joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4419b0
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x60
mov eax, dword [ebx]
mov edx, dword [eax + 0xc]
push ebp
push esi
push edi
mov ecx, ebx
call edx
mov edi, eax
push 0x68
push edi
mov dword [esp + 0x2c], edi
call fcn.00658a3b
add esp, 8
push 2
lea edx, [esp + 0x18]
push edx
mov dword [ebx + 0x2c], eax
push 0xd
xor eax, eax
push 0x400
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
cmp word [esp + 0x14], 0x30
mov ecx, dword [ebx + 0x28]
mov eax, dword [ecx]
mov edx, dword [eax + 0x58]
jne 0x441a25
fldz
fst qword [esp + 0x48]
fstp qword [esp + 0x50]
call edx
fmul qword [0x9adbb0]
mov ecx, dword [ebx + 0x28]
mov eax, dword [ecx]
mov edx, dword [eax + 0x58]
fstp qword [esp + 0x58]
call edx
fmul qword [0x9adba8]
jmp 0x441a4b
call edx
fmul qword [0x9adba0]
fldz
mov ecx, dword [ebx + 0x28]
mov eax, dword [ecx]
fst qword [esp + 0x48]
mov edx, dword [eax + 0x58]
fstp qword [esp + 0x50]
fstp qword [esp + 0x58]
call edx
fmul qword [0x9adb98]
fld qword [esp + 0x48]
mov eax, dword [ebx + 0x30]
fstp qword [esp + 0x28]
mov esi, 1
fld qword [esp + 0x50]
fstp qword [esp + 0x30]
fld qword [esp + 0x58]
fstp qword [esp + 0x38]
fstp qword [esp + 0x40]
cmp eax, esi
je 0x441a80
mov dword [esp + 0x18], 2
cmp eax, 4
jne 0x441a84
mov dword [esp + 0x18], esi
mov ecx, dword [ebx + 0x34]
mov dword [esp + 0x20], ecx
cmp eax, 3
je 0x441a95
cmp eax, 6
jne 0x441aa7
cmp ecx, esi
jne 0x441aa7
cmp dword [esp + 0x18], esi
jle 0x441aa7
mov dword [esp + 0x20], 0
mov dword [esp + 0x10], esi
cmp edi, esi
jl 0x441b8f
mov dword [esp + 0x1c], 0x68
jmp 0x441ac4
mov esi, dword [esp + 0x10]
mov eax, dword [ebx]
mov edx, dword [eax + 0x64]
push esi
mov ecx, ebx
call edx
test al, al
jne 0x441ad6
xor ebp, ebp
jmp 0x441ae9
mov eax, dword [ebx + 0x2c]
test eax, eax
jne 0x441ae1
xor ebp, ebp
jmp 0x441ae9
mov ecx, dword [esp + 0x1c]
lea ebp, [ecx + eax - 0x68]
mov ecx, dword [ebx + 0x28]
mov edx, dword [ecx]
mov edx, dword [edx + 0x10]
push esi
lea eax, [esp + 0x4c]
push eax
call edx
mov esi, eax
mov ecx, 8
mov edi, ebp
rep movsd dword es:[edi], dword [esi]
fld qword [ebp + 0x10]
fldz
fld st(0)
fucomp st(2)
fnstsw ax
fstp st(1)
test ah, 0x44
jnp 0x441b24
fld qword [ebp + 0x18]
fucompp
fnstsw ax
test ah, 0x44
jp 0x441b42
jmp 0x441b26
fstp st(0)
fld qword [esp + 0x28]
fstp qword [ebp]
fld qword [esp + 0x30]
fstp qword [ebp + 8]
fld qword [esp + 0x38]
fstp qword [ebp + 0x10]
fld qword [esp + 0x40]
fstp qword [ebp + 0x18]
fldz
mov byte [ebp + 0x40], 0
fstp dword [ebp + 0x54]
mov eax, dword [ebx + 0x30]
cmp eax, 4
je 0x441b5d
cmp eax, 5
je 0x441b5d
cmp eax, 6
jne 0x441b63
mov eax, dword [esp + 0x10]
jmp 0x441b77
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x10]
cmp ecx, eax
jg 0x441b7b
add ecx, dword [esp + 0x18]
cmp eax, ecx
jge 0x441b7b
mov byte [ebp + 0x40], 1
add dword [esp + 0x1c], 0x68
inc eax
mov dword [esp + 0x10], eax
cmp eax, dword [esp + 0x24]
jle 0x441ac0
pop edi
pop esi
pop ebp
add esp, 0x60
ret
Function at 0x444770
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x78
mov eax, dword [0x9c48d0]
xor eax, esp
mov dword [esp + 0x74], eax
mov eax, dword [esp + 0x7c]
push ebx
push ebp
push esi
mov esi, dword [ecx + 0x18]
push edi
lea edx, [esp + 0x14]
push edx
xor ebp, ebp
push ebp
call fcn.004356a0
mov edi, eax
cmp edi, ebp
je 0x4447a3
xor eax, eax
cmp ax, word [edi]
jne 0x4447ba
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x74]
xor ecx, esp
call fcn.0065865c
add esp, 0x78
ret 0x24
xor eax, eax
lea edx, [esp + 0x2c]
lea ecx, [esp + 0x5c]
push edx
lea esi, [esp + 0x94]
mov dword [esp + 0x58], ebp
mov dword [esp + 0x80], ebp
mov dword [esp + 0x84], ebp
mov dword [esp + 0x50], ebp
mov dword [esp + 0x54], 0xf
mov dword [esp + 0x5c], ecx
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], eax
mov dword [esp + 0x68], eax
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], eax
mov dword [esp + 0x78], eax
mov dword [esp + 0x7c], eax
call fcn.00431110
mov eax, edi
mov dword [esp + 0x10], eax
cmp word [edi], bp
je 0x4448ea
movzx ebx, word [eax]
cmp ebx, 0xa
je 0x4448ac
mov eax, ebp
sar eax, 1
shl eax, 4
add eax, dword [esp + 0x14]
sub esp, 0x10
mov ecx, dword [eax + 4]
mov edx, dword [eax]
mov edi, dword [eax + 8]
mov esi, dword [eax + 0xc]
mov dword [esp + 0x50], ecx
mov ecx, esp
mov dword [ecx], edx
mov dword [esp + 0x4c], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov edx, edi
mov dword [ecx + 8], edx
mov eax, esi
mov dword [ecx + 0xc], eax
lea eax, [esp + 0x2c]
lea ecx, [esp + 0x3c]
call fcn.00412340
cmp dword [esp + 0x24], 0
je 0x4448d0
cmp dword [esp + 0x28], 0
je 0x4448d0
fild dword [esp + 0x28]
imul esi, edi
fimul dword [esp + 0x24]
mov dword [esp + 0x18], esi
fild dword [esp + 0x18]
fdivp st(1)
fcomp qword [0x9add10]
fnstsw ax
test ah, 1
jne 0x4448d0
push ebx
lea eax, [esp + 0x50]
call fcn.00412590
jmp 0x4448d0
mov eax, dword [esp + 0x4c]
test eax, eax
je 0x4448d0
mov ecx, dword [esp + 0x58]
cmp word [ecx + eax*2 - 2], 0xa
je 0x4448d0
push 2
push 0x92395c
lea eax, [esp + 0x54]
call fcn.00412a00
mov eax, dword [esp + 0x10]
add eax, 2
add ebp, 2
cmp word [eax], 0
mov dword [esp + 0x10], eax
jne 0x444822
xor ebp, ebp
lea edi, [esp + 0x4c]
call fcn.0042cf50
mov esi, eax
mov eax, dword [esp + 0x58]
lea edx, [esp + 0x5c]
cmp eax, edx
je 0x44491b
mov ecx, dword [esp + 0x7c]
push eax
cmp ecx, ebp
jne 0x444914
call fcn.00658a01
add esp, 4
jmp 0x44491b
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
call eax
mov ecx, dword [esp + 0x84]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0065865c
add esp, 0x78
ret 0x24
Function at 0x44b6b0
Capabilities:
Create thread

Disassembly:
mov eax, dword [edi + 0x64]
mov ecx, dword [eax + 0x14]
mov eax, dword [ecx + 0x10]
mov ecx, dword [eax + 0x34]
mov edx, dword [eax + 0x38]
mov eax, dword [eax + 0x20]
sub esp, 8
push ebx
mov ebx, dword [eax + 0x14]
push ebp
mov ebp, dword [eax + 0x18]
push esi
mov esi, dword [eax + 0x10]
mov eax, dword [eax + 0x1c]
add ebx, eax
add ebp, esi
sub ecx, ebx
sub edx, ebp
test ecx, ecx
jle 0x44b6ea
test edx, edx
jle 0x44b6ea
mov ebp, ecx
mov ebx, edx
jmp 0x44b6ee
xor ebx, ebx
xor ebp, ebp
test ebp, ebp
je 0x44b803
test ebx, ebx
je 0x44b803
cmp dword [edi + 0x68], 0
je 0x44b803
cmp dword [edi + 0xa4], ebp
jne 0x44b71c
cmp dword [edi + 0xa8], ebx
je 0x44b803
mov esi, edi
mov dword [edi + 0xa4], ebp
mov dword [edi + 0xa8], ebx
call fcn.0044b3d0
push 0x58
call fcn.00659e93
mov esi, eax
xor ecx, ecx
add esp, 4
cmp esi, ecx
je 0x44b76b
push 0x40
lea eax, [esi + 0x10]
push ecx
push eax
mov dword [esi + 8], 0x400
mov dword [esi + 0x50], ecx
mov dword [esi + 0x54], ecx
mov dword [esi], ecx
mov dword [esi + 4], 0xf
mov dword [esi + 0xc], eax
call fcn.0065b340
add esp, 0xc
jmp 0x44b76d
xor esi, esi
lea eax, [edi + 0x78]
sub esp, 0x10
mov dword [edi + 0x98], esi
mov dword [esp + 0x20], eax
lea eax, [edi + 0x68]
mov esi, esp
call fcn.004405c0
mov eax, dword [esp + 0x20]
mov ecx, ebx
mov edx, ebp
call fcn.0044a910
push 0x43c
mov esi, eax
call fcn.00659e93
mov ebx, eax
add esp, 0x14
test ebx, ebx
je 0x44b7ce
mov edx, dword [edi + 4]
mov eax, dword [edi + 0xa0]
push edx
push eax
push edi
push esi
sub esp, 0x10
lea eax, [edi + 0x68]
mov esi, esp
call fcn.004405c0
mov esi, ebx
call fcn.0044ab60
mov esi, eax
jmp 0x44b7d0
xor esi, esi
push 0
push 0
push esi
push 0x455fb0
mov dword [edi + 0xac], esi
mov ecx, dword [esi + 4]
push 0
push 0
mov dword [edi + 0xb0], ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 8], eax
mov eax, edi
pop esi
pop ebp
pop ebx
add esp, 8
jmp fcn.0044bc20
pop esi
pop ebp
pop ebx
add esp, 8
ret

Function at 0x450e60
Capabilities:
Get common file path

Disassembly:
sub esp, 0x210
mov eax, dword [0x9c48d0]
xor eax, esp
mov dword [esp + 0x20c], eax
push esi
push 0x104
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push str.kernel32.dll
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea edx, [esp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
jne 0x450ea8
xor esi, esi
jmp 0x450eb6
push str.IsWow64Process
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov dword [esp + 4], 0
test esi, esi
je 0x450ed0
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
cmp dword [esp + 4], 0
mov ecx, dword [esp + 0x210]
setne al
pop esi
xor ecx, esp
call fcn.0065865c
add esp, 0x210
ret
Function at 0x450f30
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
push edi
xor edi, edi
mov ebx, 0x20019
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
lea eax, [esp + 0x10]
push eax
push ebx
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x450fc0
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push eax
push esi
push esi
push esi
push ecx
push edx
call ebp
mov esi, eax
test esi, esi
jne 0x450fb5
mov eax, dword [esp + 0x14]
shr eax, 1
inc eax
push 2
push eax
call fcn.00658a3b
mov edx, dword [esp + 0x2c]
add esp, 8
lea ecx, [esp + 0x14]
push ecx
mov edi, eax
mov eax, dword [esp + 0x14]
push edi
push esi
push esi
push edx
push eax
call ebp
mov esi, eax
test esi, esi
je 0x450fb5
push edi
call fcn.00658a01
add esp, 4
xor edi, edi
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, 2
jne 0x450fe1
cmp dword [esp + 0x1c], reloc.OLEAUT32.dll_SysReAllocString
jne 0x450fe1
cmp ebx, 0x20019
jne 0x450fe1
mov ebx, 0x20119
jmp 0x450f44
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret

Function at 0x450ff0
Capabilities:
Set registry value

Disassembly:
test edx, edx
je 0x451012
mov eax, edx
push esi
lea esi, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x451000
sub eax, esi
sar eax, 1
pop esi
jmp 0x451014
xor eax, eax
mov ecx, dword [esp + 0xc]
lea eax, [eax + eax + 2]
push eax
mov eax, dword [esp + 8]
push edx
mov edx, dword [esp + 0x10]
push 1
push ecx
push edx
push eax
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
neg eax
sbb eax, eax
inc eax
ret

Function at 0x4510a0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x210
mov eax, dword [0x9c48d0]
xor eax, esp
mov dword [esp + 0x20c], eax
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push edi
push 0x104
lea eax, [esp + 0x18]
push eax
call esi
mov edi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
push str.kernel32.dll
lea ecx, [esp + 0x18]
push ecx
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea edx, [esp + 0x14]
push edx
call ebx
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x451105
push str.SetProcessDEPPolicy
push eax
call ebp
test eax, eax
je 0x451105
push 1
call eax
jmp 0x451150
push 0x104
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x18], 5
call esi
push 0x9884f0
lea ecx, [esp + 0x18]
push ecx
call edi
lea edx, [esp + 0x14]
push edx
call ebx
test eax, eax
je 0x451150
push str.NtSetInformationProcess
push eax
call ebp
mov esi, eax
test esi, esi
je 0x451150
push 4
lea eax, [esp + 0x14]
push eax
push 0x22
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
mov ecx, dword [esp + 0x21c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0065865c
add esp, 0x210
ret
Function at 0x451730
Capabilities:
Get file version info

Disassembly:
sub esp, 0xc
push ebp
push esi
push edi
lea eax, [esp + 0xc]
push eax
push ebx
xor ebp, ebp
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov edi, eax
push edi
call fcn.00658d9b
mov esi, eax
add esp, 4
test esi, esi
je 0x451788
mov ecx, dword [esp + 0xc]
push esi
push edi
push ecx
push ebx
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x451788
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x14]
push eax
push 0x9291fc
push esi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x451788
mov ecx, dword [esp + 0x10]
mov ebp, dword [ecx + 8]
push esi
call fcn.00658a01
add esp, 4
pop edi
pop esi
mov eax, ebp
pop ebp
add esp, 0xc
ret

Function at 0x4517a0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x3c
test esi, esi
jne 0x4517ad
xor al, al
add esp, 0x3c
ret
push 0x38
lea eax, [esp + 8]
push 0
push eax
call fcn.0065b340
mov ecx, dword [esp + 0x50]
mov edx, dword [esp + 0x4c]
add esp, 0xc
lea eax, [esp]
push eax
mov dword [esp + 4], 0x3c
mov dword [esp + 8], 0x400
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], edx
mov dword [esp + 0x20], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
setne al
add esp, 0x3c
ret

Function at 0x451800
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x5c
push esi
push edi
mov esi, eax
xor eax, eax
push 0x40
push eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x24]
push eax
mov dword [esp + 0x14], 0
call fcn.0065b340
add esp, 0xc
mov dword [esp + 0x18], 0x44
test esi, esi
je 0x451846
push esi
call fcn.00661039
add esp, 4
mov esi, eax
jmp 0x451848
xor esi, esi
mov eax, dword [esp + 0x68]
lea ecx, [esp + 8]
push ecx
mov ecx, dword [esp + 0x70]
lea edx, [esp + 0x1c]
push edx
push eax
push 0
push ecx
push 0
push 0
push 0
push esi
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x451882
push esi
call fcn.00658a01
add esp, 4
xor eax, eax
pop edi
pop esi
add esp, 0x5c
ret
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [esp + 8]
push esi
call fcn.00658a01
add esp, 4
mov eax, edi
pop edi
pop esi
add esp, 0x5c
ret

Function at 0x451f80
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
test edi, edi
jne 0x451f87
xor al, al
ret
test bl, bl
jne 0x451f9d
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x451f84
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x451fa2
sub eax, edx
sar eax, 1
push esi
lea eax, [eax + eax + 2]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x451fe4
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
test bl, bl
jne 0x451fee
call dword [sym.imp.USER32.dll_CloseClipboard]
xor eax, eax
test esi, esi
setne al
pop esi
ret
Function at 0x452000
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
sub esp, 0x18
cmp byte [esp + 0x1c], 0
push ebx
push esi
mov esi, eax
jne 0x452028
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x452022
xor al, al
pop esi
pop ebx
add esp, 0x18
ret
call dword [sym.imp.USER32.dll_EmptyClipboard]
xor bl, bl
test esi, esi
je 0x45207f
lea eax, [esp + 8]
push eax
push 0x18
push esi
call dword [sym.imp.GDI32.dll_GetObjectW]
cmp dword [esp + 0x1c], 0
je 0x452071
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push 0
push ecx
push edx
push 0
push esi
call dword [sym.imp.USER32.dll_CopyImage]
mov esi, eax
push esi
push 2
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
push esi
setne bl
call dword [sym.imp.GDI32.dll_DeleteObject]
jmp 0x45207f
push esi
push 2
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
setne bl
cmp byte [esp + 0x24], 0
jne 0x45208c
call dword [sym.imp.USER32.dll_CloseClipboard]
pop esi
mov al, bl
pop ebx
add esp, 0x18
ret

Function at 0x452730
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
mov eax, dword [0x9c48d0]
xor eax, esp
mov dword [esp + 0x208], eax
push ebp
mov ebp, dword [esp + 0x214]
push edi
push 0x104
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push str.Normaliz.dll
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea edx, [esp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x45278e
push str.NormalizeString
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
jne 0x4527a7
pop edi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.0065865c
add esp, 0x20c
ret
push 0
push 0
push 0xffffffffffffffff
push ebp
push 5
call edi
test eax, eax
jle 0x45278e
lea eax, [eax + eax*2]
cdq
push ebx
push esi
sub eax, edx
mov esi, eax
sar esi, 1
inc esi
push 2
push esi
call fcn.00658a3b
add esp, 8
push esi
mov ebx, eax
push ebx
push 0xffffffffffffffff
push ebp
push 5
call edi
test eax, eax
jg 0x4527ea
push ebx
call fcn.00658a01
add esp, 4
xor eax, eax
jmp 0x4527f6
push 0
call fcn.00658a01
add esp, 4
mov eax, ebx
mov ecx, dword [esp + 0x218]
pop esi
pop ebx
pop edi
pop ebp
xor ecx, esp
call fcn.0065865c
add esp, 0x20c
ret

Function at 0x452810
Capabilities:
Get graphical window text

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
push 0
push 0
push 0xe
push ebp
call dword [sym.imp.USER32.dll_SendMessageW]
mov edi, eax
lea ebx, [edi + 1]
push 2
push ebx
call fcn.00658a3b
mov esi, eax
add esp, 8
test esi, esi
jne 0x452840
pop edi
pop esi
pop ebp
pop ebx
ret
push esi
push ebx
push 0xd
push ebp
call dword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
mov word [esi + edi*2], ax
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret
Function at 0x453260
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push esi
push edi
push 0xa
push 0xbeb
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push ebx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebp, eax
test ebp, ebp
jne 0x45329d
pop edi
pop esi
pop ebp
pop ebx
ret
lea ebx, [edi + 1]
push ebx
call fcn.00658d9b
mov esi, eax
add esp, 4
test esi, esi
je 0x4532be
push ebx
push ebp
push esi
call fcn.0065b3c0
add esp, 0xc
mov byte [esi + edi], 0
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret
Function at 0x453c90
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
push 0
push 0
mov esi, eax
mov edi, dword [esi]
push 0xe
push edi
mov ebx, ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [esp + 0x14], eax
inc eax
push 2
push eax
call fcn.00658a3b
mov ebp, eax
add esp, 8
test ebp, ebp
je 0x453cdb
mov eax, dword [esp + 0x14]
push ebp
inc eax
push eax
push 0xd
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [esp + 0x14]
xor eax, eax
mov word [ebp + ecx*2], ax
mov edi, dword [esi]
push ebp
call fcn.00451bf0
add esp, 4
push ebp
call fcn.00658a01
fld dword [0x9addf8]
mov edi, dword [esi]
fstp dword [esp]
call fcn.00452860
fld dword [0x9addf8]
mov edi, dword [esi]
fstp dword [esp]
mov dword [esp + 0x18], eax
call fcn.00452860
fld dword [0x9adcc8]
mov edx, dword [esp + 0x18]
fstp dword [esp]
add dword [ebx], edx
mov edi, dword [esi]
mov ebp, eax
call fcn.00452860
add dword [ebx], eax
mov eax, dword [esi + 0x24]
mov edi, dword [esi]
mov dword [esp + 0x18], eax
fild dword [esp + 0x18]
fstp dword [esp]
call fcn.00452860
mov ecx, dword [esi + 0x28]
mov edi, dword [esi]
mov dword [esp + 0x18], ecx
fild dword [esp + 0x18]
mov dword [esp + 0x1c], eax
fstp dword [esp]
call fcn.00452860
add eax, dword [esp + 0x1c]
add esp, 4
add dword [ebx], eax
cmp dword [ebx + 4], ebp
jge 0x453d69
mov dword [ebx + 4], ebp
mov eax, dword [esi + 0x2c]
mov edi, dword [esi]
mov dword [esp + 0x18], eax
fild dword [esp + 0x18]
push ecx
fstp dword [esp]
call fcn.00452860
mov ecx, dword [esi + 0x30]
mov edi, dword [esi]
mov dword [esp + 0x1c], ecx
fild dword [esp + 0x1c]
mov ebp, eax
fstp dword [esp]
call fcn.00452860
add esp, 4
pop edi
add eax, ebp
add dword [ebx + 4], eax
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0xc
ret
Function at 0x454490
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x270
mov eax, dword [0x9c48d0]
xor eax, esp
mov dword [esp + 0x26c], eax
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov eax, edi
mov esi, edx
call fcn.00455060
mov ebx, eax
lea eax, [esp + 0x28]
push eax
push edi
mov dword [esp + 0x20], ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
mov dword [esp + 0x1c], edi
cmp edi, 0xffffffff
jne 0x4544e0
push ebx
call fcn.00658a01
add esp, 4
xor al, al
jmp 0x4545b1
cmp byte [esp + 0x284], 0
sete byte [esp + 0x17]
test byte [esp + 0x28], 0x10
je 0x454528
cmp byte [esp + 0x284], 0
je 0x454586
mov ecx, 0x2e
cmp cx, word [esp + 0x54]
jne 0x45452f
mov ax, word [esp + 0x56]
test ax, ax
je 0x454586
mov edx, ecx
cmp dx, ax
jne 0x45452f
xor eax, eax
cmp ax, word [esp + 0x58]
jmp 0x45452d
cmp byte [esp + 0x17], 0
je 0x454586
lea eax, [esp + 0x54]
mov edx, ebx
call fcn.00455100
mov ebp, dword [esi]
lea edi, [ebp + 1]
mov ecx, edi
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], ebp
call fcn.0044f630
test al, al
jne 0x454556
xor eax, eax
mov byte [eax], al
mov eax, dword [esi]
mov ecx, dword [esi + 0xc]
lea ebx, [ecx + ebp*4]
cmp eax, ebp
jbe 0x454576
sub eax, ebp
add eax, eax
add eax, eax
push eax
lea edx, [ebx + 4]
push ebx
push edx
call fcn.006586a0
add esp, 0xc
mov eax, dword [esp + 0x20]
mov dword [esi], edi
mov edi, dword [esp + 0x1c]
mov dword [ebx], eax
mov ebx, dword [esp + 0x18]
lea ecx, [esp + 0x28]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4544ed
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov esi, dword [esi]
push ebx
call fcn.00658a01
add esp, 4
test esi, esi
setne al
mov ecx, dword [esp + 0x27c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0065865c
add esp, 0x270
ret

Function at 0x455510
Capabilities:
Get disk information

Disassembly:
sub esp, 0x10
mov eax, dword [0x9c48d0]
xor eax, esp
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x14]
movzx eax, word [eax]
mov ecx, dword [0x9885d4]
mov edx, dword [0x9885d8]
push eax
mov dword [esp + 8], ecx
mov dword [esp + 0xc], edx
call fcn.0065ddd3
mov word [esp + 8], ax
mov ecx, dword [esp + 8]
add ecx, 0xffffffbf
add esp, 4
cmp cx, 0x19
ja 0x455593
lea edx, [esp + 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 2
je 0x45557f
cmp eax, 5
je 0x45557f
cmp eax, 1
je 0x45557f
xor eax, eax
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.0065865c
add esp, 0x10
ret
mov eax, 1
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.0065865c
add esp, 0x10
ret
mov ecx, dword [esp + 0xc]
xor ecx, esp
xor al, al
call fcn.0065865c
add esp, 0x10
ret