
jne 0x4b2ced
cmp dword [ebx + 0x80], 0
jne 0x4b2ced
movzx eax, di
mov dword [ebx + 0x80], eax
call fcn.0041671c
push 5
push edi
mov esi, dword [eax + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov edi, eax
mov ecx, ebx
push edi
call fcn.004b2f7e
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x4b2d27
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor esi, esi
call fcn.0041671c
push 5
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x4b2d5e
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
mov ecx, dword [ebp - 4]
push ebx
push dword [ebp + 0xc]
push esi
call fcn.004b2d7d
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8

Function at 0x4b4e68
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
mov dword [ebp - 4], ebx
test byte [esi + 4], 1
mov edi, dword [esi + 0xc]
jne 0x4b4ebe
push 5
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x4b4e97
call fcn.00420e14
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x4b4eac
call fcn.00420e14
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x4b4ebe
call fcn.00420e14
call fcn.0041671c
cmp dword [eax + 0x3c], 0
je 0x4b4ed3
push edi
mov ecx, ebx
call fcn.004b4598
mov edi, eax
push dword [ebp + 0xc]
push edi
call fcn.004b50a5
mov ebx, eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x88]
test ecx, ecx
je 0x4b4efc
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 4]
and dword [eax + 0x88], 0
test ebx, ebx
je 0x4b4f08
mov edi, ebx
mov dword [eax + 0x88], ebx
or dword [esi + 4], 1
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x50cb59
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
call fcn.0055367f
pop ecx
test eax, eax
jne 0x50cb9b
push dword [ebp - 4]
push dword [ebp + 0xc]
push dword [ebp + 8]
push str._s_s_X.tmp
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.004111da
add esp, 0x18
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x50cb61
leave
ret
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
leave
ret

Function at 0x51b3a4
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
mov ecx, dword [edi + 4]
call fcn.0041d9e6
push 0xfffffffffffffff0
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowLongA]
push dword [ebp + 0xc]
mov esi, eax
mov ecx, edi
and esi, 3
call fcn.0051b5bd
cmp esi, 3
je 0x51b3e2
mov dword [edi + 0xc], 1
cmp dword [edi], 0
je 0x51b42b
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov esi, dword [ebp + 0x10]
test eax, eax
jle 0x51b405
lea ecx, [eax + 1]
push ecx
push eax
mov ecx, esi
call fcn.00418a06
jmp 0x51b416
push 0xff
mov ecx, esi
call fcn.0040b597
push 0x100
push eax
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0xffffffffffffffff
mov ecx, esi
call fcn.00410f78
jmp 0x51b44f
mov esi, dword [ebp + 0x10]
push dword [esi]
push 0xffffffffffffffff
push 0x14d
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 0xffffffff
jne 0x51b44f
push dword [esi]
push dword [ebp - 4]
call fcn.0048bbb1
pop edi
pop esi
leave
ret 0xc

Function at 0x51b514
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
push edi
push dword [ebp + 0xc]
call fcn.0051b5bd
cmp dword [esi], 0
mov edi, eax
mov dword [esi + 0xc], 1
je 0x51b55c
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.00418a06
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.00410f78
jmp 0x51b567
mov eax, dword [ebp + 0x10]
push dword [eax]
push edi
call fcn.0048bbb1
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x541bc2
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, ecx
call fcn.00547379
call fcn.00416770
cmp dword [eax + 0x14], 0
jne 0x541bdd
mov ecx, esi
pop esi
jmp fcn.00540eed
pop esi
ret

Function at 0x542a7a
Capabilities:
Get common file path
Get file system object information

Disassembly:
push esi
mov esi, ecx
call fcn.00401f37
call fcn.00416770
cmp dword [eax + 0x14], 0
jne 0x542a95
mov ecx, esi
pop esi
jmp fcn.005422f6
pop esi
ret

Function at 0x560e2c
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00560aec