joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41bef8
Capabilities:
Enumerate files on windows

Disassembly:
mov eax, 0x4679f4
call fcn.00464890
sub esp, 0x180
push ebx
push esi
push edi
xor edi, edi
push dword [edi + 0x728550]
lea eax, [ebp - 0x1c]
mov ecx, 0x73b8f0
push eax
call fcn.0041145b
and dword [ebp - 4], 0
lea ecx, [ebp - 0x3c]
push 0x728548
call fcn.00415bc9
push ecx
push eax
lea ecx, [ebp - 0x1c]
call fcn.00410ebc
lea ecx, [ebp - 0x3c]
mov esi, eax
call fcn.00415c2c
lea ecx, [ebp - 0x1c]
test esi, esi
js 0x41c00f
call fcn.00415cf7
lea ecx, [ebp - 0x18c]
push ecx
push eax
call dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x41bf73
test esi, esi
je 0x41bf73
mov bl, 1
jmp 0x41bf75
xor bl, bl
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x1c]
call fcn.004100da
mov byte [ebp - 4], 1
test bl, bl
je 0x41bff5
lea eax, [ebp - 0x160]
push 0x475a3c
push eax
call fcn.00444660
pop ecx
pop ecx
test eax, eax
je 0x41bfe3
lea eax, [ebp - 0x160]
push 0x4762e8
push eax
call fcn.00444660
pop ecx
pop ecx
test eax, eax
je 0x41bfe3
lea eax, [ebp - 0x160]
push eax
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0041145b
push eax
lea ecx, [ebp - 0x1c]
call fcn.00401d01
lea ecx, [ebp - 0x4c]
call fcn.00415c2c
lea ecx, [ebp - 0x1c]
call fcn.004114bb
lea eax, [ebp - 0x18c]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_FindNextFileA]
test eax, eax
jne 0x41bf89
cmp esi, 0xffffffff
je 0x41c005
test esi, esi
je 0x41c005
push esi
call dword [sym.imp.KERNEL32.DLL_FindClose]
lea ecx, [ebp - 0x2c]
call fcn.00415c2c
jmp 0x41c014
call fcn.004114bb
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.00415c2c
add edi, 4
cmp edi, 0x20
jb 0x41bf0d
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x41e4e7
Capabilities:
Get graphical window text

Disassembly:
mov eax, 0x464a5e
call fcn.00464890
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ecx, dword [ebp + 8]
call fcn.00415cf7
push eax
lea ecx, [ebp - 0x10]
call fcn.0040173a
and dword [ebp - 4], 0
mov ecx, edi
push esi
call fcn.0042fcba
cmp dword [edi], 0
mov ebx, eax
mov dword [edi + 0xc], 1
je 0x41e559
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov edi, eax
lea ecx, [ebp - 0x10]
push edi
call fcn.00401872
push edi
lea ecx, [ebp - 0x10]
mov esi, eax
call fcn.0040184a
lea ecx, [edi + 1]
push ecx
push esi
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.0041d266
jmp 0x41e562
push dword [ebp - 0x10]
push ebx
call fcn.00424440
push dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
call fcn.0041611d
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.004016a5
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x41f888
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [0x739e3c]
lea ebx, [edi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
mov esi, dword [ebp + 8]
test esi, esi
jle 0x41f8d1
cmp esi, dword [edi + 0xc]
jge 0x41f8d1
push dword [edi]
call dword [sym.imp.KERNEL32.DLL_TlsGetValue]
test eax, eax
je 0x41f8d1
mov ecx, dword [eax + 0xc]
test ecx, ecx
je 0x41f8d1
cmp esi, dword [eax + 8]
jge 0x41f8d1
mov esi, dword [ecx + esi*4]
push ebx
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
mov eax, esi
jmp 0x41f8da
push ebx
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x41f8e1
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, 0x467e56
call fcn.00464890
sub esp, 0x10
push ebx
mov ebx, dword [0x739e3c]
push esi
push edi
mov dword [ebp - 0x10], esp
lea eax, [ebx + 0x1c]
mov dword [ebp - 0x18], ebx
push eax
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
mov edi, dword [ebp + 8]
test edi, edi
jle 0x41f9e2
cmp edi, dword [ebx + 0xc]
jge 0x41f9e2
push dword [ebx]
call dword [sym.imp.KERNEL32.DLL_TlsGetValue]
mov esi, eax
test esi, esi
je 0x41f943
cmp edi, dword [esi + 8]
jl 0x41f9d0
cmp dword [ebp + 0xc], 0
je 0x41f9d0
xor edi, edi
jmp 0x41f975
xor edi, edi
push 0x10
mov dword [ebp - 4], edi
call fcn.0041f5f5
mov esi, eax
test esi, esi
je 0x41f95d
mov dword [esi], 0x72afe8
jmp 0x41f95f
mov esi, edi
or dword [ebp - 4], 0xffffffff
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0x14]
mov dword [esi + eax], ecx
mov dword [ebx + 0x14], esi
mov ecx, dword [ebx + 0xc]
push 4
pop edx
call fcn.00425472
cmp dword [esi + 0xc], 0
jne 0x41f990
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_LocalAlloc]
jmp 0x41f99c
push 2
push eax
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.DLL_LocalReAlloc]
mov edx, eax
test edx, edx
je 0x41fa12
mov ecx, dword [esi + 8]
mov dword [esi + 0xc], edx
mov eax, dword [ebx + 0xc]
sub eax, ecx
shl eax, 2
push eax
lea eax, [edx + ecx*4]
push edi
push eax
call fcn.0043a570
mov eax, dword [ebx + 0xc]
add esp, 0xc
mov dword [esi + 8], eax
push esi
push dword [ebx]
call dword [sym.imp.KERNEL32.DLL_TlsSetValue]
mov edi, dword [ebp + 8]
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x41f9e2
cmp edi, dword [esi + 8]
jge 0x41f9e2
mov eax, dword [ebp + 0xc]
mov dword [ecx + edi*4], eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 8
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
call fcn.00422d3e
int3
Function at 0x41fa54
Capabilities:
Set thread local storage value

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
xor eax, eax
push ebp
push esi
xor esi, esi
inc eax
inc esi
mov dword [esp + 0xc], eax
mov ebp, ecx
push edi
lea edi, [ebx + 0xc]
cmp dword [ebx + 8], esi
jle 0x41fab9
mov ecx, dword [esp + 0x1c]
test ecx, ecx
je 0x41fa92
mov eax, dword [ebp + 0x10]
cmp dword [eax + esi*8 + 4], ecx
je 0x41fa92
mov eax, dword [edi]
cmp dword [eax + esi*4], 0
je 0x41faab
xor eax, eax
mov dword [esp + 0x10], eax
jmp 0x41faaf
mov eax, dword [edi]
mov ecx, dword [eax + esi*4]
test ecx, ecx
je 0x41faa1
mov eax, dword [ecx]
push 1
call dword [eax]
mov eax, dword [edi]
mov ecx, dword [esp + 0x1c]
and dword [eax + esi*4], 0
mov eax, dword [esp + 0x10]
inc esi
cmp esi, dword [ebx + 8]
jl 0x41fa75
test eax, eax
je 0x41faee
lea esi, [ebp + 0x1c]
push esi
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
push ebx
lea ecx, [ebp + 0x14]
call fcn.0041f5a6
push esi
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
push dword [edi]
call dword [sym.imp.KERNEL32.DLL_LocalFree]
mov eax, dword [ebx]
mov ecx, ebx
push 1
call dword [eax]
push 0
push dword [ebp]
call dword [sym.imp.KERNEL32.DLL_TlsSetValue]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8

Function at 0x41faf6
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push edi
mov edi, ecx
lea ebx, [edi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x41fb25
push dword [edi]
call dword [sym.imp.KERNEL32.DLL_TlsGetValue]
test eax, eax
je 0x41fb43
push dword [esp + 0xc]
mov ecx, edi
push eax
call fcn.0041fa54
jmp 0x41fb43
mov eax, dword [edi + 0x14]
test eax, eax
je 0x41fb43
push esi
push dword [esp + 0x10]
mov esi, dword [eax + 4]
mov ecx, edi
push eax
call fcn.0041fa54
mov eax, esi
test esi, esi
jne 0x41fb2d
pop esi
push ebx
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
pop edi
pop ebx
ret 8
Function at 0x42035e
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov eax, 0x467f04
call fcn.00464890
sub esp, 0x224
mov eax, dword [edx]
push ebx
push esi
push edi
sub eax, 0x10
mov dword [ebp - 0x10], esp
push eax
mov ebx, ecx
call fcn.00417287
pop ecx
lea esi, [eax + 0x10]
mov dword [ebp - 0x18], esi
and dword [ebp - 4], 0
cmp ebx, 0x80000000
jne 0x4203ca
cmp dword [0x73bc38], 1
jne 0x4203ca
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x14]
call fcn.004247c8
pop ecx
push eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call fcn.0041dd05
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.004016a5
mov esi, dword [ebp - 0x18]
inc ebx
lea eax, [ebp - 0x1c]
push eax
push 0x2001f
push 0
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test edi, edi
jne 0x42045b
push 0x104
lea eax, [ebp - 0x230]
push eax
push 0
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov edi, eax
test edi, edi
jne 0x420438
lea eax, [ebp - 0x230]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x14]
call fcn.0041dd52
mov byte [ebp - 4], 3
lea edx, [ebp - 0x14]
mov ecx, dword [ebp - 0x1c]
push edi
call fcn.0042035e
mov ecx, dword [ebp - 0x14]
mov edi, eax
lea ecx, [ecx - 0x10]
call fcn.004016a5
test edi, edi
je 0x420476
mov byte [ebp - 4], 0
cmp edi, 0x103
je 0x420448
cmp edi, 0x3f2
jne 0x420452
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov edi, eax
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esi - 0x10]
call fcn.004016a5
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 4
and dword [ebp - 4], 0
jmp 0x4203e3
Function at 0x420f20
Capabilities:
Extract resource via kernel32 functions
Identify system language via api

Disassembly:
push ebx
push ebp
push esi
mov ebx, ecx
mov ebp, edx
push 0x42489b
mov ecx, 0x737ca0
call fcn.0041fbe8
mov esi, eax
test esi, esi
je 0x421038
cmp word [esi + 8], 0
jne 0x421013
push edi
push str.comctl32.dll
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
mov edi, eax
test edi, edi
je 0x420fd7
call dword [sym.imp.KERNEL32.DLL_GetUserDefaultUILanguage]
mov ecx, 0x3ff
and ax, cx
add ecx, 0xfffffffd
cmp ax, 0x11
jne 0x420fa5
call fcn.00420ea4
mov ecx, 0x3fc
test eax, eax
je 0x420fa5
cmp dword [esp + 0x14], 0
lea eax, [ecx - 0xe]
push 0xfc11
cmovne eax, ecx
push eax
push 5
push edi
call dword [sym.imp.KERNEL32.DLL_FindResourceExW]
test eax, eax
jne 0x420fc0
mov ecx, 0x3fc
cmp dword [esp + 0x14], 0
mov eax, 0x3ee
push 5
cmovne eax, ecx
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_FindResourceW]
test eax, eax
je 0x420fd7
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_LoadResource]
test eax, eax
je 0x420fd7
push ebp
mov edx, ebx
mov ecx, eax
call fcn.00422992
pop ecx
mov eax, dword [ebx]
push 2
pop edx
mov ecx, dword [eax - 0xc]
lea ecx, [ecx + 1]
call fcn.00425472
push eax
push 0x40
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov ecx, eax
mov dword [esi + 4], ecx
pop edi
test ecx, ecx
je 0x42103d
mov eax, dword [ebx]
push eax
mov eax, dword [eax - 0xc]
inc eax
push eax
push ecx
call fcn.00425457
mov ax, word [ebp]
add esp, 0xc
mov word [esi + 8], ax
push dword [esi + 4]
mov ecx, ebx
call fcn.0041c22c
movzx ecx, word [esi + 8]
mov edx, 0xffff
xor eax, eax
mov word [ebp], cx
pop esi
cmp cx, dx
pop ebp
setne al
pop ebx
ret 4
call fcn.00422d72
call fcn.00422d3e
int3
Function at 0x424440
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x200
cmp dword [ebp + 8], 0
je 0x4244c0
push ebx
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x4244c0
push esi
call fcn.0043e370
mov ebx, eax
mov dword [esp], 0x1fe
xor eax, eax
push eax
mov word [ebp - 0x200], ax
lea eax, [ebp - 0x1fe]
push eax
call fcn.0043a570
mov eax, 0x100
add esp, 0xc
cmp ebx, eax
ja 0x4244b0
push eax
lea eax, [ebp - 0x200]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextW]
cmp eax, ebx
jne 0x4244b0
push esi
lea eax, [ebp - 0x200]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcmpW]
test eax, eax
je 0x4244ba
push esi
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetWindowTextW]
pop esi
pop ebx
leave
ret 8
call fcn.00422d72
int3

Function at 0x42553a
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x73bc3c]
sub esp, 0x20c
push esi
test eax, eax
jne 0x425578
push 0x72b09c
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
test eax, eax
je 0x425597
push str.SetDefaultDllDirectories
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.DLL_EncodePointer]
mov dword [0x73bc3c], eax
jmp 0x425581
push eax
call dword [sym.imp.KERNEL32.DLL_DecodePointer]
mov esi, eax
test esi, esi
je 0x425597
push 0x800
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_LoadLibraryExW]
jmp 0x4255fe
mov esi, 0x105
lea eax, [ebp - 0x20c]
push esi
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryW]
test eax, eax
je 0x4255fc
cmp eax, esi
jae 0x4255fc
cmp word [ebp + eax*2 - 0x20e], 0x5c
je 0x4255d6
push 0x72b0d4
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.00450a32
add esp, 0xc
test eax, eax
jne 0x4255fc
push dword [ebp + 8]
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.00450a32
add esp, 0xc
test eax, eax
jne 0x4255fc
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.DLL_LoadLibraryW]
jmp 0x4255fe
xor eax, eax
pop esi
leave
ret

Function at 0x425af3
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [esp + 0x10]
mov dword [esi + 0x84], edi
test edi, 0xffff0000
jne 0x425b1b
cmp dword [esi + 0x80], 0
jne 0x425b1b
movzx eax, di
mov dword [esi + 0x80], eax
call fcn.0041f558
push 5
push edi
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.DLL_FindResourceW]
test eax, eax
je 0x425b4c
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_LoadResource]
test eax, eax
je 0x425b4c
push ebx
push dword [esp + 0x18]
mov ecx, esi
push eax
call fcn.00425b88
jmp 0x425b4e
xor eax, eax
pop edi
pop esi
pop ebx
ret 8

Function at 0x425b88
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, ecx
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov edi, eax
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x425ba5
call fcn.00425220
push dword [esp + 0x14]
and dword [esi + 0x90], 0
mov ecx, esi
push eax
push edi
call fcn.00425bea
pop edi
pop esi
ret 0xc
Function at 0x425f0d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x46817c
call fcn.00464890
sub esp, 0x24
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], esi
mov ebx, dword [esi + 0x8c]
mov edi, dword [esi + 0x88]
mov dword [ebp - 0x14], ebx
call fcn.0041f558
cmp dword [esi + 0x84], 0
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x18], eax
je 0x425f73
call fcn.0041f558
push 5
push dword [esi + 0x84]
mov ebx, dword [eax + 0xc]
push ebx
mov dword [ebp - 0x18], ebx
call dword [sym.imp.KERNEL32.DLL_FindResourceW]
test eax, eax
je 0x425f87
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_LoadResource]
mov ebx, dword [ebp - 0x14]
mov edi, eax
test edi, edi
je 0x425f83
push edi
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov ebx, eax
mov dword [ebp - 0x14], eax
test ebx, ebx
jne 0x425f8f
or eax, 0xffffffff
jmp 0x4260c9
mov ecx, esi
call fcn.00425e85
mov edi, eax
mov dword [ebp - 0x2c], edi
call fcn.004275bc
and dword [ebp - 0x28], 0
xor ebx, ebx
and dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
test edi, edi
je 0x42600b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp edi, eax
je 0x42600b
push edi
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x42600b
push ebx
push edi
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [ebp - 0x28], 1
call fcn.00425220
mov ebx, eax
mov dword [ebp - 0x20], ebx
test ebx, ebx
je 0x42600b
mov edx, dword [ebx]
mov ecx, ebx
call dword [edx + 0x150]
test eax, eax
je 0x42600b
mov ecx, ebx
call fcn.00426569
test eax, eax
je 0x42600b
push 0
mov ecx, ebx
call fcn.00426584
mov dword [ebp - 0x24], 1
and dword [ebp - 4], 0
mov ecx, esi
call fcn.0042756a
push edi
call fcn.00427102
push dword [ebp - 0x18]
mov ecx, esi
push eax
push dword [ebp - 0x14]
call fcn.00425dd4
test eax, eax
jne 0x426055
cmp dword [esi + 0x9c], eax
jne 0x426055
call fcn.0041f558
push edi
mov eax, dword [eax + 8]
mov dword [ebp - 0x18], eax
call fcn.00427102
push dword [ebp - 0x18]
mov ecx, esi
push eax
push dword [ebp - 0x14]
call fcn.00425dd4
and dword [esi + 0x9c], 0
jmp 0x426080
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x24], 0
je 0x426093
push 1
mov ecx, ebx
call fcn.00426584
cmp dword [ebp - 0x28], 0
je 0x4260a2
push 1
push edi
call dword [sym.imp.USER32.dll_EnableWindow]
test edi, edi
je 0x4260b8
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [esi + 0x20]
jne 0x4260b8
push edi
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x60]
mov ecx, esi
call fcn.00425ec4
mov eax, dword [esi + 0x68]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x427b89
Capabilities:
Get graphical window text

Disassembly:
push edi
mov edi, ecx
mov ecx, dword [edi + 0x74]
test ecx, ecx
jne 0x427bc7
push esi
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov ecx, dword [esp + 0xc]
mov esi, eax
push esi
call fcn.004256ba
lea edx, [esi + 1]
push edx
push eax
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esp + 0xc]
push 0xffffffffffffffff
call fcn.0041d266
pop esi
pop edi
ret 4
mov eax, dword [ecx]
pop edi
jmp dword [eax + 0x8c]

Function at 0x42a3b2
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
xor esi, esi
mov ebx, ecx
push edi
cmp dword [esp + 0x10], esi
je 0x42a3f0
call fcn.0041f558
push 0xf0
push dword [esp + 0x14]
mov edi, dword [eax + 0xc]
push edi
call dword [sym.imp.KERNEL32.DLL_FindResourceW]
test eax, eax
je 0x42a3f0
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_LoadResource]
test eax, eax
je 0x42a3f8
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov esi, eax
push esi
mov ecx, ebx
call fcn.0043001a
pop edi
pop esi
pop ebx
ret 4

Function at 0x42add5
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
push edi
test esi, esi
je 0x42ae56
cmp dword [esi + 0x20], 0
je 0x42ae56
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x42ae56
cmp dword [esp + 0x14], 0
je 0x42ae56
xor ebp, ebp
call fcn.0041f558
push str.AFX_DIALOG_LAYOUT
push dword [esp + 0x18]
mov edi, dword [eax + 0xc]
push edi
call dword [sym.imp.KERNEL32.DLL_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x42ae38
push ebx
push edi
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
push ebx
push edi
mov ebp, eax
call dword [sym.imp.KERNEL32.DLL_LoadResource]
test eax, eax
je 0x42ae56
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
jmp 0x42ae3a
mov eax, ebp
push ebp
mov edx, eax
mov ecx, esi
call fcn.0041ede7
mov edi, eax
pop ecx
test edi, edi
je 0x42ae52
mov ecx, esi
call fcn.0042acb2
mov eax, edi
jmp 0x42ae58
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x42bfe9
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x10]
mov ebx, ecx
mov esi, dword [edi + 0xc]
lea eax, [edi + 4]
test byte [eax], 1
jne 0x42c037
push 5
push esi
push dword [edi + 8]
call dword [sym.imp.KERNEL32.DLL_FindResourceW]
test eax, eax
je 0x42c0b9
push eax
push dword [edi + 8]
call dword [sym.imp.KERNEL32.DLL_LoadResource]
test eax, eax
je 0x42c0b9
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov esi, eax
test esi, esi
je 0x42c0b9
lea eax, [edi + 4]
mov dword [esp + 0x10], eax
call fcn.0041f558
cmp dword [eax + 0x3c], 0
je 0x42c071
mov ecx, ebx
call fcn.0042bed3
push 0x10
call fcn.00450c94
pop ecx
mov dword [ebx + 0xa0], eax
call fcn.0041f558
push esi
push dword [ebx + 0xa0]
mov ecx, dword [eax + 0x3c]
mov eax, dword [ecx]
call dword [eax + 0x14]
mov esi, eax
mov edx, dword [esp + 0x14]
mov ecx, esi
push ebp
call fcn.0042bf07
mov ebp, eax
mov eax, dword [ebx + 0x88]
test eax, eax
je 0x42c097
push eax
call dword [sym.imp.KERNEL32.DLL_GlobalFree]
and dword [ebx + 0x88], 0
test ebp, ebp
je 0x42c0a3
mov esi, ebp
mov dword [ebx + 0x88], ebp
mov eax, dword [edi + 4]
mov ecx, dword [esp + 0x14]
or eax, 1
pop ebp
mov dword [edi + 0xc], esi
pop edi
pop esi
mov dword [ecx], eax
pop ebx
ret 8
call fcn.00423ec3
int3
Function at 0x430f75
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x737040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x18], eax
mov eax, dword [0x738590]
mov dword [ebp - 0x20], ebx
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x1c], edi
test eax, eax
jne 0x430fce
push 0x72b09c
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
test eax, eax
je 0x430ff3
push str.GetThreadPreferredUILanguages
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.DLL_EncodePointer]
mov dword [0x738590], eax
jmp 0x430fd7
push eax
call dword [sym.imp.KERNEL32.DLL_DecodePointer]
mov esi, eax
test esi, esi
je 0x430ff3
mov eax, dword [ebp - 0x18]
mov ecx, esi
push eax
push edi
push ebx
push dword [ebp + 8]
call dword [0x469664]
call esi
jmp 0x431135
and dword [ebx], 0
call dword [sym.imp.KERNEL32.DLL_GetUserDefaultUILanguage]
movzx ebx, ax
lea eax, [ebp - 0x14]
push 7
push eax
push ebx
call fcn.004312d9
lea eax, [ebp - 0x14]
push eax
call fcn.0043e370
mov esi, eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push dword [eax]
push edi
call fcn.00450aa1
mov eax, dword [ebp - 0x20]
lea edi, [esi + 1]
push 7
and ebx, 0x3ff
inc dword [eax]
lea eax, [ebp - 0x14]
push eax
push ebx
call fcn.004312d9
lea eax, [ebp - 0x14]
push eax
call fcn.0043e370
lea esi, [eax + 1]
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
sub ecx, edi
push ecx
mov ecx, dword [ebp - 0x1c]
lea ecx, [ecx + edi*2]
push ecx
call fcn.00450aa1
mov eax, dword [ebp - 0x20]
add esp, 0x38
add edi, esi
inc dword [eax]
call dword [sym.imp.KERNEL32.DLL_GetSystemDefaultUILanguage]
movzx ebx, ax
lea eax, [ebp - 0x14]
push 7
push eax
push ebx
call fcn.004312d9
lea eax, [ebp - 0x14]
push eax
call fcn.0043e370
lea esi, [eax + 1]
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x1c]
sub ecx, edi
push ecx
lea ecx, [eax + edi*2]
push ecx
call fcn.00450aa1
mov eax, dword [ebp - 0x20]
add edi, esi
push 7
and ebx, 0x3ff
inc dword [eax]
lea eax, [ebp - 0x14]
push eax
push ebx
call fcn.004312d9
lea eax, [ebp - 0x14]
push eax
call fcn.0043e370
lea esi, [eax + 1]
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x1c]
sub ecx, edi
push ecx
lea ecx, [eax + edi*2]
push ecx
call fcn.00450aa1
mov ebx, dword [ebp - 0x20]
lea eax, [ebp - 0x14]
push 7
push eax
add edi, esi
inc dword [ebx]
push 0x800
call fcn.004312d9
add esp, 0x44
lea eax, [ebp - 0x14]
push eax
call fcn.0043e370
mov esi, eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x1c]
sub ecx, edi
push ecx
lea ecx, [eax + edi*2]
push ecx
call fcn.00450aa1
mov ecx, dword [ebp - 0x1c]
lea eax, [edi + esi]
add esp, 0x10
xor edx, edx
inc dword [ebx]
mov word [ecx + eax*2 + 2], dx
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00431aaa
leave
ret
Function at 0x431fdb
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
test eax, eax
je 0x43201a
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x43201a
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x43201a
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x43201a
cmp dword [ecx + 0x74], 0xe
jbe 0x43201a
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret