joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41a86a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x41a8ac
call fcn.00420cdc
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x41a8ac
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x41a8a3
xor eax, eax
jmp 0x41a8b4
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0041a8ba
pop edi
pop esi
pop ebx
ret 4

Function at 0x421e14
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x421ec4
mov ecx, 0x433998
call fcn.004219ff
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov esi, eax
cmp word [esi + 8], 0
jne 0x421ea2
push str.COMCTL32.DLL
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
mov dword [ebp + 0xc], eax
je 0x421e80
mov ecx, dword [ebp + 0x10]
push 5
neg ecx
sbb ecx, ecx
and ecx, 0xe
add ecx, 0x3ee
movzx ecx, cx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x421e80
push ebx
push edi
push eax
call fcn.0041d27e
add esp, 0xc
mov eax, dword [edi]
mov eax, dword [eax - 8]
inc eax
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [esi + 4], eax
push dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ax, word [ebx]
mov word [esi + 8], ax
push dword [esi + 4]
mov ecx, edi
call fcn.0041bab2
mov si, word [esi + 8]
xor eax, eax
mov word [ebx], si
cmp si, 0xffff
pop edi
pop esi
setne al
pop ebx
pop ebp
ret 0xc
Function at 0x10018fb3
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x10018ff2
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10018ff2
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10018ff2
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x10018ff2
cmp dword [ecx + 0x74], 0xe
jbe 0x10018ff2
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x1001bc6f
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1001bd0c
push ebx
push esi
call fcn.1001bc38
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1001bbcc
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1001bcb9
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1001bd0b
push edi
push eax
call fcn.1001cc2c
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1001bcd9
call fcn.1001a714
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1001bd0a
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1001bbcc
add esp, 0x20
test eax, eax
jne 0x1001bcf8
push edi
call fcn.1001a714
jmp 0x1001bd00
push ebx
call fcn.1001a714
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x1001bf79
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10023cc8
push 0x10023cc0
push str.FlsAlloc
push 0x1f
call fcn.1001be95
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001bfad
push dword [ebp + 8]
mov ecx, esi
call dword [0x10022150]
call esi
jmp 0x1001bfb3
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1001bff9
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10023cd8
push 0x10023cd0
push str.FlsGetValue
push 0x21
call fcn.1001be95
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001c030
push dword [ebp + 8]
mov ecx, esi
call dword [0x10022150]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1001c038
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10023ce0
push 0x10023cd8
push str.FlsSetValue
push 0x22
call fcn.1001be95
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001c072
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x10022150]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x10021700
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1002172d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1002172d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x403387
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
call sub.msvcrt.dll_wcslen
pop ecx
add eax, eax
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
leave
ret

Function at 0x403566
Capabilities:
Get file size
Read file on windows
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 4], 0
call dword [sym.imp.USER32.dll_EmptyClipboard]
push dword [ebp + 8]
call fcn.00403355
cmp eax, 0xffffffff
pop ecx
mov dword [ebp - 8], eax
je 0x4035f8
push ebx
push esi
push edi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
lea eax, [esi + 2]
push eax
push 0x2000
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
je 0x4035e1
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push 0
mov edi, eax
lea eax, [ebp - 0xc]
push eax
push esi
push edi
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4035e1
shr esi, 1
and word [edi + esi*2], 0
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebx
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
jmp 0x4035ea
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
jmp 0x403601
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, dword [ebp - 4]
leave
ret

Function at 0x4036c2
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
ret

Function at 0x403877
Capabilities:
Get common file path

Disassembly:
cmp word [0x4112b8], 0
push esi
mov esi, 0x4112b8
jne 0x403898
push 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov dword [0x4114c4], eax
push esi
push dword [esp + 0xc]
call sub.msvcrt.dll_wcscpy
mov eax, dword [0x4114c4]
pop ecx
pop ecx
pop esi
ret

Function at 0x403bfd
Capabilities:
Create process on windows

Disassembly:
push 5
mov eax, 0x40d43c
push eax
push eax
push dword [esp + 0x14]
push 0x40d7d8
push dword [esp + 0x18]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0x20
pop ecx
cmp ecx, eax
sbb eax, eax
neg eax
ret

Function at 0x404b63
Capabilities:
Read .ini file

Disassembly:
and word [esi], 0
push 0x410c08
push dword [esp + 0xc]
push esi
push 0x40d43c
push dword [esp + 0x14]
push 0x410e18
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov eax, esi
ret
Function at 0x404b88
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2004
call fcn.0040c5c0
and word [ebp - 0x2004], 0
push 0x2000
lea eax, [ebp - 0x2002]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x410c08
push 0x1000
lea eax, [ebp - 0x2004]
push eax
push 0x40d43c
push dword [ebp + 8]
push 0x410e18
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [ebp - 0x2004], 0
je 0x404bf7
lea eax, [ebp - 0x2004]
push eax
push dword [ebp + 0xc]
call sub.msvcrt.dll_wcscpy
pop ecx
xor eax, eax
pop ecx
inc eax
leave
ret
xor eax, eax
leave
ret

Function at 0x404bfb
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2004
call fcn.0040c5c0
and word [ebp - 0x2004], 0
push esi
push edi
push 0x2000
lea eax, [ebp - 0x2002]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov edi, 0x410c08
push edi
push 0x1000
lea eax, [ebp - 0x2004]
push eax
push 0x40d43c
push dword [ebp + 8]
mov esi, 0x410e18
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [ebp - 0x2004], 0
je 0x404c62
cmp dword [ebp + 0x10], 0
jne 0x404c62
xor eax, eax
jmp 0x404c70
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
pop edi
pop esi
leave
ret

Function at 0x404fe7
Capabilities:
Read .ini file

Disassembly:
push dword [esp + 4]
call fcn.004036c2
test eax, eax
pop ecx
je 0x40506e
push esi
push edi
push dword [esp + 0xc]
mov edi, 0x410c08
push edi
call sub.msvcrt.dll_wcscpy
push str.general
mov esi, 0x410e18
push esi
call sub.msvcrt.dll_wcscpy
add esp, 0x10
push edi
push 0
push 0x40d8b4
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
dec eax
neg eax
sbb eax, eax
inc eax
push 0x3f
push str.charset
mov esi, 0x410ea8
mov dword [0x410ea0], eax
call fcn.00404b63
push 0x3f
push str.TranslatorName
mov esi, 0x410f28
call fcn.00404b63
push 0xff
push str.TranslatorURL
mov esi, 0x410fa8
call fcn.00404b63
add esp, 0x18
pop edi
pop esi
ret

Function at 0x405f25
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b4
and dword [ebp - 0x2b4], 0
push 0x2b0
lea eax, [ebp - 0x2b0]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x111
push 0x2b4
lea eax, [ebp - 0x2b4]
push eax
push 0
push dword [ebp + 8]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
cmp dword [ebp - 0x2b4], 0
je 0x405f7c
push dword [ebp - 0x2b4]
call dword [sym.imp.USER32.dll_DestroyIcon]
mov eax, dword [ebp - 0x2b0]
leave
ret 4
Function at 0x40602c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov esi, eax
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x10], eax
mov eax, edi
call fcn.004055aa
and dword [ebp - 4], 0
test eax, eax
mov dword [ebp - 8], eax
jle 0x4060b9
cmp dword [ebp + 8], 0
je 0x406077
mov eax, dword [ebp - 4]
push 0x64
cdq
pop ecx
idiv ecx
test edx, edx
jne 0x406077
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x10]
cmp eax, 0x1f4
ja 0x4060b9
mov ebx, dword [esi + 0xc]
add ebx, dword [ebp - 4]
cmp ebx, dword [ebp - 8]
jl 0x40608b
test byte [esi + 0x10], 0x20
je 0x4060b9
sub ebx, dword [ebp - 8]
and dword [ebp - 0xc], 0
lea eax, [ebp - 0xc]
push eax
push edi
mov eax, ebx
call fcn.00405d4b
test eax, eax
je 0x4060ae
push dword [ebp + 8]
push dword [ebp - 0xc]
call fcn.00405f9d
test eax, eax
jne 0x4060c3
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
jl 0x406054
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret 4
mov eax, ebx
jmp 0x4060bc

Function at 0x406602
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x8004
call fcn.0040c5c0
push ebx
push esi
mov esi, 0x7fff
xor ebx, ebx
push esi
lea eax, [ebp - 0x8003]
push ebx
push eax
mov byte [ebp - 0x8004], bl
call sub.msvcrt.dll_memset
add esp, 0xc
push ebx
push ebx
push esi
lea eax, [ebp - 0x8004]
push eax
push 0xffffffffffffffff
push dword [ebp + 0xc]
push ebx
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebx
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x8004]
push eax
call sub.msvcrt.dll_strlen
pop ecx
push eax
lea eax, [ebp - 0x8004]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
pop ebx
leave
ret

Function at 0x406671
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2004
call fcn.0040c5c0
push ebx
push esi
mov esi, 0x1fff
xor ebx, ebx
push esi
lea eax, [ebp - 0x2003]
push ebx
push eax
mov byte [ebp - 0x2004], bl
call sub.msvcrt.dll_memset
add esp, 0xc
push ebx
push ebx
push esi
lea eax, [ebp - 0x2004]
push eax
push 0xffffffffffffffff
push dword [ebp + 0xc]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebx
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x2004]
push eax
call sub.msvcrt.dll_strlen
pop ecx
push eax
lea eax, [ebp - 0x2004]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
pop ebx
leave
ret
Function at 0x40784c
Capabilities:
Get common file path
Get file system object information

Disassembly:
sub esp, 0x4cc
push ebx
push ebp
mov ebp, dword [sym.imp.COMCTL32.dll_ImageList_Create]
push esi
mov esi, eax
xor ebx, ebx
cmp dword [esi + 0x2c0], ebx
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
je 0x407913
cmp dword [esi + 0x2c8], ebx
je 0x4078e3
push 0x2b0
lea eax, [esp + 0x230]
push ebx
push eax
mov dword [esp + 0x234], ebx
call sub.msvcrt.dll_memset
push 0x208
lea eax, [esp + 0x2e]
push ebx
push eax
mov word [esp + 0x34], bx
call sub.msvcrt.dll_memset
add esp, 0x18
push 0x104
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push 0x4001
push 0x2b4
lea eax, [esp + 0x230]
push eax
push ebx
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov dword [esi + 0x2b4], eax
push eax
jmp 0x407904
push 1
push 1
push 0x19
push 0x10
push 0x10
call ebp
push 1
push eax
mov dword [esi + 0x2b4], eax
call dword [sym.imp.COMCTL32.dll_ImageList_SetImageCount]
push dword [esi + 0x2b4]
push 1
push 0x1003
push dword [esi + 0x2ac]
call edi
cmp dword [esi + 0x2c4], ebx
je 0x40794a
push 1
push 1
push 0x19
push 0x20
push 0x20
call ebp
push 1
push eax
mov dword [esi + 0x2b8], eax
call dword [sym.imp.COMCTL32.dll_ImageList_SetImageCount]
push dword [esi + 0x2b8]
push ebx
push 0x1003
push dword [esi + 0x2ac]
call edi
push 1
push 1
push 0x19
push 0x10
push 0x10
call ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push ebx
mov dword [esi + 0x2b0], eax
call ebp
push 0x1000
push 0x10
push 0x10
push ebx
push 0x85
push eax
call dword [sym.imp.USER32.dll_LoadImageW]
push ebx
mov dword [esp + 0x14], eax
call ebp
push 0x1000
push 0x10
push 0x10
push ebx
push 0x86
push eax
call dword [sym.imp.USER32.dll_LoadImageW]
push ebx
push dword [esi + 0x2b0]
mov dword [esp + 0x1c], eax
call dword [sym.imp.COMCTL32.dll_ImageList_SetImageCount]
push 0xf
call dword [sym.imp.USER32.dll_GetSysColor]
mov ebp, dword [sym.imp.COMCTL32.dll_ImageList_AddMasked]
push eax
push dword [esp + 0x14]
mov dword [esp + 0x20], eax
push dword [esi + 0x2b0]
call ebp
push dword [esp + 0x18]
push dword [esp + 0x18]
push dword [esi + 0x2b0]
call ebp
push dword [esp + 0x10]
mov ebp, dword [sym.imp.GDI32.dll_DeleteObject]
call ebp
push dword [esp + 0x14]
call ebp
mov eax, dword [esi + 0x2b0]
mov esi, dword [esi + 0x2ac]
push eax
push ebx
push 0x1208
push esi
call fcn.0040275a
pop ecx
push eax
call edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4cc
ret
Function at 0x408dab
Capabilities:
Delete file
Get common file path
Open clipboard

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
push esi
push edi
mov esi, eax
lea eax, [ebp - 0x410]
push eax
mov edi, 0x104
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x408ddd
push edi
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
and word [ebp - 0x208], 0
lea eax, [ebp - 0x208]
push eax
push 0
push 0x40e140
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov eax, dword [esi + 0x69c]
push 1
push 1
push 2
lea ecx, [ebp - 0x208]
push ecx
push eax
call fcn.00408c8d
test eax, eax
je 0x408e61
push dword [esi + 0x208]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x408e3c
lea eax, [ebp - 0x208]
push eax
call fcn.00403566
pop ecx
jmp 0x408e42
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x408e54
push dword [esi + 0x208]
mov ecx, eax
call fcn.004033ce
pop ecx
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop edi
pop esi
leave
ret

Function at 0x408f56
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x250
push 1
mov eax, edi
call fcn.004090a2
and word [ebp - 0x250], 0
push 0x208
lea eax, [ebp - 0x24e]
push 0
push eax
call sub.msvcrt.dll_memset
lea eax, [ebp - 0x250]
add esp, 0xc
push eax
call fcn.004036f1
pop ecx
push 0x38
lea eax, [ebp - 0x38]
push 0
push eax
call sub.msvcrt.dll_memset
and dword [ebp - 0x28], 0
lea eax, [ebp - 0x250]
mov dword [ebp - 0x2c], eax
add esp, 0xc
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x30], str.RunAs
mov dword [ebp - 0x38], 0x40
mov dword [ebp - 0x20], 5
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x408fe6
push dword [edi + 0x208]
call dword [sym.imp.USER32.dll_DestroyWindow]
leave
ret
Function at 0x4090a2
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x630
push ebx
push esi
push edi
mov edi, eax
xor ebx, ebx
cmp dword [edi + 0x27c], ebx
jne 0x4091ac
push 0x208
lea eax, [ebp - 0x20e]
push ebx
push eax
mov word [ebp - 0x210], bx
call sub.msvcrt.dll_memset
lea eax, [ebp - 0x210]
add esp, 0xc
push eax
call fcn.004036f1
pop ecx
lea eax, [ebp - 0x210]
push 0x2e
push eax
call sub.msvcrt.dll_wcsrchr
cmp eax, ebx
pop ecx
pop ecx
je 0x4090fe
mov word [eax], bx
lea eax, [ebp - 0x210]
push str..cfg
push eax
call sub.msvcrt.dll_wcscat
mov esi, dword [edi + 0x6cc]
pop ecx
pop ecx
push str._cfg
call fcn.00404453
cmp eax, ebx
jl 0x409146
push 0x104
lea ecx, [ebp - 0x210]
push ecx
lea ecx, [eax + 1]
mov eax, dword [edi + 0x6cc]
call fcn.00404443
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x62c], eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x628]
push eax
mov dword [ebp - 0x630], 0x40e730
mov word [ebp - 0x628], bx
mov word [ebp - 0x41e], bx
call sub.msvcrt.dll_wcscpy
pop ecx
pop ecx
lea eax, [ebp - 0x630]
call fcn.0040bae5
mov eax, dword [edi + 0x698]
lea esi, [ebp - 0x630]
call fcn.004019a1
mov eax, edi
call fcn.004016e1
mov edi, dword [edi + 0x69c]
mov ebx, esi
call fcn.00405615
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x40a081
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x724
push ebx
push esi
push edi
call fcn.00402528
test eax, eax
jne 0x40a09f
inc eax
jmp 0x40a2ad
call fcn.0040bc79
xor ebx, ebx
lea eax, [esp + 0xc]
mov dword [esp + 0xc], ebx
call fcn.0040a743
push 0x8001
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push ebx
push 0x40bc5e
push ebx
mov dword [0x410ae0], 0x11223344
call edi
push eax
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
lea eax, [esp + 0x60]
mov dword [esp + 0x24], 0x400
mov dword [esp + 0x28], 0x100
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x38], 0x20
mov dword [esp + 0x30], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x40], ebx
call fcn.00409d87
push dword [ebp + 0x10]
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x734], eax
call fcn.004042d6
mov esi, dword [esp + 0x72c]
push str._savelangfile
call fcn.00404453
test eax, eax
jl 0x40a164
mov dword [0x410ea4], 0x41033c
call fcn.0040520d
jmp 0x40a277
call fcn.0040506f
mov esi, dword [esp + 0x72c]
push str._deleteregkey
call fcn.00404453
test eax, eax
jge 0x40a277
mov eax, dword [esp + 0x72c]
cmp dword [eax + 0x30], 1
jle 0x40a1a0
lea eax, [esp + 0x60]
call fcn.00409f3a
test eax, eax
jne 0x40a277
lea esi, [esp + 0x60]
call fcn.00409d06
cmp dword [esp + 0x2b0], 3
jne 0x40a1b7
push 3
jmp 0x40a1b9
push 5
push dword [esp + 0x26c]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esp + 0x268]
call dword [sym.imp.USER32.dll_UpdateWindow]
push ebx
call edi
push 0x67
push eax
call dword [sym.imp.USER32.dll_LoadAcceleratorsW]
mov edi, dword [sym.imp.USER32.dll_GetMessageW]
mov dword [esp + 0x280], eax
jmp 0x40a265
mov eax, dword [0x410aec]
cmp eax, ebx
mov esi, eax
je 0x40a203
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp esi, eax
je 0x40a220
lea eax, [esp + 0x44]
push eax
push dword [esp + 0x284]
push dword [esp + 0x270]
call dword [sym.imp.USER32.dll_TranslateAcceleratorW]
cmp eax, ebx
jne 0x40a265
mov eax, dword [0x410aec]
cmp eax, ebx
je 0x40a239
lea ecx, [esp + 0x44]
push ecx
push eax
call dword [sym.imp.USER32.dll_IsDialogMessageW]
test eax, eax
jne 0x40a265
lea eax, [esp + 0x44]
push eax
push dword [esp + 0x26c]
call dword [sym.imp.USER32.dll_IsDialogMessageW]
test eax, eax
jne 0x40a265
lea eax, [esp + 0x44]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0x44]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push ebx
push ebx
push ebx
lea eax, [esp + 0x50]
push eax
call edi
test eax, eax
jne 0x40a1ee
lea edi, [esp + 0x60]
call fcn.00409e77
lea esi, [esp + 0x10]
call fcn.004040e7
lea esi, [esp + 0x30]
call fcn.00404582
lea esi, [esp + 0x10]
call fcn.004040e7
cmp dword [esp + 0xc], ebx
je 0x40a2ab
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40a743
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 8], eax
call fcn.0040a723
test eax, eax
je 0x40a784
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x40e56c
push dword [esi]
call edi
xor ebx, ebx
cmp eax, ebx
je 0x40a784
lea ecx, [ebp - 4]
push ecx
push 0x28
push dword [ebp - 8]
call eax
cmp eax, ebx
jne 0x40a78c
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40a7f8
call fcn.0040a723
test eax, eax
je 0x40a7ae
push str.LookupPrivilegeValueW
push dword [esi]
call edi
cmp eax, ebx
je 0x40a7ae
lea ecx, [ebp - 0x14]
push ecx
push str.SeDebugPrivilege
push ebx
call eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], 1
mov dword [ebp - 0xc], 2
mov dword [ebp - 8], eax
call fcn.0040a723
test eax, eax
je 0x40a7e5
push str.AdjustTokenPrivileges
push dword [esi]
call edi
cmp eax, ebx
je 0x40a7e5
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x18]
push ecx
push ebx
push dword [ebp - 8]
call eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret