joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41dc10
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x605328
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
push ebx
push ebp
push esi
push edi
mov ebp, ecx
xor ebx, ebx
mov dword [esp + 0x48], ebx
call fcn.004d4420
lea ecx, [esp + 0x20]
call fcn.004096c0
mov eax, dword [0x69c108]
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x50]
mov byte [esp + 0x48], 2
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x41dca9
lea ecx, [esp + 0x10]
mov byte [esp + 0x48], 1
call fcn.005eb0f5
mov dword [esp + 0x20], vtable.CArray_class_CFileInfo__class_CFileInfo__.0
mov esi, dword [esp + 0x24]
mov byte [esp + 0x48], 3
cmp esi, ebx
je 0x41de13
mov eax, dword [esp + 0x28]
cmp eax, ebx
je 0x41de0a
lea edi, [eax]
push 0
mov ecx, esi
call fcn.0040ab50
add esi, 0x38
dec edi
jne 0x41dc95
jmp 0x41de06
push 0x6713a0
lea ecx, [esp + 0x54]
call fcn.005e76aa
push 0x6713a0
lea ecx, [esp + 0x54]
call fcn.005eb4d1
push ebx
push ebx
push ebx
push ebx
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push str..tns
call fcn.005eb163
push ecx
lea edx, [esp + 0x6c]
mov ecx, esp
mov dword [esp + 0x30], esp
push edx
mov byte [esp + 0x68], 4
call fcn.005eae6a
lea ecx, [esp + 0x3c]
mov byte [esp + 0x64], 2
call fcn.00409b10
mov eax, dword [esp + 0x28]
mov dword [esp + 0x14], ebx
cmp eax, ebx
jle 0x41ddcc
mov eax, dword [esp + 0x24]
lea ecx, [ebx + eax + 4]
push ecx
lea ecx, [esp + 0x14]
call fcn.005eb22e
push ecx
lea edx, [esp + 0x14]
mov ecx, esp
mov dword [esp + 0x20], esp
push edx
call fcn.005eae6a
mov ecx, ebp
call fcn.0041deb0
test eax, eax
je 0x41ddb4
push 0xc
call fcn.005eae36
mov esi, eax
add esp, 4
test esi, esi
je 0x41ddb4
mov eax, dword [0x69c108]
lea ecx, [esi + 4]
lea edi, [esi + 8]
mov dword [ecx], eax
mov edx, dword [0x69c108]
lea eax, [esp + 0x10]
mov dword [edi], edx
push eax
mov dword [esi], vtable.CIRTransitionDLLInfo.0
call fcn.005eb22e
push ecx
lea edx, [esp + 0x14]
mov ecx, esp
mov dword [esp + 0x20], esp
push edx
call fcn.005eae6a
lea eax, [esp + 0x1c]
mov ecx, ebp
push eax
call fcn.0041dfc0
push eax
mov ecx, edi
mov byte [esp + 0x4c], 5
call fcn.005eb22e
lea ecx, [esp + 0x18]
mov byte [esp + 0x48], 2
call fcn.005eb0f5
push esi
lea ecx, [ebp + 4]
call fcn.005e9f6c
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x28]
inc eax
add ebx, 0x38
cmp eax, ecx
mov dword [esp + 0x14], eax
jl 0x41dd10
lea ecx, [esp + 0x10]
mov byte [esp + 0x48], 1
call fcn.005eb0f5
mov dword [esp + 0x20], vtable.CArray_class_CFileInfo__class_CFileInfo__.0
mov esi, dword [esp + 0x24]
mov byte [esp + 0x48], 6
test esi, esi
je 0x41de13
mov eax, dword [esp + 0x28]
test eax, eax
je 0x41de0a
lea edi, [eax]
mov ecx, esi
call fcn.00408fa0
add esi, 0x38
dec edi
jne 0x41ddf9
mov esi, dword [esp + 0x24]
push esi
call fcn.005eae5f
add esp, 4
lea ecx, [esp + 0x50]
mov dword [esp + 0x48], 0xffffffff
call fcn.005eb0f5
mov ecx, dword [esp + 0x40]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x3c
ret 4
Function at 0x41ecc0
Capabilities:
Delete directory
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x6055a0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov eax, dword [0x69c108]
push ebx
push ebp
mov ebp, ecx
push esi
push edi
mov dword [esp + 0x24], ebp
mov dword [esp + 0x14], eax
xor edi, edi
mov dword [esp + 0x10], eax
mov dword [esp + 0x30], edi
mov bl, 1
push str.gdi32.dll
mov byte [esp + 0x34], bl
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
cmp esi, edi
mov dword [esp + 0x20], esi
je 0x41ed1e
push str.RemoveFontResourceExA
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
mov ebp, dword [ebp + 8]
test ebp, ebp
je 0x41ede2
mov eax, ebp
mov ebp, dword [ebp]
mov eax, dword [eax + 8]
test eax, eax
je 0x41edd6
lea esi, [eax + 0x24]
mov eax, dword [eax + 0x24]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x41edd6
push str..TFT
lea ecx, [esp + 0x1c]
push esi
push ecx
call fcn.005eb38a
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x34], 2
call fcn.005eb22e
lea ecx, [esp + 0x18]
mov byte [esp + 0x30], bl
call fcn.005eb0f5
push str..FON
lea edx, [esp + 0x20]
push esi
push edx
call fcn.005eb38a
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x34], 3
call fcn.005eb22e
lea ecx, [esp + 0x1c]
mov byte [esp + 0x30], bl
call fcn.005eb0f5
test edi, edi
je 0x41edb3
mov eax, dword [esp + 0x14]
push 0
push 0x10
push eax
call edi
jmp 0x41edbe
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.GDI32.dll_RemoveFontResourceA]
test eax, eax
je 0x41edd6
mov edx, dword [esp + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push edx
call esi
mov eax, dword [esp + 0x14]
push eax
call esi
test ebp, ebp
jne 0x41ed29
mov esi, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
mov eax, dword [ecx + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test esi, esi
je 0x41edfb
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [esp + 0x10]
mov byte [esp + 0x30], 0
call fcn.005eb0f5
lea ecx, [esp + 0x14]
mov dword [esp + 0x30], 0xffffffff
call fcn.005eb0f5
mov ecx, dword [esp + 0x28]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret

Function at 0x41ee30
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x6055bb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10c
mov eax, dword [0x69c108]
push esi
push edi
mov esi, ecx
mov dword [esp + 8], eax
lea ecx, [esp + 0x10]
mov dword [esp + 0x11c], 0
push ecx
push 0x104
mov edi, 1
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea edx, [esp + 0x10]
lea ecx, [esp + 8]
push edx
call fcn.005eb27e
push 0x6713a0
lea ecx, [esp + 0xc]
call fcn.005e76aa
add esi, 0x20
mov eax, dword [esp + 8]
push edi
push eax
push str._s_ir_tmpfnt__d
push esi
call fcn.005e764e
mov eax, dword [esi]
push 0
push eax
call fcn.005ce4b4
add esp, 0x18
test eax, eax
je 0x41eed2
push ecx
mov ecx, esp
mov dword [esp + 0x10], esp
push esi
call fcn.005eae6a
call fcn.0040eb20
add esp, 4
test eax, eax
jne 0x41eed5
inc edi
jmp 0x41ee97
lea ecx, [esp + 8]
mov dword [esp + 0x11c], 0xffffffff
call fcn.005eb0f5
mov ecx, dword [esp + 0x114]
pop edi
mov dword fs:[0], ecx
pop esi
add esp, 0x118
ret
Function at 0x420140
Capabilities:
Terminate process

Disassembly:
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x42018c
mov edx, dword [esi + 4]
lea ecx, [esp + 4]
push ecx
push edx
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov eax, dword [esp + 4]
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
je 0x42018c
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ecx
ret
Function at 0x423400
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x605d7f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
mov dword [esp + 0x24], 0
push 0x6a0f60
lea ecx, [esp + 0xc]
mov dword [esp + 0x34], 1
call fcn.005eb163
mov eax, dword [esp + 0x40]
mov bl, 2
sub eax, 0
mov byte [esp + 0x30], bl
je 0x423588
dec eax
je 0x423515
dec eax
jne 0x4235fa
lea eax, [esp + 0x40]
push 7
push eax
lea ecx, [esp + 0x44]
call fcn.005e722e
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x34], 7
call fcn.005eb22e
lea ecx, [esp + 0x40]
mov byte [esp + 0x30], bl
call fcn.005eb0f5
mov ecx, dword [esp + 8]
push str.http:__
push ecx
call fcn.005ce8ce
add esp, 8
test eax, eax
je 0x4235fa
lea edx, [esp + 0xc]
push 8
push edx
lea ecx, [esp + 0x44]
call fcn.005e722e
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x34], 8
call fcn.005eb22e
lea ecx, [esp + 0xc]
mov byte [esp + 0x30], bl
call fcn.005eb0f5
mov eax, dword [esp + 8]
push str.https:__
push eax
call fcn.005ce8ce
add esp, 8
test eax, eax
je 0x4235fa
lea ecx, [esp + 0x3c]
lea edx, [esp + 0x10]
push ecx
push str.https:__
push edx
call fcn.005eb3fe
push eax
lea ecx, [esp + 0x40]
mov byte [esp + 0x34], 9
call fcn.005eb22e
mov byte [esp + 0x30], bl
lea ecx, [esp + 0x10]
jmp 0x4235f5
lea eax, [esp + 0x14]
push 7
push eax
lea ecx, [esp + 0x44]
call fcn.005e722e
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x34], 5
call fcn.005eb22e
lea ecx, [esp + 0x14]
mov byte [esp + 0x30], bl
call fcn.005eb0f5
mov ecx, dword [esp + 8]
push str.http:__
push ecx
call fcn.005ce8ce
add esp, 8
test eax, eax
je 0x4235fa
lea edx, [esp + 0x3c]
lea eax, [esp + 0x18]
push edx
push str.http:__
push eax
call fcn.005eb3fe
push eax
lea ecx, [esp + 0x40]
mov byte [esp + 0x34], 6
call fcn.005eb22e
mov byte [esp + 0x30], bl
lea ecx, [esp + 0x18]
jmp 0x4235f5
lea ecx, [esp + 0x1c]
push 6
push ecx
lea ecx, [esp + 0x44]
call fcn.005e722e
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x34], 3
call fcn.005eb22e
lea ecx, [esp + 0x1c]
mov byte [esp + 0x30], bl
call fcn.005eb0f5
mov edx, dword [esp + 8]
push str.ftp:__
push edx
call fcn.005ce8ce
add esp, 8
test eax, eax
je 0x4235fa
lea eax, [esp + 0x3c]
lea ecx, [esp + 0x20]
push eax
push str.ftp:__
push ecx
call fcn.005eb3fe
push eax
lea ecx, [esp + 0x40]
mov byte [esp + 0x34], 4
call fcn.005eb22e
mov byte [esp + 0x30], bl
lea ecx, [esp + 0x20]
call fcn.005eb0f5
mov esi, dword [esp + 0x38]
lea edx, [esp + 0x3c]
push edx
mov ecx, esi
call fcn.005eae6a
mov dword [esp + 0x24], 1
lea ecx, [esp + 8]
mov byte [esp + 0x30], 1
call fcn.005eb0f5
lea ecx, [esp + 0x3c]
mov byte [esp + 0x30], 0
call fcn.005eb0f5
mov ecx, dword [esp + 0x28]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x2c
ret 0xc
Function at 0x42c150
Capabilities:
Check os version
Compare security identifiers

Disassembly:
sub esp, 0xac
push ebx
push ebp
push esi
lea eax, [esp + 0x24]
push edi
push eax
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x42c189
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xac
ret
cmp dword [esp + 0x38], 2
je 0x42c1a0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xac
ret
cmp dword [esp + 0x2c], 6
jb 0x42c1af
mov dword [esp + 0x24], 1
lea ecx, [esp + 0x10]
mov byte [esp + 0x14], 0
push ecx
push 1
push 8
mov byte [esp + 0x21], 0
mov byte [esp + 0x22], 0
mov byte [esp + 0x23], 0
mov byte [esp + 0x24], 0
mov byte [esp + 0x25], 5
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x42c226
call ebp
cmp eax, 0x3f0
je 0x42c203
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xac
ret
lea edx, [esp + 0x10]
push edx
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x42c226
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xac
ret
push 0x1000
call fcn.005ce37a
mov ecx, dword [esp + 0x14]
mov ebx, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
add esp, 4
mov esi, eax
lea eax, [esp + 0x1c]
push eax
push 0x1000
push esi
push 2
push ecx
call ebx
mov edi, eax
call ebp
test edi, edi
jne 0x42c284
cmp eax, 0x7a
jne 0x42c284
mov edx, dword [esp + 0x1c]
push edx
push esi
call fcn.005cf98f
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x18]
add esp, 8
mov esi, eax
lea eax, [esp + 0x1c]
push eax
push ecx
push esi
push 2
push edx
call ebx
mov edi, eax
call ebp
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
jne 0x42c2a9
push esi
call fcn.005ce291
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xac
ret
lea ecx, [esp + 0x20]
lea edx, [esp + 0x14]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
push edx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x42c2e8
push esi
call fcn.005ce291
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xac
ret
mov eax, dword [esi]
xor ebx, ebx
xor edi, edi
test eax, eax
jbe 0x42c319
lea ebp, [esi + 4]
mov eax, dword [ebp]
mov ecx, dword [esp + 0x20]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x42c314
mov eax, dword [esi]
inc edi
add ebp, 8
cmp edi, eax
jb 0x42c2f5
jmp 0x42c319
mov ebx, 1
mov edx, dword [esp + 0x20]
push edx
call dword [sym.imp.ADVAPI32.dll_FreeSid]
push esi
call fcn.005ce291
mov eax, dword [esp + 0x28]
add esp, 4
test eax, eax
je 0x42c340
test ebx, ebx
je 0x42c340
call fcn.0042c350
mov ebx, eax
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0xac
ret
Function at 0x42c3c0
Capabilities:
Check os version
Compare security identifiers

Disassembly:
sub esp, 0xac
push ebx
push ebp
push esi
lea eax, [esp + 0x24]
push edi
push eax
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x42c3f9
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xac
ret
cmp dword [esp + 0x38], 2
je 0x42c410
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xac
ret
cmp dword [esp + 0x2c], 6
jb 0x42c41f
mov dword [esp + 0x24], 1
lea ecx, [esp + 0x10]
mov byte [esp + 0x14], 0
push ecx
push 1
push 8
mov byte [esp + 0x21], 0
mov byte [esp + 0x22], 0
mov byte [esp + 0x23], 0
mov byte [esp + 0x24], 0
mov byte [esp + 0x25], 5
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x42c496
call ebp
cmp eax, 0x3f0
je 0x42c473
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xac
ret
lea edx, [esp + 0x10]
push edx
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x42c496
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xac
ret
push 0x1000
call fcn.005ce37a
mov ecx, dword [esp + 0x14]
mov ebx, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
add esp, 4
mov esi, eax
lea eax, [esp + 0x1c]
push eax
push 0x1000
push esi
push 2
push ecx
call ebx
mov edi, eax
call ebp
test edi, edi
jne 0x42c4f4
cmp eax, 0x7a
jne 0x42c4f4
mov edx, dword [esp + 0x1c]
push edx
push esi
call fcn.005cf98f
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x18]
add esp, 8
mov esi, eax
lea eax, [esp + 0x1c]
push eax
push ecx
push esi
push 2
push edx
call ebx
mov edi, eax
call ebp
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
jne 0x42c519
push esi
call fcn.005ce291
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xac
ret
lea ecx, [esp + 0x20]
lea edx, [esp + 0x14]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
push edx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x42c558
push esi
call fcn.005ce291
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xac
ret
mov eax, dword [esi]
xor ebx, ebx
xor edi, edi
test eax, eax
jbe 0x42c589
lea ebp, [esi + 4]
mov eax, dword [ebp]
mov ecx, dword [esp + 0x20]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x42c584
mov eax, dword [esi]
inc edi
add ebp, 8
cmp edi, eax
jb 0x42c565
jmp 0x42c589
mov ebx, 1
mov edx, dword [esp + 0x20]
push edx
call dword [sym.imp.ADVAPI32.dll_FreeSid]
push esi
call fcn.005ce291
mov eax, dword [esp + 0x28]
add esp, 4
test eax, eax
je 0x42c5b0
test ebx, ebx
je 0x42c5b0
call fcn.0042c5c0
mov ebx, eax
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0xac
ret
Function at 0x42c630
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag
Check os version
Get ntdll base address
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x6064a8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov ecx, 0x11
mov eax, 0xa
push edi
mov dword [esp + 0xc], esi
mov dword [esi + 4], vtable.CMap_class_CString__char_const___class_CISImageEx___class_CISImageEx__.0
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ecx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], eax
mov dword [esp + 0x20], ebx
mov dword [esi + 0x20], vtable.CMap_class_CString__char_const___class_CRect__class_CRect__.0
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ecx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], eax
push eax
lea ecx, [esi + 0x40]
mov byte [esp + 0x24], 1
mov byte [esi + 0x3c], bl
call fcn.005e95b1
lea edi, [esi + 0x70]
push 0xa
mov ecx, edi
mov byte [esp + 0x24], 2
mov dword [esi + 0x5c], 0xffffffff
mov byte [esi + 0x60], bl
mov byte [esi + 0x61], bl
mov byte [esi + 0x62], bl
mov dword [esi + 0x64], ebx
mov byte [esi + 0x68], 1
mov dword [esi + 0x6c], ebx
call fcn.005e95b1
lea ecx, [esi + 0x8c]
mov byte [esp + 0x20], 3
call fcn.005ea013
mov byte [esi + 0xa0], bl
mov byte [esi + 0xa1], bl
mov byte [esi + 0xa2], bl
mov dword [esi + 0xa4], ebx
mov dword [esi + 0xa8], ebx
mov dword [esi + 0xac], ebx
mov dword [esi + 0xb0], ebx
mov dword [esi + 0xb4], ebx
mov dword [esi + 0xb8], ebx
mov dword [esi + 0xbc], ebx
mov dword [esi + 0xc0], ebx
lea ecx, [esi + 0xd4]
mov byte [esp + 0x20], 4
mov dword [esi + 0xc4], ebx
mov dword [esi + 0xc8], 0xffffffff
mov dword [esi + 0xcc], ebx
mov dword [esi + 0xd0], 0xbb8
call fcn.0042ef50
push str..bmp
mov ecx, edi
mov byte [esp + 0x24], 5
mov byte [esi + 0x14c], bl
mov byte [esi + 0x14d], bl
mov byte [esi + 0x14e], bl
mov dword [esi + 0x150], 0x64
mov dword [esi + 0x154], 0x100
mov dword [esi + 0x158], 1
mov dword [esi + 0x15c], 0xff
mov dword [esi + 0x160], ebx
mov dword [esi + 0x164], ebx
mov dword [esi], vtable.CIRSlideShowCtrl.0
call fcn.005e975a
push str..jpg
mov ecx, edi
call fcn.005e975a
push str..pcx
mov ecx, edi
call fcn.005e975a
push str..png
mov ecx, edi
call fcn.005e975a
push str..tga
mov ecx, edi
call fcn.005e975a
push str..tif
mov ecx, edi
call fcn.005e975a
push str..wmf
mov ecx, edi
call fcn.005e975a
push str..apm
mov ecx, edi
call fcn.005e975a
push str..emf
mov ecx, edi
call fcn.005e975a
push str..psd
mov ecx, edi
call fcn.005e975a
push str..pcd
mov ecx, edi
call fcn.005e975a
push str..gif
mov ecx, edi
call fcn.005e975a
lea eax, [esp + 0x10]
push 8
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
mov eax, dword [esp + 0x10]
cmp eax, 0xa
mov ecx, eax
ja 0x42c84f
mov ecx, 0xa
mov edx, dword [esp + 0x14]
cmp ecx, edx
jae 0x42c863
cmp eax, 0xa
ja 0x42c865
mov eax, 0xa
jmp 0x42c865
mov eax, edx
mov ecx, esi
mov dword [esi + 0x150], eax
call fcn.0042d480
mov ecx, dword [esp + 0x18]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x42f4e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6067ef
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push 0x6a0f60
lea ecx, [esp + 8]
mov dword [esp + 0xc], 0
call fcn.005eb163
mov ecx, dword [esp + 0x20]
push 0
lea eax, [esp + 4]
push 0
push eax
push 0x400
push ecx
push 0
push 0x1100
mov dword [esp + 0x30], 1
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
mov eax, dword [esp]
test eax, eax
je 0x42f55b
push eax
lea ecx, [esp + 8]
call fcn.005eb27e
mov edx, dword [esp]
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
push esi
mov esi, dword [esp + 0x20]
lea eax, [esp + 8]
mov ecx, esi
push eax
call fcn.005eae6a
mov dword [esp + 0xc], 1
lea ecx, [esp + 8]
mov byte [esp + 0x18], 0
call fcn.005eb0f5
mov ecx, dword [esp + 0x10]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x18
ret

Function at 0x42f5f0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x60681e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
mov eax, dword [0x69c108]
lea ebx, [esi + 0xc]
xor edi, edi
mov dword [esp + 0x18], edi
mov dword [ebx], eax
lea ecx, [esi + 0x44]
mov byte [esp + 0x18], 1
call fcn.005ea38f
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov dword [esi + 0x3c], ecx
push 0x6a0f60
mov ecx, ebx
mov byte [esp + 0x1c], 2
mov dword [esi], vtable.CThread.0
mov dword [esi + 0x40], edx
mov dword [esi + 0x20], edi
mov dword [esi + 0x30], edi
mov dword [esi + 8], edi
mov dword [esi + 4], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x34], 0xfffffffe
call fcn.005eb27e
mov ecx, esi
call fcn.0042f770
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x4308a0
Capabilities:
Terminate thread

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x60699a
push eax
mov eax, dword [0x6a0f7c]
mov dword fs:[0], esp
push ebx
push ebp
push esi
push edi
test eax, eax
mov esi, ecx
je 0x4308cb
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, esi
call fcn.00430370
test eax, eax
jne 0x4308fd
mov eax, dword [esi + 0x24]
test eax, eax
jne 0x4308fd
mov eax, dword [esp + 0x20]
mov ecx, esi
mov dword [esi + 0x34], eax
call fcn.0042f770
mov eax, dword [0x6a0f7c]
test eax, eax
je 0x4309da
jmp 0x4309d3
mov eax, dword [esi + 0x24]
mov ebp, dword [esp + 0x20]
xor ebx, ebx
mov edi, 1
test eax, eax
je 0x430925
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov edi, eax
test edi, edi
jne 0x430925
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov ecx, esi
call fcn.0042fec0
mov eax, dword [esp + 0x24]
test edi, edi
jne 0x4309a0
test eax, eax
jne 0x4309a4
push 0x14
call fcn.005eae36
mov edi, eax
add esp, 4
mov dword [esp + 0x20], edi
test edi, edi
mov dword [esp + 0x18], 0
je 0x430973
push 3
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push ebx
push ecx
call fcn.0042f4e0
add esp, 8
mov ecx, edi
push esi
call fcn.0042f3e0
mov esi, eax
jmp 0x430975
xor esi, esi
mov eax, dword [0x6a0f7c]
mov dword [esp + 0x18], 0xffffffff
test eax, eax
je 0x43098d
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea edx, [esp + 0x20]
push 0x653da0
push edx
mov dword [esp + 0x28], esi
call fcn.005d06b1
test eax, eax
je 0x4309a7
mov dword [esi + 0x34], ebp
mov eax, dword [esi + 0x24]
test eax, eax
je 0x4309b5
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, esi
call fcn.0042fc70
mov ecx, esi
call fcn.0042f770
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x10]
mov eax, dword [0x6a0f7c]
test eax, eax
je 0x4309da
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [esp + 0x10]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret 8

Function at 0x432b90
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x124
lea eax, [esp + 0x10]
mov dword [esp], 3
push eax
mov dword [esp + 0x14], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x432be0
cmp dword [esp + 0x20], 1
jne 0x432bc4
mov eax, dword [esp + 0x18]
test eax, eax
je 0x432be0
lea ecx, [esp]
push 0
push ecx
push 0
push 0x68
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
mov eax, dword [esp]
add esp, 0x124
ret
lea edx, [esp + 4]
push edx
push 1
push 0
push str.Control_PanelDesktop
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x432c4f
lea eax, [esp + 8]
lea ecx, [esp + 0xa4]
push eax
mov eax, dword [esp + 8]
lea edx, [esp + 0x10]
push ecx
push edx
push 0
push str.WheelScrollLines
push eax
mov dword [esp + 0x20], 0x80
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x432c44
push 0xa
lea ecx, [esp + 0xa8]
push eax
push ecx
call fcn.005cf951
add esp, 0xc
mov dword [esp], eax
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp]
add esp, 0x124
ret