joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42b635
Capabilities:
Check if file exists
Create process on windows

Disassembly:
mov eax, 0x4cc094
call fcn.0049c8c4
push ecx
push ecx
push ebx
push esi
mov esi, ecx
push edi
push 0x56f1b4
lea ecx, [ebp - 0x10]
call fcn.004b925f
xor edi, edi
xor ebx, ebx
cmp dword [esi + 0x14], edi
mov dword [ebp - 4], edi
jle 0x42b6c9
cmp ebx, edi
jl 0x42b663
cmp ebx, dword [esi + 0x14]
jge 0x42b663
mov eax, dword [esi + 0x10]
mov eax, dword [eax + ebx*4]
jmp 0x42b665
xor eax, eax
cmp dword [eax + 0x800], 0x64
jne 0x42b6c3
cmp dword [eax + 0x808], 0x64
jne 0x42b6c3
push dword [eax + 0x530]
lea edi, [eax + 0x530]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x42b6c1
test ebx, ebx
jle 0x42b69e
push 0x4f4984
lea ecx, [ebp - 0x10]
call fcn.004b95dc
push 0x4f4980
lea ecx, [ebp - 0x10]
call fcn.004b95dc
push edi
lea ecx, [ebp - 0x10]
call fcn.004b9618
push 0x4f4980
lea ecx, [ebp - 0x10]
call fcn.004b95dc
xor edi, edi
inc ebx
cmp ebx, dword [esi + 0x14]
jl 0x42b652
mov eax, dword [ebp - 0x10]
cmp dword [eax - 8], edi
je 0x42b70c
lea eax, [ebp - 0x14]
push eax
call fcn.00402057
pop ecx
push dword [ebp - 0x14]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
push 1
push edi
je 0x42b6f4
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push edi
jmp 0x42b6fd
push edi
push dword [ebp - 0x10]
push str.open
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x14]
call fcn.004b91eb
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.004b91eb
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x432280
Capabilities:
Check if file exists
Set current directory

Disassembly:
mov eax, 0x4ccea0
call fcn.0049c8c4
sub esp, 0x1c
push ebx
push esi
push edi
mov esi, ecx
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4322be
push dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.004174d9
pop ecx
pop ecx
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea ecx, [ebp - 0x10]
call fcn.004b91eb
lea eax, [ebp - 0x14]
push eax
call fcn.0041a7a3
pop ecx
mov eax, dword [eax]
and dword [ebp - 4], 0
push 1
push 1
push eax
lea ecx, [ebp - 0x28]
call fcn.00417147
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.004b91eb
push dword [ebp + 8]
lea edi, [esi + 0x10]
mov ecx, edi
call fcn.004b9382
push dword [ebp + 0x10]
mov eax, esi
neg eax
push dword [ebp - 0x24]
lea ecx, [esi + 8]
sbb eax, eax
and eax, ecx
mov ecx, esi
push eax
call fcn.0043205f
test eax, eax
je 0x432315
mov esi, eax
jmp 0x43234a
push dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
mov eax, dword [esi]
mov ecx, esi
push ebx
push dword [ebp - 0x24]
call dword [eax + 0x20]
test eax, eax
je 0x43232f
or esi, 0xffffffff
jmp 0x43234a
mov edi, dword [edi]
mov eax, dword [esi]
push edi
push ebx
mov ecx, esi
call dword [eax + 0x24]
or esi, 0xffffffff
cmp eax, esi
je 0x43234a
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0xc]
xor esi, esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.004171b4
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0xc

Function at 0x451877
Capabilities:
Get process heap flags
Get process heap force flags

Disassembly:
mov eax, 0x4cf372
call fcn.0049c8c4
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.00451023
mov eax, dword [0x56a9b8]
lea ecx, [esi + 0x14]
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ecx], eax
mov eax, dword [0x56a9b8]
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], 0x4d84e8
mov dword [esi + 0x20], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x24], ebx
mov eax, dword [0x56a9b8]
mov dword [esi + 0x3c], eax
mov eax, dword [0x56a9b8]
mov dword [esi + 0x40], eax
mov eax, dword [0x56a9b8]
mov dword [esi + 0x44], eax
mov edi, 0x56f1b4
mov byte [ebp - 4], 6
push edi
mov dword [esi], 0x4d84dc
call fcn.004b9382
push edi
lea ecx, [esi + 0x18]
call fcn.004b9382
push edi
lea ecx, [esi + 0x3c]
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
call fcn.004b9382
push edi
lea ecx, [esi + 0x40]
call fcn.004b9382
push edi
lea ecx, [esi + 0x44]
call fcn.004b9382
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x45a347
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x4cfaf7
call fcn.0049c8c4
sub esp, 0xe4
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
push esi
push edi
je 0x45a4a5
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x45a4a5
lea ecx, [ebp - 0xf0]
call fcn.004213e1
push ebx
push 0x74
push dword [ebp + 8]
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0xf0]
mov dword [ebp - 4], ebx
push eax
call fcn.0042154a
mov ecx, eax
call fcn.004213d9
test al, al
jne 0x45a3ac
or esi, 0xffffffff
jmp 0x45a477
lea eax, [ebp - 0x10]
push str.MediaFormats
push eax
lea ecx, [ebp - 0xf0]
call fcn.00421015
lea ecx, [ebp - 0x10]
call fcn.004213d9
test al, al
jne 0x45a3a4
push 0x56f1b4
lea eax, [ebp - 0x1c]
push str.Version
push eax
lea ecx, [ebp - 0x10]
call fcn.0042105c
mov ecx, eax
call fcn.00420eb5
push eax
lea ecx, [ebp - 0x14]
call fcn.004b925f
mov esi, dword [ebp + 0xc]
mov byte [ebp - 4], 1
push dword [esi + 4]
push dword [ebp - 0x14]
call fcn.0049d255
pop ecx
test eax, eax
pop ecx
je 0x45a40f
push 1
pop esi
jmp 0x45a46b
lea eax, [ebp - 0x18]
push str.Categories
push eax
lea ecx, [ebp - 0x10]
call fcn.00421015
lea ecx, [ebp - 0x18]
call fcn.004213d9
test al, al
je 0x45a431
or esi, 0xffffffff
jmp 0x45a46b
cmp dword [esi + 0x10], ebx
jle 0x45a469
mov eax, dword [esi + 0xc]
lea ecx, [ebp - 0x18]
mov edi, dword [eax + ebx*4]
lea eax, [ebp + 8]
push dword [edi + 8]
push eax
call fcn.00421015
lea ecx, [ebp + 8]
call fcn.004213d9
test al, al
jne 0x45a48a
lea eax, [ebp + 8]
push eax
push edi
call fcn.0045a4b9
inc ebx
pop ecx
cmp ebx, dword [esi + 0x10]
pop ecx
jl 0x45a436
xor esi, esi
and byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.004b91eb
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf0]
call fcn.004213f8
mov eax, esi
jmp 0x45a4a8
and byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.004b91eb
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf0]
call fcn.004213f8
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8
Function at 0x4b4410
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
push 0xf00021
mov edx, dword [esi + 4]
mov ecx, dword [esi]
mov eax, dword [esi + 0xc]
sub eax, edx
push eax
mov eax, dword [esi + 8]
sub eax, ecx
push eax
push edx
push ecx
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.GDI32.dll_PatBlt]
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov ebx, eax
lea eax, [eax + 5]
add eax, 3
and eax, 0xfffffffc
call fcn.0049db50
mov dword [ebp - 4], esp
cmp dword [ebp - 4], 0
je 0x4b44db
add ebx, 2
mov eax, dword [ebp - 4]
push ebx
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
je 0x4b44db
mov bx, 0x140
mov edi, dword [ebp + 0x14]
mov eax, edi
and al, 0xf
cmp al, 0xc
je 0x4b448e
mov ebx, edi
and bx, 0xf
or bx, 0x150
test edi, 0x80
je 0x4b4499
or bh, 8
and edi, 0x8000000
je 0x4b44b4
mov eax, dword [0x57303c]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
movzx eax, bx
push eax
push esi
push 0xffffffffffffffff
push ecx
push edx
call dword [sym.imp.USER32.dll_DrawTextA]
test edi, edi
je 0x4b44db
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4ba6ba
Capabilities:
Get graphical window text

Disassembly:
push esi
push edi
mov edi, dword [esp + 0x10]
mov esi, ecx
push 0x56f4e0
mov ecx, edi
call fcn.004b9382
cmp dword [esi + 0x34], 0
push dword [esp + 0xc]
jne 0x4ba70d
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, eax
test esi, esi
je 0x4ba720
push esi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [eax + 1]
push ecx
push eax
mov ecx, edi
call fcn.004b96a9
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0xffffffffffffffff
mov ecx, edi
call fcn.004b9680
jmp 0x4ba720
mov ecx, esi
call fcn.004bc663
test eax, eax
je 0x4ba720
push edi
mov ecx, eax
call fcn.004ba672
mov eax, dword [edi]
pop edi
pop esi
mov eax, dword [eax - 8]
ret 8

Function at 0x4bbdd9
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4bbe1b
call fcn.004c64c3
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
cmp eax, edi
je 0x4bbe1b
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4bbe12
xor eax, eax
jmp 0x4bbe23
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004bbe29
pop edi
pop esi
pop ebx
ret 4

Function at 0x4c6c9a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov dword [ebp - 8], ecx
call fcn.004c64c3
mov esi, dword [eax + 0xc]
push 0xf1
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x4c6cd7
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4c6cd7
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x4c6cdb
xor eax, eax
jmp 0x4c6d59
movzx eax, word [esi + 6]
push ebx
push edi
shl eax, 2
push eax
call fcn.004b8677
and dword [ebp - 4], 0
cmp word [esi + 6], 0
pop ecx
mov ebx, eax
jbe 0x4c6d13
mov ecx, ebx
lea eax, [esi + 8]
movzx edx, word [eax]
inc dword [ebp - 4]
mov dword [ecx], edx
movzx edx, word [esi + 6]
inc eax
add ecx, 4
inc eax
cmp dword [ebp - 4], edx
jl 0x4c6cfd
movzx eax, word [esi + 6]
mov ecx, dword [ebp - 8]
push eax
push ebx
call fcn.004c6e4a
push ebx
mov edi, eax
call fcn.004b86a0
test edi, edi
pop ecx
je 0x4c6d55
movzx ecx, word [esi + 4]
movzx eax, word [esi + 2]
lea esi, [ecx + 7]
push ecx
mov ecx, dword [ebp - 8]
lea edx, [eax + 7]
push eax
push esi
push edx
call fcn.004c6c13
push dword [ebp + 8]
mov ecx, dword [ebp - 8]
call fcn.004c6d5e
mov edi, eax
mov eax, edi
pop edi
pop ebx
pop esi
leave
ret 4
Function at 0x1001bd34
Capabilities:
Log keystrokes

Disassembly:
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyW]
xor ebx, ebx
push edi
mov edi, ecx
push 5
pop eax
push ebx
mov dword [edi], eax
mov dword [edi + 4], eax
mov word [edi + 8], 1
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
mov dword [edi + 0x18], ebx
mov dword [edi + 0x1c], ebx
push 0x5b
mov dword [edi + 0xc], 4
call esi
push ebx
push 0x10
mov byte [edi + 0x29], al
call esi
push ebx
push 0xa0
mov byte [edi + 0x26], al
call esi
push ebx
push 0xa1
mov byte [edi + 0x27], al
call esi
push ebx
push 0x11
mov byte [edi + 0x28], al
call esi
push ebx
push 0x12
mov byte [edi + 0x24], al
call esi
mov byte [edi + 0x25], al
pop edi
pop esi
pop ebx
ret

Function at 0x100359ef
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x100359fe
pop dword [ebp - 0x4c]
mov eax, 0x1385007f
add eax, 0xfc7e597f
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0xe0d0bcd
add dword [ebp - 0x5c], 0x4045397e
mov dword [ebp - 0x58], 0x91069fca
sub dword [ebp - 0x58], 0x5ed35385
mov dword [ebp - 0x54], 0x4605833f
add dword [ebp - 0x54], 0x646c0ef
mov dword [ebp - 0x50], 0xfb3f888c
add dword [ebp - 0x50], 0x4c07774
lea eax, [ebp - 0x5c]
push eax
mov eax, 0xd2b9e991
sub eax, 0xc2b5988d
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0x90bce668
add dword [ebp - 0x5c], 0xe3b582ee
mov dword [ebp - 0x58], 0x989e4ced
sub dword [ebp - 0x58], 0x5731eb78
mov dword [ebp - 0x54], 0x2174e4a2
sub dword [ebp - 0x54], 0xbe057836
mov dword [ebp - 0x50], 0x9799e87f
sub dword [ebp - 0x50], 0x9799e87f
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x4ab4e
push 0
call eax
mov ecx, 0x830ee07c
sub ecx, 0x830e970e
xor edi, edi
add edi, eax
mov ebx, 0x25237851
add ebx, 0xeae3d7af
add ebx, dword [ebp - 0x4c]
mov esi, 0x4d9709dd
sub esi, 0x89df2644
xor dword [ebp - 0x10], ecx
mov edx, dword [ebx]
xor edx, esi
mov dword [ebp - 0x28], 0x9c0ec064
mov dword [edi], edx
add dword [ebp - 0x3c], eax
add edi, 0xde6d879
add edi, 0xf219278b
add ebx, 4
loop 0x10035b1d
add eax, 0x1aa3b396
sub eax, 0x1aa29b0b
xor ebx, ebx
add ebx, eax
add eax, 0xfae68e1b
sub eax, 0xfae68e16
mov ecx, 0xe0b98f54
add ecx, 0x2f4670ac
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x4015e0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43c072
mov eax, dword fs:[0]
push eax
sub esp, 0x448
mov eax, dword [0x452a60]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x450], 0
mov dword [ebp - 0x454], ebx
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
push 0
mov dword [ebp - 4], 0
push 2
mov dword [ebp - 0x450], 1
mov dword [ebp - 0x448], 0x22c
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea ecx, [ebp - 0x448]
push ecx
push eax
mov dword [ebp - 0x44c], eax
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x40171e
mov eax, dword [ebp - 0x440]
mov ecx, 0x82
lea esi, [ebp - 0x424]
lea edi, [ebp - 0x21c]
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebx + 4]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x21c]
cmp eax, edi
jae 0x4016db
mov eax, dword [ebx]
lea ecx, [ebp - 0x21c]
cmp eax, ecx
ja 0x4016db
sub ecx, eax
mov eax, 0x3e88cb3d
imul ecx
sar edx, 7
mov esi, edx
shr esi, 0x1f
add esi, edx
cmp edi, dword [ebx + 8]
jne 0x4016ca
push ecx
mov ecx, ebx
call fcn.004024b0
mov edi, dword [ebx + 4]
imul esi, esi, 0x20c
add esi, dword [ebx]
test edi, edi
je 0x4016fc
jmp 0x4016f5
cmp edi, dword [ebx + 8]
jne 0x4016e8
push ecx
mov ecx, ebx
call fcn.004024b0
mov edi, dword [ebx + 4]
test edi, edi
je 0x4016fc
lea esi, [ebp - 0x21c]
mov ecx, 0x83
rep movsd dword es:[edi], dword [esi]
add dword [ebx + 4], 0x20c
lea eax, [ebp - 0x448]
push eax
push dword [ebp - 0x44c]
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x401675
push dword [ebp - 0x44c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004255d9
mov esp, ebp
pop ebp
ret

Function at 0x402630
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
movzx eax, word [ebp + 8]
mov dword [ebp + 8], eax
pop ebp
jmp fcn.00406513

Function at 0x402c30
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x402c45
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x402c84
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x402c80
lea ebx, [ebx]
cmp esi, edx
jae 0x402c84
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
dec ecx
jne 0x402c70
cmp esi, edx
jb 0x402c89
xor eax, eax
pop esi
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop ebp
ret
Function at 0x403560
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, ecx
mov ecx, 0x5a4d
mov dword [ebp - 4], eax
cmp word [eax], cx
je 0x40357b
xor eax, eax
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [eax + 0x3c]
add ebx, eax
cmp dword [ebx], 0x4550
je 0x403590
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 4
push 0x2000
push dword [ebx + 0x50]
push dword [ebx + 0x34]
call edi
mov esi, eax
mov dword [ebp - 8], esi
test esi, esi
jne 0x4035ca
push 4
push 0x2000
push dword [ebx + 0x50]
push eax
call edi
mov esi, eax
mov dword [ebp - 8], eax
test esi, esi
je 0x403694
push 0x14
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
push 4
push 0x1000
mov dword [edi + 4], esi
mov dword [edi + 0xc], 0
mov dword [edi + 8], 0
mov dword [edi + 0x10], 0
push dword [ebx + 0x50]
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 4
push 0x1000
push dword [ebx + 0x54]
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, dword [ebx + 0x54]
mov esi, eax
mov eax, dword [ebp - 4]
add ecx, dword [eax + 0x3c]
push ecx
push eax
push esi
call fcn.0042ca30
mov ecx, dword [ebp - 4]
push edi
mov eax, dword [ecx + 0x3c]
add eax, esi
mov esi, dword [ebp - 8]
mov dword [edi], eax
mov edx, ebx
mov dword [eax + 0x34], esi
call fcn.00403210
mov edx, esi
add esp, 0x10
sub edx, dword [ebx + 0x34]
je 0x403653
mov ecx, edi
call fcn.004033a0
mov ecx, edi
call fcn.00403440
test eax, eax
je 0x40368d
mov ecx, edi
call fcn.004032c0
mov eax, dword [edi]
mov eax, dword [eax + 0x28]
test eax, eax
je 0x403684
add eax, esi
je 0x40368d
push 0
push 1
push esi
call eax
test eax, eax
je 0x40368d
mov dword [edi + 0x10], 1
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, edi
call fcn.00403740
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x405445
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
mov esi, edi
mov eax, ecx
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], esi
je 0x40548f
call fcn.0040f9be
mov ebx, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x40548c
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x4054c8
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov eax, dword [ebp - 4]
xor ebx, ebx
inc ebx
test edi, edi
je 0x4054b1
push dword [ebp + 0x10]
mov edx, dword [eax]
push edi
push dword [ebp + 8]
mov ecx, eax
call dword [edx + 0x20]
mov ebx, eax
test esi, esi
je 0x4054b1
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x68]
test ecx, ecx
je 0x4054c6
mov eax, dword [ecx]
push dword [ebp + 0x10]
call dword [eax + 0xa0]
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x40a518
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x452a60]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x4558cc]
push esi
push edi
mov edi, dword [ebp + 8]
test eax, eax
jne 0x40a564
push 0x43ea58
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40a581
push str.SetDefaultDllDirectories
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_EncodePointer]
mov dword [0x4558cc], eax
jmp 0x40a56d
push eax
call dword [sym.imp.KERNEL32.dll_DecodePointer]
mov esi, eax
test esi, esi
je 0x40a581
push 0x800
push 0
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
jmp 0x40a5ee
mov esi, 0x105
push esi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x40a59c
xor eax, eax
jmp 0x40a5ee
lea eax, [ebp - 0x210]
push eax
call fcn.004262b8
cmp word [ebp + eax*2 - 0x212], 0x5c
pop ecx
je 0x40a5cd
push 0x43e6d0
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.0042624c
add esp, 0xc
test eax, eax
jne 0x40a598
push edi
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.0042624c
add esp, 0xc
test eax, eax
jne 0x40a598
lea eax, [ebp - 0x210]
push eax
call fcn.0040eb1f
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004255d9
leave
ret

Function at 0x40ad51
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
mov esi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], esi
je 0x40ad96
call fcn.0040f9be
mov ebx, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x40ad96
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x40adb2
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.00403855
mov ebx, eax
test edi, edi
je 0x40adb0
test esi, esi
je 0x40adb0
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x40f23a
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x43a86e
call fcn.0042697a
mov edi, ecx
xor esi, esi
cmp dword [edi + 0x6c], esi
jne 0x40f260
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x40f2b4
call fcn.004090c0
push eax
lea ecx, [ebp - 0x10]
call fcn.00402c00
mov ecx, dword [edi + 0x6c]
lea edx, [ebp - 0x10]
mov eax, dword [ecx]
push edx
mov dword [ebp - 4], esi
call dword [eax + 0x8c]
mov edi, dword [ebp + 8]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push edi
call fcn.00428bf9
push eax
call fcn.00402cd0
add esp, 0x14
test edi, edi
je 0x40f2a7
push edi
call fcn.004262b8
pop ecx
mov esi, eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00403060
mov eax, esi
call fcn.00426948
ret 8