joyce8/EMBER2024-capa huggingface dataset:
Function at 0x440f30
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x318
mov eax, dword [0x8a0204]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x314], 0
lea eax, [ebp - 0x314]
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x440f89
lea ecx, [ebp - 0x20c]
push ecx
mov edx, dword [ebp - 0x314]
push edx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
mov dword [ebp - 0x318], eax
mov eax, dword [ebp - 0x314]
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov ecx, dword [ebp + 0xc]
push ecx
push 0x8618b0
lea edx, [ebp - 0x108]
push edx
call fcn.004055c0
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
lea ecx, [ebp - 0x20c]
push ecx
push 0x8618b8
lea edx, [ebp - 0x310]
push edx
call fcn.004055c0
add esp, 0x10
push 1
mov eax, dword [ebp + 0xc]
push eax
push 0
mov ecx, dword [ebp + 0x10]
push ecx
push 0
lea edx, [ebp - 0x108]
push edx
lea eax, [ebp - 0x20c]
push eax
push 0x85fbc9
mov ecx, dword [ebp + 8]
push ecx
call fcn.00440b40
add esp, 0x24
movzx edx, al
test edx, edx
je 0x441001
lea eax, [ebp - 0x310]
jmp 0x441010
push 0x8618c0
call fcn.004054e0
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0075c173
mov esp, ebp
pop ebp
ret

Function at 0x441020
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x318
mov eax, dword [0x8a0204]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x314], 0
lea eax, [ebp - 0x314]
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x441079
lea ecx, [ebp - 0x20c]
push ecx
mov edx, dword [ebp - 0x314]
push edx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
mov dword [ebp - 0x318], eax
mov eax, dword [ebp - 0x314]
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov ecx, dword [ebp + 0x10]
push ecx
push str._s.lnk
lea edx, [ebp - 0x108]
push edx
call fcn.004055c0
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
lea ecx, [ebp - 0x20c]
push ecx
push 0x8618e4
lea edx, [ebp - 0x310]
push edx
call fcn.004055c0
add esp, 0x10
push 1
mov eax, dword [ebp + 0x10]
push eax
push 0
mov ecx, dword [ebp + 0x14]
push ecx
push 0
lea edx, [ebp - 0x108]
push edx
lea eax, [ebp - 0x20c]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00440b40
add esp, 0x24
movzx eax, al
test eax, eax
je 0x4410f0
lea eax, [ebp - 0x310]
jmp 0x4410ff
push str.GenerateNormalIcon_faile__n
call fcn.004054e0
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0075c173
mov esp, ebp
pop ebp
ret
Function at 0x4411c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 0xc]
push eax
push 0x20219
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x441220
lea eax, [ebp + 0x18]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
push 0
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x441214
mov dword [ebp - 8], 1
jmp 0x44121b
mov dword [ebp - 8], 0
mov al, byte [ebp - 8]
jmp 0x441222
xor al, al
mov esp, ebp
pop ebp
ret

Function at 0x441230
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 8]
push eax
push 0x20006
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x441281
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x441281
mov al, 1
jmp 0x441283
xor al, al
mov esp, ebp
pop ebp
ret

Function at 0x441db0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0xa8], 0
je 0x441de2
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xa8]
push edx
call fcn.004f1710
add esp, 4
mov eax, dword [ebp - 4]
mov dword [eax + 0xa8], 0
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push edx
call fcn.004f1330
add esp, 4
mov ecx, dword [ebp - 4]
add ecx, 0xac
call fcn.00403470
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [ebp - 4]
add ecx, 0xac
call fcn.00403560
mov ecx, dword [ebp - 4]
add ecx, 0x80
call fcn.00403560
mov ecx, dword [ebp - 4]
add ecx, 0x64
call fcn.00403560
mov ecx, dword [ebp - 4]
add ecx, 0x4c
call fcn.00403560
mov ecx, dword [ebp - 4]
add ecx, 0x34
call fcn.00403560
mov ecx, dword [ebp - 4]
add ecx, 0x1c
call fcn.00403560
mov ecx, dword [ebp - 4]
add ecx, 4
call fcn.00403560
mov esp, ebp
pop ebp
ret

Function at 0x44fae0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
mov ecx, 0x1505
test edi, edi
jne 0x44faf9
pop edi
xor eax, eax
pop esi
pop ebp
ret
push ebx
mov bl, byte [edi]
test bl, bl
je 0x44fb20
mov eax, ecx
lea edi, [edi + 1]
mov edx, esi
shld esi, ecx, 5
shl ecx, 5
add ecx, eax
movzx eax, bl
mov bl, byte [edi]
adc esi, edx
cdq
add ecx, eax
adc esi, edx
test bl, bl
jne 0x44fb00
pop ebx
pop edi
mov eax, ecx
pop esi
pop ebp
ret
Function at 0x450e10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push edi
xor edi, edi
bts edi, eax
cmp eax, 0x20
cmovae edx, edi
xor edi, edx
cmp eax, 0x40
mov eax, dword [ebp + 0xc]
cmovae edx, edi
test eax, eax
js 0x450e5c
push ebx
push esi
lea ebx, [ebp + 0xc]
xor ecx, ecx
lea ebx, [ebx + 4]
bts ecx, eax
xor esi, esi
cmp eax, 0x20
cmovae esi, ecx
xor ecx, esi
cmp eax, 0x40
mov eax, dword [ebx]
cmovae esi, ecx
or edi, ecx
or edx, esi
test eax, eax
jns 0x450e38
pop esi
pop ebx
mov eax, edi
pop edi
pop ebp
ret

Function at 0x4580b0
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [ebp + 0x18], 0
xorps xmm0, xmm0
movlpd qword [ebp - 0x10], xmm0
jb 0x458171
ja 0x4580d4
cmp dword [ebp + 0x14], 0
jbe 0x458171
mov eax, dword [ebp - 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp - 0x10]
push edi
movzx ecx, word [ebx + 8]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 8], eax
nop word [eax + eax]
mov eax, dword [ebp + 0x10]
mov al, byte [esi + eax]
test edi, edi
je 0x458110
movzx edx, cx
or edx, 2
mov ecx, edx
xor ecx, 1
imul ecx, edx
shr ecx, 8
xor al, cl
mov byte [esi + edi], al
mov byte [ebp - 4], al
lea eax, [ebp - 4]
push 1
push eax
mov eax, dword [ebx]
not eax
push eax
call fcn.0045b020
not eax
mov dword [ebx], eax
movzx eax, al
add eax, dword [ebx + 4]
imul eax, eax, 0x8088405
push 1
inc eax
mov dword [ebx + 4], eax
shr eax, 0x18
mov byte [ebp - 4], al
lea eax, [ebp - 4]
push eax
mov eax, dword [ebx + 8]
not eax
push eax
call fcn.0045b020
mov edx, dword [ebp - 8]
add esi, 1
not eax
adc edx, 0
mov dword [ebx + 8], eax
mov dword [ebp - 8], edx
movzx ecx, ax
cmp edx, dword [ebp + 0x18]
jb 0x4580f0
ja 0x45816e
cmp esi, dword [ebp + 0x14]
jb 0x4580f0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x458180
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [ebp + 0x18], 0
xorps xmm0, xmm0
push esi
mov esi, dword [ebp + 8]
movlpd qword [ebp - 0xc], xmm0
jb 0x4582c3
push ebx
mov ebx, dword [ebp + 0x14]
ja 0x4581aa
test ebx, ebx
je 0x4582c2
cmp dword [ebp + 0xc], 0
push edi
je 0x458253
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0x10]
push 1
mov bl, byte [eax + ecx]
mov ax, word [esi + 8]
or ax, 2
mov byte [ebp - 4], bl
movzx edi, ax
lea eax, [ebp - 4]
push eax
mov eax, dword [esi]
not eax
push eax
call fcn.0045b020
not eax
mov dword [esi], eax
movzx eax, al
add eax, dword [esi + 4]
imul eax, eax, 0x8088405
push 1
inc eax
mov dword [esi + 4], eax
shr eax, 0x18
mov byte [ebp - 4], al
lea eax, [ebp - 4]
push eax
mov eax, dword [esi + 8]
not eax
push eax
call fcn.0045b020
mov edx, dword [ebp + 0xc]
not eax
mov dword [esi + 8], eax
mov eax, edi
mov ecx, edi
xor ecx, 1
imul ecx, eax
mov eax, dword [ebp - 8]
shr ecx, 8
xor cl, bl
mov byte [eax + edx], cl
add eax, 1
mov ecx, dword [ebp - 0x10]
adc ecx, 0
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], ecx
cmp ecx, dword [ebp + 0x18]
jb 0x4581c1
ja 0x4582c1
cmp eax, dword [ebp + 0x14]
jb 0x4581c1
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
movlpd qword [ebp - 0xc], xmm0
mov eax, dword [ebp - 8]
mov edi, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
push 1
mov al, byte [edi + eax]
mov byte [ebp - 4], al
lea eax, [ebp - 4]
push eax
mov eax, dword [esi]
not eax
push eax
call fcn.0045b020
not eax
mov dword [esi], eax
movzx eax, al
add eax, dword [esi + 4]
imul eax, eax, 0x8088405
push 1
inc eax
mov dword [esi + 4], eax
shr eax, 0x18
mov byte [ebp - 4], al
lea eax, [ebp - 4]
push eax
mov eax, dword [esi + 8]
not eax
push eax
call fcn.0045b020
not eax
add edi, 1
mov dword [esi + 8], eax
mov eax, dword [ebp - 0x10]
adc eax, 0
mov dword [ebp - 0x10], eax
cmp eax, dword [ebp + 0x18]
jb 0x458261
ja 0x4582c1
cmp edi, ebx
jb 0x458261
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x458740
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
movzx eax, word [ebp + 0xc]
push 2
push eax
push dword [ebp + 8]
push 0
call sub.bcrypt.dll_BCryptGenRandom
test eax, eax
setns al
pop ebp
ret

Function at 0x45b020
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.0045b030

Function at 0x45b350
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
movzx eax, dl
shr edx, 8
xor edx, dword [eax*4 + 0x7b6600]
movzx eax, dl
shr edx, 8
xor edx, dword [eax*4 + 0x7b6600]
movzx ecx, dl
shr edx, 8
xor edx, dword [ecx*4 + 0x7b6600]
movzx ecx, dl
shr edx, 8
xor edx, dword [ecx*4 + 0x7b6600]
mov eax, edx
pop ebp
ret

Function at 0x45e940
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.0045e950
Function at 0x45ebd0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x24
mov edx, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov eax, dword [edx + 0x78]
mov ebx, dword [edx + 0x8c]
cmp eax, ebx
mov eax, dword [edx + 0x34]
mov ebx, dword [edx + 0x7c]
jl 0x45ebf5
shr ebx, 2
dec ebx
shl ebx, 0x10
or ebx, eax
mov dword [esp], ebx
mov eax, dword [edx + 0x90]
mov ebx, dword [edx + 0x74]
cmp ebx, eax
jl 0x45ec0d
mov ebx, eax
mov dword [esp + 0x18], ebx
mov esi, dword [edx + 0x38]
mov dword [esp + 4], esi
mov ebp, dword [edx + 0x6c]
lea edi, [esi + ebp]
mov dword [esp + 0x20], edi
mov eax, edi
neg eax
and eax, 3
mov dword [esp + 0x14], eax
mov eax, dword [edx + 0x2c]
sub eax, 0x106
sub ebp, eax
jg 0x45ec3b
xor ebp, ebp
mov eax, dword [edx + 0x78]
mov dword [esp + 0x1c], eax
add esi, eax
mov dword [esp + 8], esi
movzx ebx, word [edi]
mov dword [esp + 0x10], ebx
movzx ebx, word [edi + eax - 1]
mov dword [esp + 0xc], ebx
mov edi, dword [edx + 0x40]
mov edx, dword [esp]
jmp 0x45ec7a
and ecx, edx
movzx ecx, word [edi + ecx*2]
cmp ecx, ebp
jbe 0x45ed4e
sub edx, 0x10000
js 0x45ed4e
movzx eax, word [esi + ecx - 1]
cmp eax, ebx
jne 0x45ec60
mov eax, dword [esp + 4]
movzx eax, word [eax + ecx]
cmp eax, dword [esp + 0x10]
jne 0x45ec60
mov dword [esp], edx
mov esi, dword [esp + 4]
mov edi, dword [esp + 0x20]
add esi, ecx
mov eax, dword [esp + 0x14]
mov edx, 0xfffffef8
lea edi, [edi + eax + 0x108]
lea esi, [esi + eax + 0x108]
mov eax, dword [esi + edx]
xor eax, dword [edi + edx]
jne 0x45ecd1
mov eax, dword [esi + edx + 4]
xor eax, dword [edi + edx + 4]
jne 0x45ecce
add edx, 8
jne 0x45ecb5
jmp 0x45ed3f
add edx, 4
test eax, 0xffff
jne 0x45ecde
add edx, 2
shr eax, 0x10
sub al, 1
adc edx, 0
lea eax, [edi + edx]
mov edi, dword [esp + 0x20]
sub eax, edi
cmp eax, 0x102
jge 0x45ed3f
mov edx, dword [esp + 0x38]
mov ebx, dword [esp + 0x1c]
cmp eax, ebx
jg 0x45ed12
mov esi, dword [esp + 8]
mov edi, dword [edx + 0x40]
mov ebx, dword [esp + 0xc]
mov edx, dword [esp]
jmp 0x45ec60
mov ebx, dword [esp + 0x18]
mov dword [esp + 0x1c], eax
mov dword [edx + 0x70], ecx
cmp eax, ebx
jge 0x45ed4e
mov esi, dword [esp + 4]
add esi, eax
mov dword [esp + 8], esi
movzx ebx, word [edi + eax - 1]
mov edi, dword [edx + 0x40]
mov dword [esp + 0xc], ebx
mov edx, dword [esp]
jmp 0x45ec60
mov edx, dword [esp + 0x38]
mov dword [esp + 0x1c], 0x102
mov dword [edx + 0x70], ecx
mov edx, dword [esp + 0x38]
mov ebx, dword [esp + 0x1c]
mov eax, dword [edx + 0x74]
cmp ebx, eax
jg 0x45ed5f
mov eax, ebx
add esp, 0x24
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x463230
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
test eax, eax
jge 0x463251
mov ecx, dword [ebp - 4]
or ecx, 8
mov dword [ebp - 4], ecx
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
movsx edx, ax
test edx, edx
jge 0x463269
mov eax, dword [ebp - 4]
or eax, 1
mov dword [ebp - 4], eax
push 2
call dword [sym.imp.USER32.dll_GetKeyState]
movsx ecx, ax
test ecx, ecx
jge 0x463281
mov edx, dword [ebp - 4]
or edx, 2
mov dword [ebp - 4], edx
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
test eax, eax
jge 0x463297
mov ecx, dword [ebp - 4]
or ecx, 4
mov dword [ebp - 4], ecx
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
movsx edx, ax
test edx, edx
jge 0x4632af
mov eax, dword [ebp - 4]
or eax, 0x20
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x46a180
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov dword [ebp - 4], ecx
call dword [sym.imp.USER32.dll_GetFocus]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
cmp ecx, dword [eax + 0x68]
je 0x46a1b8
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
cmp eax, dword [edx + 0xc8]
je 0x46a1b8
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x68]
push edx
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax + 0xc8]
jne 0x46a1cb
jmp 0x46a327
mov edx, dword [ebp - 4]
cmp dword [edx + 0xc8], 0
je 0x46a251
xor eax, eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x28], 0x17
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x24], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x20], eax
lea edx, [ebp - 0x28]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc8]
mov edx, dword [ebp - 4]
mov eax, dword [ecx]
mov ecx, dword [edx + 0xc8]
mov edx, dword [eax + 0x138]
call edx
push 0
push 0
push 0
push str.killfocus
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc8]
push ecx
mov ecx, dword [ebp - 4]
call fcn.00469c60
mov edx, dword [ebp - 4]
mov dword [edx + 0xc8], 0
cmp dword [ebp + 8], 0
jne 0x46a25c
jmp 0x46a327
cmp dword [ebp + 8], 0
je 0x46a327
mov eax, dword [ebp + 8]
mov edx, dword [eax]
mov ecx, dword [ebp + 8]
mov eax, dword [edx + 0x1c]
call eax
cmp eax, dword [ebp - 4]
jne 0x46a327
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov ecx, dword [ebp + 8]
mov eax, dword [edx + 0xf8]
call eax
movzx ecx, al
test ecx, ecx
je 0x46a327
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov ecx, dword [ebp + 8]
mov edx, dword [eax + 0x104]
call edx
movzx eax, al
test eax, eax
je 0x46a327
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
mov dword [ecx + 0xc8], edx
xor eax, eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x48], 0x18
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x44], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x40], eax
lea edx, [ebp - 0x48]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc8]
mov edx, dword [ebp - 4]
mov eax, dword [ecx]
mov ecx, dword [edx + 0xc8]
mov edx, dword [eax + 0x138]
call edx
push 0
push 0
push 0
push str.setfocus
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc8]
push ecx
mov ecx, dword [ebp - 4]
call fcn.00469c60
mov esp, ebp
pop ebp
ret 4
Function at 0x4718d0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], 0
push 4
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_GetWindow]
mov dword [ebp - 4], eax
push 1
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_EnableWindow]
xor edx, edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4719aa
push 0
push 0
push 0
lea edx, [ebp - 0x28]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x4719aa
cmp dword [ebp - 0x24], 0x10
jne 0x471976
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x28]
cmp ecx, dword [eax + 4]
jne 0x471976
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0xc], edx
push 1
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
lea edx, [ebp - 0x28]
push edx
call fcn.0046adf0
add esp, 4
movzx eax, al
test eax, eax
jne 0x47199d
lea ecx, [ebp - 0x28]
push ecx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea edx, [ebp - 0x28]
push edx
call dword [sym.imp.USER32.dll_DispatchMessageA]
cmp dword [ebp - 0x24], 0x12
jne 0x4719a5
jmp 0x4719aa
jmp 0x471924
push 1
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
cmp dword [ebp - 0x24], 0x12
jne 0x4719d0
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x472e70
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x8a0204]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov dword [ebp - 0x214], ecx
mov eax, dword [ebp + 8]
shr eax, 0x10
and eax, 0xffff
movzx ecx, ax
test ecx, ecx
je 0x472ef1
mov edx, dword [ebp + 8]
movsx eax, byte [edx]
cmp eax, 0x3c
jne 0x472eca
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x214]
add ecx, 0x28
call fcn.004b22f0
movzx edx, al
test edx, edx
jne 0x472ec8
xor eax, eax
jmp 0x472fc9
jmp 0x472eec
push 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x214]
add ecx, 0x28
call fcn.004b2360
movzx ecx, al
test ecx, ecx
jne 0x472eec
xor eax, eax
jmp 0x472fc9
jmp 0x472f98
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00462c10
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0
jne 0x472f1b
xor eax, eax
jmp 0x472fc9
mov ecx, dword [ebp - 0x218]
push ecx
call fcn.00462c10
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0
jne 0x472f4e
mov edx, dword [ebp - 0x218]
push edx
call dword [sym.imp.KERNEL32.dll_FreeResource]
xor eax, eax
jmp 0x472fc9
push 0
mov eax, dword [ebp - 0x218]
push eax
call fcn.00462c10
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
mov ecx, dword [ebp - 0x21c]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
mov ecx, dword [ebp - 0x214]
add ecx, 0x28
call fcn.004b29a0
movzx edx, al
test edx, edx
jne 0x472f8b
xor eax, eax
jmp 0x472fc9
mov eax, dword [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
lea ecx, [ebp - 0x210]
push ecx
mov ecx, dword [ebp - 0x214]
add ecx, 0x28
call fcn.004b2170
sub esp, 0x20c
mov ecx, 0x83
mov esi, eax
mov edi, esp
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0x214]
call fcn.004729c0
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0075c173
mov esp, ebp
pop ebp
ret 8
Function at 0x4731f0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x8a0204]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
je 0x473224
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x473224
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov edx, dword [ebp + 0xc]
movsx eax, byte [edx]
test eax, eax
jne 0x473233
jmp 0x473390
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x214], ecx
mov edx, dword [ebp - 0x214]
mov dword [ebp - 0x210], edx
mov eax, dword [ebp - 0x210]
movsx ecx, byte [eax]
test ecx, ecx
je 0x47328e
mov edx, dword [ebp - 0x210]
movsx eax, byte [edx]
cmp eax, 0x2f
je 0x473271
mov ecx, dword [ebp - 0x210]
movsx edx, byte [ecx]
cmp edx, 0x5c
jne 0x47327d
mov eax, dword [ebp - 0x210]
mov dword [ebp - 0x214], eax
mov ecx, dword [ebp - 0x210]
add ecx, 1
mov dword [ebp - 0x210], ecx
jmp 0x473248
mov edx, dword [ebp - 0x214]
mov dword [ebp - 0x21c], edx
mov eax, dword [ebp - 0x214]
cmp eax, dword [ebp + 0xc]
je 0x473314
mov ecx, dword [ebp - 0x214]
sub ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x20c]
push eax
call fcn.00774520
add esp, 0xc
mov ecx, dword [ebp - 0x214]
sub ecx, dword [ebp + 0xc]
mov dword [ebp - 0x218], ecx
cmp dword [ebp - 0x218], 0x104
jae 0x4732df
jmp 0x4732e4
call fcn.0075ca57
mov edx, dword [ebp - 0x218]
mov byte [ebp + edx - 0x20c], 0
lea eax, [ebp - 0x20c]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004731f0
add esp, 8
mov edx, dword [ebp - 0x21c]
add edx, 1
mov dword [ebp - 0x21c], edx
mov eax, 1
imul ecx, eax, 0
mov dword [ebp - 0x220], ecx
cmp dword [ebp - 0x220], 0x104
jae 0x473330
jmp 0x473335
call fcn.0075ca57
mov edx, dword [ebp - 0x220]
mov byte [ebp + edx - 0x108], 0
cmp dword [ebp + 8], 0
je 0x47335c
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x108]
push ecx
call fcn.00786cf0
add esp, 8
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x108]
push eax
call fcn.00786d00
add esp, 8
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x473390
push 0
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0075c173
mov esp, ebp
pop ebp
ret