joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4088e0
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x4adda8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [0x4dca08]
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x10], eax
mov esi, dword [esp + 0x24]
lea ecx, [esp + 0x10]
and esi, 0xf
mov dword [esp + 0x1c], 0
push esi
push 0x4d3dc8
push ecx
call fcn.00490e4f
mov ebx, dword [esp + 0x3c]
mov edi, dword [esp + 0x1c]
add esp, 0xc
lea ecx, [esp + 0x10]
mov eax, dword [ebx]
push eax
push 0x64
push 0x64
call fcn.0049397a
mov ebp, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push eax
push 0x4e0dd0
push edi
push 0x4d3768
call ebp
push 0xffffffffffffffff
lea ecx, [esp + 0x14]
call fcn.004939c9
mov edi, dword [esp + 0x2c]
lea edx, [esp + 0x10]
push edx
mov ecx, edi
call fcn.00493683
mov eax, dword [esp + 0x28]
lea ecx, [esp + 0x10]
and eax, 0xff
push eax
push esi
push str._03d_03d
push ecx
call fcn.00490e4f
mov ebx, dword [ebx]
mov esi, dword [esp + 0x20]
add esp, 0x10
lea ecx, [esp + 0x10]
push ebx
push 0x64
push 0x64
call fcn.0049397a
push eax
push 0x4e0dd0
push esi
push str.ZUNAME
call ebp
push 0xffffffffffffffff
lea ecx, [esp + 0x14]
call fcn.004939c9
push 0x4d3db0
mov ecx, edi
call fcn.00493926
lea edx, [esp + 0x10]
mov ecx, edi
push edx
call fcn.00493962
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c], 0xffffffff
call fcn.0049354a
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x40a250
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebp, dword [esp + 0x20]
mov dword [esp + 0x14], eax
mov ecx, ebp
call fcn.00406830
mov dword [ebp + 4], eax
push 5
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, ebp
call fcn.004068b0
test eax, eax
jbe 0x40a298
mov edx, dword [ebp + 4]
mov ecx, ebp
sub ecx, eax
push eax
lea eax, [ecx + edx + 0x19]
mov ecx, dword [esp + 0x28]
push eax
call fcn.00406800
mov ecx, dword [ebp + 4]
lea esi, [ebp + 0x19]
lea ebx, [ecx + ebp + 0x19]
mov edx, ebx
sub edx, esi
cmp edx, 0x1a
jl 0x40a363
cmp byte [esi], 0xeb
jne 0x40a355
mov al, byte [esi + 1]
test al, al
jne 0x40a355
mov eax, ebx
mov edi, 1
sub eax, esi
cmp eax, edi
jle 0x40a34d
cmp byte [edi + esi], 0xeb
je 0x40a2dd
inc edi
cmp edi, eax
jl 0x40a2d0
jmp 0x40a34d
cmp edi, 0x19
jge 0x40a2e8
lea esi, [esi + edi - 1]
jmp 0x40a34d
mov eax, dword [esp + 0x1c]
lea edx, [edi - 1]
test edi, edi
jle 0x40a313
mov cl, byte [esi]
cmp cl, 0xec
jne 0x40a308
mov cl, byte [esi + 1]
inc esi
dec cl
mov byte [eax], cl
inc eax
inc esi
dec edi
dec edx
jmp 0x40a30c
mov byte [eax], cl
inc eax
inc esi
mov ecx, edx
dec edx
test ecx, ecx
jg 0x40a2f3
xor ebp, ebp
mov dword [esp + 0x10], 0xffff
test edi, edi
jle 0x40a343
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x10]
push edx
lea ecx, [eax + ebp]
push ecx
call fcn.0040a170
add esp, 8
inc ebp
cmp ebp, edi
jl 0x40a321
mov eax, dword [esp + 0x10]
test eax, eax
je 0x40a3a0
mov ebp, dword [esp + 0x20]
mov edi, 0x1000
inc esi
mov edx, ebx
sub edx, esi
cmp edi, edx
jge 0x40a363
inc esi
mov eax, ebx
sub eax, esi
cmp eax, 0x1a
jge 0x40a2af
cmp ebx, esi
jbe 0x40a383
mov eax, ebx
lea edi, [ebp + 0x19]
sub eax, esi
mov ecx, eax
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 4], eax
jmp 0x40a38a
mov dword [ebp + 4], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esp + 0x14]
cmp eax, 0x1388
jae 0x40a3ab
jmp 0x40a26f
lea eax, [edi + 1]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 8
ret
Function at 0x40f710
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x410
push ebx
push ebp
mov ebx, ecx
push esi
push edi
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], 9
mov al, byte [ebx + 0x5c]
test al, al
jne 0x40f84a
mov ecx, dword [esp + 0x428]
xor eax, eax
mov al, byte [ecx]
cmp eax, 0xff
jne 0x40f74a
mov eax, 0x1009
mov edx, dword [esp + 0x424]
push eax
lea ecx, [ebx + 0x6c]
push edx
call fcn.00406800
mov dword [esp + 0x10], 0
mov ecx, dword [ebx + 0x88c]
lea eax, [esp + 0x10]
push 0
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WaitCommEvent]
mov edx, dword [esp + 0x10]
and edx, 4
cmp dl, 4
jne 0x40f763
lea ebp, [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 0x1c], eax
lea ecx, [ebx + 0x6c]
call fcn.00406830
test eax, eax
jle 0x40f812
mov ecx, eax
lea esi, [ebx + 0x85]
mov edx, ecx
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
add ebp, eax
and ecx, 3
mov eax, ebp
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x428]
lea edx, [esp + 0x20]
sub eax, edx
xor edx, edx
mov dl, byte [esi + 1]
lea ecx, [esp + 0x20]
mov esi, edx
cmp eax, esi
jl 0x40f7fe
mov edi, eax
xor eax, eax
test esi, esi
jle 0x40f83b
mov ebx, dword [esp + 0x428]
mov dl, byte [eax + ecx]
cmp dl, byte [ebx + eax + 2]
jne 0x40f7f4
inc eax
cmp eax, esi
jge 0x40f83b
jmp 0x40f7dd
inc ecx
dec edi
cmp edi, esi
jge 0x40f7d7
mov ebx, dword [esp + 0x18]
cmp ecx, ebp
lea eax, [esp + 0x20]
jae 0x40f810
mov dl, byte [ecx]
mov byte [eax], dl
inc eax
inc ecx
cmp ecx, ebp
jb 0x40f806
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esp + 0x1c]
cmp eax, 0x12c
jb 0x40f791
mov eax, dword [esp + 0x14]
mov ecx, eax
dec eax
test ecx, ecx
mov dword [esp + 0x14], eax
je 0x40f84a
jmp 0x40f728
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x410
ret 8
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x410
ret 8
Function at 0x41ea70
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4b00f5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
lea ecx, [esi + 0x11c]
mov dword [esp + 0x18], 3
call fcn.0049354a
lea ecx, [esi + 0x114]
mov byte [esp + 0x18], 2
call fcn.0049354a
lea ecx, [esi + 0x110]
mov byte [esp + 0x18], 1
call fcn.0049354a
lea edi, [esi + 0x5c]
mov dword [esp + 0xc], edi
lea ecx, [edi + 0xac]
mov byte [esp + 0x18], 5
call fcn.0049354a
lea ecx, [edi + 0x30]
mov byte [esp + 0x18], 4
call fcn.0049354a
lea ecx, [edi + 0x2c]
mov byte [esp + 0x18], 0
call fcn.0049354a
mov ecx, esi
mov dword [esp + 0x18], 0xffffffff
call fcn.00493d90
mov ecx, dword [esp + 0x10]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x41ea88
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4b00f5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
lea ecx, [esi + 0x11c]
mov dword [esp + 0x18], 3
call fcn.0049354a
lea ecx, [esi + 0x114]
mov byte [esp + 0x18], 2
call fcn.0049354a
lea ecx, [esi + 0x110]
mov byte [esp + 0x18], 1
call fcn.0049354a
lea edi, [esi + 0x5c]
mov dword [esp + 0xc], edi
lea ecx, [edi + 0xac]
mov byte [esp + 0x18], 5
call fcn.0049354a
lea ecx, [edi + 0x30]
mov byte [esp + 0x18], 4
call fcn.0049354a
lea ecx, [edi + 0x2c]
mov byte [esp + 0x18], 0
call fcn.0049354a
mov ecx, esi
mov dword [esp + 0x18], 0xffffffff
call fcn.00493d90
mov ecx, dword [esp + 0x10]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x426240
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4b07c8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
mov eax, dword [0x4dca08]
push ebx
push esi
push edi
mov esi, ecx
mov dword [esp + 0xc], eax
mov eax, dword [esi + 0x1b2c]
xor ebx, ebx
cmp eax, ebx
mov dword [esp + 0x38], ebx
je 0x426288
lea ecx, [esi + 0x1c28]
push ecx
lea ecx, [esp + 0x10]
call fcn.00493683
jmp 0x4262ba
lea edx, [esi + 0x1c24]
lea eax, [esp + 0x1c]
push edx
push 0x4d87c4
push eax
call fcn.00493853
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x3c], 1
call fcn.00493683
lea ecx, [esp + 0x1c]
mov byte [esp + 0x38], bl
call fcn.0049354a
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], ebx
push ecx
push ebx
push 0x39473995
push 0xbc90edf3
push 0x8938afe0
push ebx
push ebx
call fcn.00471950
cmp eax, 0x80000000
nop
nop
lea edx, [esp + 0xc]
push 0x4d87b4
lea eax, [esp + 0x24]
push edx
push eax
mov dword [esi + 0x110], ebx
call fcn.004937df
mov eax, dword [eax]
mov ecx, esi
push eax
mov byte [esp + 0x3c], 2
call fcn.004978fc
lea ecx, [esp + 0x20]
mov byte [esp + 0x38], bl
call fcn.0049354a
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.004720d0
mov dword [esp + 0x38], 0xffffffff
jmp 0x42656d
lea ecx, [esp + 0xc]
call fcn.0049354a
mov ecx, dword [esp + 0x30]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x30
ret
Function at 0x4372b3
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp dword [esi], ebx
jle 0x437328
mov ebp, dword [sym.imp.USER32.dll_GetKeyState]
xor edi, edi
mov eax, dword [esi + 4]
add eax, edi
movzx ecx, word [eax + 2]
cmp ecx, dword [esp + 0x14]
jne 0x437320
mov al, byte [eax]
and al, 4
cmp al, 4
jne 0x4372ec
push 0x10
call ebp
and ax, 0x8000
cmp ax, 0x8000
jne 0x437320
mov eax, dword [esi + 4]
mov al, byte [edi + eax]
and al, 8
cmp al, 8
jne 0x437306
push 0x11
call ebp
and ax, 0x8000
cmp ax, 0x8000
jne 0x437320
mov eax, dword [esi + 4]
mov al, byte [edi + eax]
and al, 0x10
cmp al, 0x10
jne 0x437331
push 0x12
call ebp
and ax, 0x8000
cmp ax, 0x8000
je 0x437331
inc ebx
add edi, 6
cmp ebx, dword [esi]
jl 0x4372c7
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret 8
mov ecx, dword [esi + 4]
lea eax, [ebx + ebx*2]
push 6
lea eax, [ecx + eax*2]
push eax
push dword [esp + 0x20]
call fcn.0047fa80
add esp, 0xc
push 1
pop eax
jmp 0x43732a

Function at 0x43ccc0
Capabilities:
Check os version

Disassembly:
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x43cd27
push 1
mov esi, 0x94
pop ebx
push esi
call fcn.0047f5a0
mov edi, eax
pop ecx
test edi, edi
je 0x43cd7f
push esi
push 0
push edi
call fcn.0047f870
add esp, 0xc
mov dword [edi], esi
push edi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [edi + 4]
cmp eax, 4
jne 0x43cd0a
push 5
jmp 0x43cd77
cmp eax, 5
jne 0x43cd78
cmp dword [edi + 8], 0
jne 0x43cd19
push 6
jmp 0x43cd77
cmp eax, 5
jne 0x43cd78
cmp dword [edi + 8], ebx
jne 0x43cd78
push 7
jmp 0x43cd77
cmp al, 4
jae 0x43cd2f
xor ebx, ebx
jmp 0x43cd7f
push 2
mov esi, 0x94
pop ebx
push esi
call fcn.0047f5a0
mov edi, eax
pop ecx
test edi, edi
je 0x43cd7f
push esi
push 0
push edi
call fcn.0047f870
add esp, 0xc
mov dword [edi], esi
push edi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [edi + 4]
cmp eax, 4
jne 0x43cd78
cmp dword [edi + 8], 0xa
jne 0x43cd6b
push 3
jmp 0x43cd77
cmp eax, 4
jne 0x43cd78
cmp dword [edi + 8], 0x5a
jne 0x43cd78
push eax
pop ebx
push edi
call fcn.0047f323
pop ecx
pop edi
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x43d3da
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
je 0x43d445
push esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x43d445
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
mov edi, eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push 0x4d93a4
mov ebx, eax
push dword [ebp + 8]
call fcn.0047f70b
mov esi, eax
pop ecx
test esi, esi
pop ecx
je 0x43d445
push esi
push 1
push ebx
push edi
call fcn.004802d5
push esi
call fcn.0047f523
add esp, 0x14
push 1
pop eax
jmp 0x43d447
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x43d44c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
lea eax, [ebp - 0x104]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x43d47b
push dword [ebp + 0x10]
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x208]
push eax
push 0
lea eax, [ebp - 0x104]
push 0x4d93b4
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x43d4e1
push dword [ebp + 0x10]
push dword [ebp + 8]
call fcn.00480410
pop ecx
lea eax, [ebp - 0x104]
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp byte [ebp + eax - 0x105], 0x5c
push dword [ebp + 0xc]
lea eax, [ebp - 0x104]
push eax
je 0x43d4da
push str._s_s
push dword [ebp + 8]
call fcn.0047eebf
add esp, 0x10
jmp 0x43d4f2
push 0x4d754c
jmp 0x43d4cd
lea eax, [ebp - 0x208]
push eax
push dword [ebp + 8]
call fcn.00480410
pop ecx
pop ecx
cmp dword [ebp + 0x14], 0
je 0x43d513
push 0x4d93a8
push dword [ebp + 8]
call fcn.00480420
push dword [ebp + 0x14]
push dword [ebp + 8]
call fcn.00480420
add esp, 0x10
leave
ret
Function at 0x43ed98
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
push 0
push dword [edi + 0xac]
lea esi, [edi + 0xac]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ebx, dword [sym.imp.USER32.dll_KillTimer]
push 0x3e8
push dword [esi]
call ebx
push 0x3f2
push dword [esi]
call ebx
and dword [edi + 0x11c], 0
pop edi
pop esi
pop ebx
ret

Function at 0x43f242
Capabilities:
Check os version

Disassembly:
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x43f25a
cmp al, 5
sbb eax, eax
and eax, 2
add eax, 6
ret
push 8
pop eax
ret

Function at 0x44297d
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x4b222d
call fcn.0047f954
sub esp, 0x24
mov al, byte [ebp + 0xb]
push ebx
mov ebx, ecx
push esi
push edi
mov dword [ebp - 0x10], ebx
and byte [ebx + 0xc], 0
lea ecx, [ebx + 4]
mov byte [ecx], al
mov al, byte [ebp + 0xb]
mov byte [ecx + 1], al
call fcn.00441b81
mov al, byte [ebp + 0xb]
and byte [ebx + 0xac], 0
lea ecx, [ebx + 0xa4]
xor edi, edi
mov dword [ebp - 4], edi
mov byte [ecx], al
mov al, byte [ebp + 0xb]
mov byte [ecx + 1], al
call fcn.00443cca
mov eax, dword [ebp + 8]
push 0x33
mov dword [ebx + 0xa0], eax
lea eax, [ebx + 0x6c]
push edi
push eax
mov byte [ebp - 4], 1
mov dword [ebx], 0x4b9454
call fcn.0047f870
push 0x33
lea eax, [ebx + 0x34]
push edi
push eax
call fcn.0047f870
mov esi, dword [sym.imp.USER32.dll_GetSysColor]
add esp, 0x18
push 0xf
call esi
push 8
mov dword [ebx + 0x14], eax
call esi
push 0x1e
mov dword [ebx + 0x18], eax
push 0x3c
push edi
lea eax, [ebp - 0x30]
push edi
push eax
mov dword [ebx + 0x1c], 0xff
mov dword [ebx + 0x68], edi
call fcn.0043b53e
mov esi, eax
lea edi, [ebp - 0x20]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea edi, [ebx + 0x20]
lea esi, [ebp - 0x20]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
add esp, 0x14
and dword [ebx + 0x30], 0
movsd dword es:[edi], dword [esi]
lea eax, [ebx + 0x6c]
push 0x33
mov esi, 0x4e0dd0
push eax
lea edi, [ebx + 0x30]
push esi
push 0x4d3768
push 1
mov ecx, ebx
call fcn.00442a82
push 4
push edi
push esi
push str.AUTOPLACE
push 6
mov ecx, ebx
call fcn.00442a82
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, ebx
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4

Function at 0x44913f
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
xor eax, eax
cmp dword [esi + 0x128], eax
jne 0x44919e
lea ecx, [ebp - 4]
mov dword [ebp - 4], eax
push ecx
push eax
push esi
push 0x4491a1
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
movzx ecx, word [esi + 0x11c]
mov dword [esi + 0x120], eax
mov eax, dword [esi + 0xac]
or ecx, 0x10000
push eax
push ecx
push 0x111
push eax
mov dword [esi + 0x128], 1
call dword [sym.imp.USER32.dll_GetParent]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
pop esi
leave
ret
Function at 0x4522fe
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
push ebx
push esi
push edi
lea eax, [ebp - 0x420]
mov esi, ecx
push 0x400
push eax
push dword [esi + 0xac]
call dword [sym.imp.USER32.dll_GetWindowTextA]
and byte [ebp - 0x21], 0
lea eax, [ebp - 0x10]
push eax
push dword [esi + 0xac]
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esi + 0x14]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
cmp dword [eax + 0x15c], 0
jne 0x452367
mov ebx, dword [ebp + 8]
push 1
push dword [eax + 0x14]
add eax, 0xf4
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
call fcn.0043b83e
add esp, 0x14
jmp 0x452380
mov ecx, esi
call fcn.0043647c
push dword [esi + 0xac]
mov ebx, dword [ebp + 8]
push ebx
push 0x1795
push eax
call edi
push 0
push 0
push 0x31
push dword [esi + 0xac]
call edi
mov edi, dword [sym.imp.GDI32.dll_SelectObject]
push eax
push ebx
call edi
mov dword [ebp - 0x14], eax
mov eax, dword [esi + 0x14]
push dword [eax + 0xf0]
push ebx
call dword [sym.imp.GDI32.dll_SetTextColor]
push 1
push ebx
mov dword [ebp - 0x1c], eax
call dword [sym.imp.GDI32.dll_SetBkMode]
push 0xfffffffffffffff0
mov dword [ebp - 0x18], eax
push dword [esi + 0xac]
call dword [sym.imp.USER32.dll_GetWindowLongA]
and dword [ebp + 8], 0
push 2
mov edx, eax
pop ecx
and edx, ecx
mov dword [ebp - 0x20], eax
cmp dl, cl
jne 0x4523dd
mov dword [ebp + 8], ecx
push 1
mov edx, eax
pop ecx
and edx, ecx
cmp dl, cl
jne 0x4523eb
mov dword [ebp + 8], ecx
mov edx, eax
mov ecx, 0x200
and edx, ecx
cmp edx, ecx
jne 0x4523fc
or dword [ebp + 8], 0x24
mov ecx, eax
and ecx, 0xc
cmp cl, 0xc
jne 0x45240c
or dword [ebp + 8], 0x20
jmp 0x452410
or dword [ebp + 8], 0x10
mov ecx, eax
and cx, 0x80
cmp cl, 0x80
jne 0x452420
or byte [ebp + 9], 8
and eax, 0xb
cmp al, 0xb
jne 0x45242b
or dword [ebp + 8], 0x20
mov ecx, esi
call fcn.00436723
test eax, eax
je 0x45243a
or byte [ebp + 0xa], 2
push dword [ebp - 4]
mov ecx, dword [ebp - 0x20]
mov eax, 0x2000
push dword [ebp - 8]
and ecx, eax
cmp ecx, eax
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push ebx
jne 0x45246f
call dword [sym.imp.GDI32.dll_IntersectClipRect]
mov eax, dword [ebp + 8]
mov esi, dword [esi + 0x14]
or ax, 0x2010
push eax
lea eax, [ebp - 0x420]
push eax
jmp 0x452492
call dword [sym.imp.GDI32.dll_IntersectClipRect]
push dword [esi + 0xac]
call dword [sym.imp.USER32.dll_IsWindowEnabled]
push dword [ebp + 8]
mov esi, dword [esi + 0x14]
test eax, eax
lea eax, [ebp - 0x420]
push eax
je 0x4524ac
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x10]
push eax
add esi, 0x160
jmp 0x4524c4
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x10]
push eax
add esi, 0x170
push esi
push ebx
call fcn.0043d394
add esp, 0x18
push dword [ebp - 0x1c]
push ebx
call dword [sym.imp.GDI32.dll_SetTextColor]
push dword [ebp - 0x14]
push ebx
call edi
push dword [ebp - 0x18]
push ebx
call dword [sym.imp.GDI32.dll_SetBkMode]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x4564ae
Capabilities:
Link many functions at runtime

Disassembly:
mov eax, 0x4b29c6
call fcn.0047f954
push ecx
cmp dword [0x4f1f04], 0
jne 0x456645
push ebx
push esi
push edi
call fcn.004563ec
push str.Kernel32
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, str.LoadLibraryA
push edi
push eax
mov dword [0x4f1f34], eax
call esi
mov ebx, str.LoadLibraryW
mov dword [0x4f1f04], eax
push ebx
push dword [0x4f1f34]
call esi
push str.LoadLibraryExA
mov dword [0x4f1f08], eax
push dword [0x4f1f34]
call esi
push str.LoadLibraryExW
mov dword [0x4f1f0c], eax
push dword [0x4f1f34]
call esi
push str.GetProcAddress
mov dword [0x4f1f10], eax
push dword [0x4f1f34]
call esi
push 0x18
mov dword [0x4f1f14], eax
call fcn.00493b03
pop ecx
mov dword [ebp - 0x10], eax
and dword [ebp - 4], 0
mov esi, str.Kernel32.dll
test eax, eax
je 0x456565
push 0
push 0x456992
push edi
push esi
mov ecx, eax
call fcn.0045671d
jmp 0x456567
xor eax, eax
or dword [ebp - 4], 0xffffffff
push 0x18
mov dword [0x4f1f18], eax
call fcn.00493b03
pop ecx
mov dword [ebp - 0x10], eax
xor edi, edi
mov dword [ebp - 4], 1
cmp eax, edi
je 0x456599
push edi
push 0x4569ad
push ebx
push esi
mov ecx, eax
call fcn.0045671d
jmp 0x45659b
xor eax, eax
or dword [ebp - 4], 0xffffffff
push 0x18
mov dword [0x4f1f1c], eax
call fcn.00493b03
pop ecx
mov dword [ebp - 0x10], eax
cmp eax, edi
mov dword [ebp - 4], 2
je 0x4565cf
push edi
push 0x4569c8
push str.LoadLibraryExA
push esi
mov ecx, eax
call fcn.0045671d
jmp 0x4565d1
xor eax, eax
or dword [ebp - 4], 0xffffffff
push 0x18
mov dword [0x4f1f20], eax
call fcn.00493b03
pop ecx
mov dword [ebp - 0x10], eax
cmp eax, edi
mov dword [ebp - 4], 3
je 0x456605
push edi
push 0x4569ed
push str.LoadLibraryExW
push esi
mov ecx, eax
call fcn.0045671d
jmp 0x456607
xor eax, eax
or dword [ebp - 4], 0xffffffff
push 0x18
mov dword [0x4f1f24], eax
call fcn.00493b03
pop ecx
mov dword [ebp - 0x10], eax
cmp eax, edi
mov dword [ebp - 4], 4
je 0x45663b
push edi
push 0x456a12
push str.GetProcAddress
push esi
mov ecx, eax
call fcn.0045671d
jmp 0x45663d
xor eax, eax
pop edi
pop esi
mov dword [0x4f1f28], eax
pop ebx
mov ecx, dword [ebp - 0xc]
push 1
pop eax
mov dword fs:[0], ecx
leave
ret
Function at 0x45671d
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
cmp dword [0x4f1f2c], 0
push esi
mov esi, ecx
jne 0x456741
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x18]
mov dword [0x4f1f2c], eax
mov eax, dword [0x4f1f30]
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov dword [esi], eax
mov eax, dword [ebp + 8]
mov dword [0x4f1f30], esi
mov dword [esi + 0x10], edx
mov edx, dword [ebp + 0x14]
push ecx
push eax
mov dword [esi + 4], eax
mov dword [esi + 8], ecx
mov dword [esi + 0x14], edx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call fcn.004567de
mov dword [esi + 0xc], eax
cmp eax, dword [0x4f1f2c]
jbe 0x45678a
cmp byte [eax], 0x68
jne 0x45678a
mov eax, dword [eax + 1]
mov dword [esi + 0xc], eax
push dword [esi + 0x14]
push dword [esi + 0x10]
push dword [esi + 0xc]
push dword [esi + 4]
call fcn.004567ef
mov eax, esi
pop esi
leave
ret 0x10

Function at 0x456d2b
Capabilities:
Allocate or change rwx memory

Disassembly:
mov eax, dword [esp + 8]
push ebx
mov ebx, dword [esp + 8]
push esi
mov esi, ecx
push edi
and dword [esi + 0xc], 0
lea edi, [esi + 0xc]
mov dword [esi + 4], ebx
mov dword [esi + 8], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp dword [esi + 4], 0
mov dword [esi], eax
je 0x456d77
cmp dword [esi + 8], 0
je 0x456d77
push dword [esp + 0x14]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
test eax, eax
je 0x456d77
push edi
push 0x40
push dword [esp + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, esi
pop edi
pop esi
pop ebx
ret 8

Function at 0x45c95e
Capabilities:
Get common file path

Disassembly:
mov eax, 0x4b2f60
call fcn.0047f954
sub esp, 0x11c
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [ebp - 0x14], esi
cmp dword [esi + 0xfc], ebx
jne 0x45ca50
mov edi, dword [sym.imp.USER32.dll_LoadCursorA]
push 0x7f89
push ebx
call edi
cmp eax, ebx
mov dword [esi + 0xfc], eax
jne 0x45ca50
mov al, byte [ebp - 0xd]
push ebx
lea ecx, [ebp - 0x24]
mov byte [ebp - 0x24], al
call fcn.0043688b
mov esi, 0x104
lea eax, [ebp - 0x128]
push esi
push ebx
push eax
mov dword [ebp - 4], ebx
call fcn.0047f870
add esp, 0xc
lea eax, [ebp - 0x128]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0x128]
push eax
call fcn.0047fdc0
pop ecx
push eax
lea eax, [ebp - 0x128]
push eax
lea ecx, [ebp - 0x24]
call fcn.00436c6c
mov esi, str.winhlp32.exe
push esi
call fcn.0047fdc0
pop ecx
push eax
push esi
lea ecx, [ebp - 0x24]
call fcn.00460d92
mov eax, dword [ebp - 0x20]
cmp eax, ebx
jne 0x45ca15
mov eax, 0x4b9358
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
cmp esi, ebx
je 0x45ca3b
push 0x6a
push esi
call edi
cmp eax, ebx
je 0x45ca3b
push eax
call dword [sym.imp.USER32.dll_CopyIcon]
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0xfc], eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
or dword [ebp - 4], 0xffffffff
push 1
lea ecx, [ebp - 0x24]
call fcn.0043688b
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret