joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2a82cc8b
Capabilities:
Encode data using base64

Disassembly:
push 0x14
mov eax, 0x2a84f345
call fcn.2a8015aa
mov edi, dword [ebp + 0xc]
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], edi
cmp dword [edi + 0x14], 0x10
jb 0x2a82ccad
mov eax, dword [edi]
mov dword [ebp - 0x14], eax
mov esi, dword [ebp + 8]
mov ebx, dword [edi + 0x10]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x20], esi
mov dword [esi + 0x10], ecx
mov dword [esi + 0x14], 0xf
mov byte [esi], cl
push ecx
mov eax, ebx
mov dword [ebp - 4], ecx
shl eax, 2
push 3
pop ecx
cdq
idiv ecx
mov dword [ebp - 0x1c], 1
add eax, ecx
mov ecx, esi
push eax
call fcn.2a80bdc5
cmp dword [esi + 0x14], 0x10
mov edx, esi
jb 0x2a82ccef
mov edx, dword [esi]
xor ecx, ecx
test ebx, ebx
jle 0x2a82cda0
mov esi, dword [ebp - 0x14]
movzx eax, byte [esi + ecx]
shr eax, 2
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx], al
mov bl, byte [esi + ecx]
and bl, 3
shl bl, 4
inc ecx
cmp ecx, dword [ebp - 0x10]
jge 0x2a82cd22
mov al, byte [esi + ecx]
shr al, 4
or bl, al
movzx eax, bl
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx + 1], al
mov eax, dword [ebp - 0x10]
cmp ecx, eax
jge 0x2a82cd63
cmp dword [edi + 0x14], 0x10
mov ebx, edi
jb 0x2a82cd3f
mov ebx, dword [edi]
mov bl, byte [ebx + ecx]
and bl, 0xf
shl bl, 2
inc ecx
cmp ecx, eax
jge 0x2a82cd55
mov al, byte [esi + ecx]
shr al, 6
or bl, al
movzx eax, bl
mov bl, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov eax, dword [ebp - 0x10]
jmp 0x2a82cd65
mov bl, 0x3d
lea esi, [edx + 3]
mov byte [edx + 2], bl
mov dword [ebp - 0x18], esi
mov edx, esi
mov esi, dword [ebp - 0x14]
inc edx
cmp ecx, eax
jge 0x2a82cd8a
movzx eax, byte [esi + ecx]
and eax, 0x3f
mov bl, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov eax, dword [ebp - 0x10]
jmp 0x2a82cd8c
mov bl, 0x3d
mov esi, dword [ebp - 0x18]
inc ecx
mov byte [esi], bl
mov esi, dword [ebp - 0x14]
cmp ecx, eax
jl 0x2a82ccfc
mov esi, dword [ebp - 0x20]
cmp dword [esi + 0x14], 0x10
mov eax, esi
jb 0x2a82cdaa
mov eax, dword [esi]
push 0
sub edx, eax
mov ecx, esi
push edx
call fcn.2a80bdc5
mov eax, esi
call fcn.2a80187a
ret

Function at 0x2a82f2c5
Capabilities:
Get hostname

Disassembly:
push 0x448
mov eax, 0x2a84f81b
call fcn.2a84a907
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x410]
mov edi, 0x400
mov dword [ebp - 0x450], esi
push edi
xor ebx, ebx
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x410]
push edi
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
jne 0x2a82f329
lea eax, [ebp - 0x410]
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], 0xf
mov ecx, esi
push eax
mov byte [esi], bl
call fcn.2a805678
mov eax, esi
call fcn.2a84a8e5
ret
push 0x93
lea ecx, [ebp - 0x454]
call fcn.2a80bdc5
lea ecx, [ebp - 0x44c]
mov dword [ebp - 4], ebx
push ecx
mov ecx, eax
call fcn.2a827d86
push eax
lea ecx, [ebp - 0x434]
mov byte [ebp - 4], 1
call fcn.2a821de4
push 0x2a85dc48
lea eax, [ebp - 0x434]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x2a84a76f
Capabilities:
Create process on windows

Disassembly:
push 0x48
mov eax, 0x2a851e75
call fcn.2a8015aa
mov edi, ecx
push 0x44
pop esi
push esi
xor ebx, ebx
lea eax, [ebp - 0x54]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
push 0x10
mov dword [ebp - 0x54], esi
call fcn.2a80bdc5
mov esi, eax
add esp, 0x10
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], ebx
test esi, esi
je 0x2a84a7b4
push 0x10
push ebx
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
jmp 0x2a84a7b6
mov esi, ebx
or dword [ebp - 4], 0xffffffff
mov ecx, edi
mov dword [edi + 0x24], esi
call fcn.2a849b77
push dword [edi + 0x24]
lea ecx, [ebp - 0x54]
push ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push eax
push ebx
call dword [sym.imp.kernel32.dll_CreateProcessW]
call fcn.2a80187a
ret
Function at 0x406bd0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x406c28
cmp byte [esi + ebx - 1], 0xa
je 0x406bfc
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x40c0a4], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret
Function at 0x407250
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xe0
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [esp], eax
call sym.___wine_dbg_get_channel_flags
movzx eax, al
bt eax, esi
jae 0x407428
mov edi, dword [0x40c0a4]
xor eax, eax
mov edx, dword fs:[0x18]
cmp dword [edx + 0x24], edi
je 0x407337
test byte [0x40826c], 8
jne 0x4073d0
lea ebx, [ebp - 0xd4]
mov edi, ebx
test byte [0x40827c], 8
jne 0x407390
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [esp + 4], str._04x:
mov dword [esp], edi
mov dword [esp + 8], eax
call sym._sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x4072d9
cmp esi, 3
jbe 0x407348
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov ecx, ebx
mov edi, eax
mov esi, dword [ecx]
add ecx, 4
lea edx, [esi - 0x1010101]
not esi
and edx, esi
and edx, 0x80808080
je 0x4072ea
mov esi, edx
mov dword [esp + 0xc], edi
shr esi, 0x10
test edx, 0x8080
mov dword [esp + 4], 1
cmove edx, esi
lea esi, [ecx + 2]
mov dword [esp], ebx
cmove ecx, esi
mov eax, edx
add al, dl
sbb ecx, 3
sub ecx, ebx
mov dword [esp + 8], ecx
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0xe0
pop ebx
pop esi
pop edi
pop ebp
ret
add eax, edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 8], str._s:_s:_s
mov dword [esp], eax
mov dword [esp + 0x14], edi
mov edi, dword [ebp + 0xc]
lea edx, [edi + 1]
mov dword [esp + 0x10], edx
mov edx, dword [esi*4 + 0x409c08]
mov dword [esp + 0xc], edx
mov edx, ebx
sub edx, eax
add edx, 0xc8
mov dword [esp + 4], edx
call sym._snprintf.constprop.0
jmp 0x4072d9
mov dword [esp], 0x40827c
call sym.___wine_dbg_get_channel_flags
test al, 8
je 0x4072b0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov dword [esp], edi
mov dword [esp + 4], str._04x:
mov dword [esp + 8], eax
call sym._sprintf
add edi, eax
jmp 0x4072b0
mov dword [esp], 0x40826c
call sym.___wine_dbg_get_channel_flags
test al, 8
je 0x40729b
call dword [sym.imp.kernel32.dll_GetTickCount]
mov edx, 0x10624dd3
lea ebx, [ebp - 0xd4]
mov dword [esp + 4], str._3u._03u:
mov ecx, eax
mul edx
mov dword [esp], ebx
shr edx, 6
imul eax, edx, 0x3e8
mov dword [esp + 8], edx
sub ecx, eax
mov dword [esp + 0xc], ecx
call sym._sprintf
lea edi, [ebx + eax]
jmp 0x4072a3
mov eax, 0xffffffff
jmp 0x407337

Function at 0x4076c0
Capabilities:
Get process heap flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov dword [esp], 1
call sym.__configure_wide_argv
call sym.__initialize_wide_environment
call sym.___p___argc
mov esi, dword [eax]
call sym.___p___wargv
mov edi, dword [eax]
call sym.__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sym.__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call sym._wmain
mov dword [esp], eax
call sym._exit
nop
nop
nop
Function at 0x401dd0
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56a5f0
mov eax, dword fs:[0]
push eax
sub esp, 0x378
mov eax, dword [0x5c9e64]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 8
push eax
mov dword [ebp - 0x14], 0xff
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov ecx, edi
call fcn.0040599c
push 0
call fcn.00406d76
push 0xc
call fcn.00404bb1
add esp, 8
mov dword [ebp - 0x384], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x401e59
xorps xmm0, xmm0
mov ecx, eax
movq qword [eax], xmm0
mov dword [eax + 8], 0
call fcn.00407baf
mov esi, eax
jmp 0x401e5b
xor esi, esi
push 0x57b7f0
mov dword [ebp - 4], 0xffffffff
call fcn.0041050d
push str.Local_AppWizard_Generated_Applications
mov ecx, edi
call fcn.00413bcd
push 0x368
lea eax, [ebp - 0x380]
push 0
push eax
call fcn.0054e4d0
add esp, 0xc
lea ecx, [ebp - 0x380]
push 0
push 0x66
call fcn.0041c726
mov dword [ebp - 4], 1
mov dword [ebp - method.CDialogEx.virtual_0], 0x5abb98
call fcn.00418f83
mov ecx, eax
test ecx, ecx
je 0x402020
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x2b0], eax
lea ecx, [ebp - 0x2a8]
mov byte [ebp - 4], 2
call fcn.0041cd3e
mov dword [ebp - method.CButton.virtual_0], vtable.CButton.0
lea ecx, [ebp - 0x228]
mov byte [ebp - 4], 3
call fcn.0041cd3e
mov dword [ebp - method.CComboBox.virtual_0], vtable.CComboBox.0
lea ecx, [ebp - 0x1a8]
mov byte [ebp - 4], 4
call fcn.0041cd3e
mov dword [ebp - method.CEdit.virtual_0], vtable.CEdit.0
lea eax, [ebp - 0x128]
mov byte [ebp - 4], 5
mov dword [ebp - 0x384], eax
call fcn.00418f83
test eax, eax
je 0x402020
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x128], eax
mov eax, 0x5abb90
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x128]
test eax, 0xffff0000
jne 0x401f64
movzx eax, ax
push eax
call fcn.00402380
jmp 0x401f70
push 0
push 0x5abb90
call fcn.00402500
lea ecx, [ebp - 0x120]
mov byte [ebp - 4], 7
call fcn.0041cd3e
mov dword [ebp - method.CProgressCtrl.virtual_0], vtable.CProgressCtrl.0
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x98]
mov dword [ebp - 0x9c], 0
call fcn.0041cd3e
mov dword [ebp - 0x98], vtable.CButton.0
mov byte [ebp - 4], 9
call fcn.00424b98
call fcn.00424b98
push 0x85
mov eax, dword [eax + 0xc]
push eax
call dword [sym.imp.USER32.dll_LoadIconW]
mov dword [ebp - 0x2ac], eax
lea eax, [ebp - 0x380]
mov dword [ebp - 4], 0xa
mov ecx, eax
mov dword [edi + 0x20], eax
call fcn.0041439d
test esi, esi
je 0x401ff3
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax + 4]
call fcn.0041538a
lea ecx, [ebp - 0x380]
call fcn.00402030
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0054c436
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00402910
int3
Function at 0x4022b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov eax, edi
shr eax, 4
inc eax
push 6
movzx eax, ax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp + 0xc], eax
test eax, eax
jne 0x4022d9
pop edi
pop ebx
pop ebp
ret
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4022ef
xor esi, esi
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4022e6
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [esi + eax]
and edi, 0xf
jbe 0x402322
nop
cmp esi, ecx
jae 0x4022e6
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edi, 1
jne 0x402310
cmp esi, ecx
jae 0x4022e6
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x402380
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov edi, dword [ebp + 8]
push edi
mov dword [ebp - 4], ecx
call fcn.00419257
mov ebx, eax
test ebx, ebx
jne 0x4023a0
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, edi
shr eax, 4
push esi
inc eax
push 6
movzx eax, ax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp + 8], eax
test eax, eax
je 0x402487
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x402487
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x402487
push dword [ebp + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [esi + eax]
and edi, 0xf
jbe 0x402408
cmp esi, ecx
jae 0x402487
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edi, 1
jne 0x4023f2
cmp esi, ecx
jae 0x402487
movzx eax, word [esi]
test ax, ax
je 0x402487
push 0
push 0
push 0
push 0
push eax
lea ecx, [esi + 2]
push ecx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
test edi, edi
js 0x402492
mov ebx, dword [ebp - 4]
mov edx, 1
mov eax, dword [ebx]
mov ecx, dword [eax - 8]
sub edx, dword [eax - 4]
sub ecx, edi
or edx, ecx
jge 0x402451
push edi
mov ecx, ebx
call fcn.00402830
mov eax, dword [ebx]
push 0
push 0
push edi
push eax
movzx eax, word [esi]
push eax
lea eax, [esi + 2]
push eax
push 0
push 3
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, dword [ebx]
cmp edi, dword [eax - 8]
jg 0x402492
mov dword [eax - 0xc], edi
mov eax, dword [ebx]
pop esi
mov byte [edi + eax], 0
mov eax, 1
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop esi
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.00402910
int3
Function at 0x404140
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
movzx eax, word [ebp + 8]
mov dword [ebp + 8], eax
pop ebp
jmp fcn.0041402f

Function at 0x4073e3
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
xor edi, edi
mov eax, ecx
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], edi
je 0x407428
call fcn.00424b98
push 0xf0
push dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x407425
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40746f
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov eax, dword [ebp - 4]
push ebx
xor ebx, ebx
inc ebx
test edi, edi
je 0x40744b
mov ecx, dword [eax]
push dword [ebp + 0x10]
push edi
mov esi, dword [ecx + 0x20]
mov ecx, esi
push dword [ebp + 8]
call dword [0x57a9e8]
mov ecx, dword [ebp - 4]
call esi
mov ebx, eax
mov eax, dword [ebp + 8]
mov edi, dword [eax + 0x70]
test edi, edi
je 0x40746c
mov edx, dword [edi]
push dword [ebp + 0x10]
mov esi, dword [edx + 0xa0]
mov ecx, esi
call dword [0x57a9e8]
mov ecx, edi
call esi
mov eax, ebx
pop ebx
pop edi
pop esi
leave
ret 0xc

Function at 0x41384a
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
push edi
cmp dword [ecx + 0x58], esi
je 0x41389d
push esi
push dword [ebp + 8]
call fcn.00413a30
mov edi, eax
test edi, edi
je 0x413898
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp + 0xc]
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x413898
mov eax, dword [ebp - 8]
jmp 0x4138af
mov eax, dword [ebp + 0x10]
jmp 0x4138af
push dword [ecx + 0x6c]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
pop edi
pop esi
leave
ret 0xc

Function at 0x414087
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, ecx
xor esi, esi
call fcn.00424b98
push 5
push dword [ebp + 8]
mov edi, dword [eax + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4140ba
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
push edi
push dword [ebp + 0xc]
mov ecx, ebx
push esi
call fcn.004140cd
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x41ecc3
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
xor esi, esi
mov ebx, ecx
push edi
cmp dword [ebp + 8], esi
je 0x41ed02
call fcn.00424b98
push 0xf0
push dword [ebp + 8]
mov edi, dword [eax + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x41ed02
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x41ed0a
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
push esi
mov ecx, ebx
call fcn.00424d47
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x41f701
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
je 0x41f78d
cmp dword [esi + 0x20], 0
je 0x41f78d
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x41f78d
cmp dword [ebp + 8], 0
je 0x41f78d
xor edi, edi
mov ebx, edi
call fcn.00424b98
push str.AFX_DIALOG_LAYOUT
push dword [ebp + 8]
mov eax, dword [eax + 0xc]
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 8], eax
test eax, eax
je 0x41f771
mov ebx, dword [ebp - 4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp - 8]
mov edi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x41f78d
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
push edi
push ebx
push esi
call fcn.004c23db
mov edi, eax
add esp, 0xc
test edi, edi
je 0x41f789
mov ecx, esi
call fcn.0041f49f
mov eax, edi
jmp 0x41f78f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x42416e
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x56ab68
call fcn.0054cb28
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x74], ebx
jne 0x424194
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x4241ee
lea ecx, [ebp - 0x10]
call fcn.00402250
mov edi, dword [edi + 0x74]
lea ecx, [ebp - 0x10]
push ecx
mov dword [ebp - 4], ebx
mov eax, dword [edi]
mov esi, dword [eax + 0x8c]
mov ecx, esi
call dword [0x57a9e8]
mov ecx, edi
call esi
mov esi, dword [ebp + 8]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push esi
call fcn.005556d2
push eax
call fcn.00405317
add esp, 0x14
test esi, esi
je 0x4241e1
push esi
call fcn.00554aa0
pop ecx
mov ebx, eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00402c30
mov eax, ebx
call fcn.0054caf6
ret 8
Function at 0x424fe2
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
mov ecx, dword [esi + 4]
call fcn.00423d4b
push 0xfffffffffffffff0
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowLongA]
push dword [ebp + 0xc]
and eax, 3
mov ecx, esi
cmp al, 3
je 0x42501e
call fcn.004251ff
mov dword [esi + 0xc], 1
jmp 0x425023
call fcn.004251ff
cmp dword [esi], 0
je 0x42506e
push edi
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov esi, dword [ebp + 0x10]
mov edi, eax
mov ecx, esi
test edi, edi
jle 0x425049
push edi
call fcn.00416cf9
lea ecx, [edi + 1]
push ecx
jmp 0x425058
push 0xff
call fcn.00402890
push 0x100
push eax
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0xffffffffffffffff
mov ecx, esi
call fcn.00413b6c
pop edi
jmp 0x425092
mov esi, dword [ebp + 0x10]
push dword [esi]
push 0xffffffffffffffff
push 0x14d
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 0xffffffff
jne 0x425092
push dword [esi]
push dword [ebp - 4]
call fcn.00429b7a
pop esi
leave
ret 0xc

Function at 0x425156
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
push edi
push dword [ebp + 0xc]
call fcn.004251ff
cmp dword [esi], 0
mov edi, eax
mov dword [esi + 0xc], 1
je 0x42519e
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.00416cf9
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.00413b6c
jmp 0x4251a9
mov eax, dword [ebp + 0x10]
push dword [eax]
push edi
call fcn.00429b7a
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x43b9b4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
push edi
test esi, esi
jne 0x43b9cd
call fcn.00424b98
mov esi, dword [eax + 0xc]
push 0x581c40
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
je 0x43ba0f
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x43ba0f
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x43ba0f
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 4]
push eax
push ebx
call fcn.0043ba18
jmp 0x43ba11
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x4c3e27
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
mov dword [ebp - 4], ebx
test byte [esi + 4], 1
mov edi, dword [esi + 0xc]
jne 0x4c3e7d
push 5
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x4c3e56
call fcn.00419c74
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x4c3e6b
call fcn.00419c74
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x4c3e7d
call fcn.00419c74
call fcn.00424b98
cmp dword [eax + 0x3c], 0
je 0x4c3e92
push edi
mov ecx, ebx
call fcn.004c354a
mov edi, eax
push dword [ebp + 0xc]
push edi
call fcn.004c4078
mov ebx, eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x88]
test ecx, ecx
je 0x4c3ebb
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 4]
and dword [eax + 0x88], 0
test ebx, ebx
je 0x4c3ec7
mov edi, ebx
mov dword [eax + 0x88], ebx
or dword [esi + 4], 1
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x51477d
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, ecx
call fcn.00547cf3
call fcn.00424bec
cmp dword [eax + 0x14], 0
jne 0x514798
mov ecx, esi
pop esi
jmp fcn.00513aa1
pop esi
ret

Function at 0x51486d
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
call fcn.0055bb49
pop ecx
test eax, eax
jne 0x5148af
push dword [ebp - 4]
push dword [ebp + 0xc]
push dword [ebp + 8]
push str._s_s_X.tmp
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.00413dd0
add esp, 0x18
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x514875
leave
ret
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
leave
ret

Function at 0x52eb7d
Capabilities:
Get common file path
Get file system object information

Disassembly:
push esi
mov esi, ecx
call fcn.00401d70
call fcn.00424bec
cmp dword [eax + 0x14], 0
jne 0x52eb98
mov ecx, esi
pop esi
jmp fcn.0052e3ee
pop esi
ret
Function at 0x564a38
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005646b5