joyce8/EMBER2024-capa huggingface dataset:
Function at 0x433010
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
movzx eax, byte [ebp + 0x38]
test eax, eax
je 0x433070
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x34]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x30]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 8], eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
push eax
push 1
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
call fcn.00433174
add esp, 0x20
jmp 0x433170
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x28], eax
lea eax, [ebp + 0x2c]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x2c], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x3c]
mov dword [ebp - 0x34], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x433134
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test eax, eax
je 0x433111
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x4330f2
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x43310f
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x4c]
call fcn.00434a1c
mov dword [eax], 0x3acdd711
jmp 0x4330e7
jmp 0x433132
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x58]
movzx eax, byte [eax]
test eax, eax
je 0x433132
push 0x14ab
call dword [sym.imp.USER32.dll_GetSysColorBrush]
jmp 0x433170
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x60]
movzx eax, byte [eax]
test eax, eax
je 0x433150
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
jmp 0x433170
push 0
push 0x270f
push 0x1418
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
mov esp, ebp
pop ebp
ret
Function at 0x43b395
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x43b40a
mov eax, dword [ebp + 0x30]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x34]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x43b3e9
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push 0
call fcn.0043dc04
add esp, 0xc
jmp 0x43b405
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
push 0
push dword [ebp - 0x20]
push dword [ebp - 0x24]
call fcn.0043bac5
add esp, 0xc
jmp 0x43b4df
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x4c], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x50], eax
lea eax, [ebp + 0x38]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x43b47c
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x43b46b
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [eax], 9
jmp 0x43b47a
push 0
push 0x21ec
push 0
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
jmp 0x43b4df
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x60], eax
push 0
push 0x4745
push 1
push 1
push 0x1fc0
push dword [ebp - 0x54]
push 0x7a9c
push dword [ebp - 0x58]
push 0x6b5
push 0x30fa
push 0x7da4
push dword [ebp - 0x5c]
push 0x3070
push 1
push 1
push 0x39b3
push 0x7875
push dword [ebp - 0x60]
call fcn.00440d49
add esp, 0x48
mov esp, ebp
pop ebp
ret
Function at 0x43ef32
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
movzx eax, byte [ebp + 8]
test eax, eax
je 0x43f00f
lea eax, [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x43ef90
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
push 0x6661
push 1
push 0x8c9
push 0x6d1b
push dword [ebp - 0x10]
call fcn.0043f030
add esp, 0x14
jmp 0x43f00d
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x43efc2
push 0x218a
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x43f00d
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x43eff0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x43f00d
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x34]
call fcn.00434a1c
mov dword [eax], 0x3acdd711
jmp 0x43efe5
jmp 0x43f02c
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x38], eax
push dword [ebp - 0x38]
push 0x7068
push 0x563b
push 1
call fcn.0043c8e5
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x4424eb
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
movzx eax, byte [ebp + 0x28]
test eax, eax
je 0x442597
lea eax, [ebp + 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x44254d
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
push dword [ebp - 0x18]
push 0x2ed7
push dword [ebp - 0x1c]
push 1
push 0x4995
call fcn.00442642
add esp, 0x14
jmp 0x442592
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
push 0x1c19
push 1
push 1
push 0x4b79
push 1
push dword [ebp - 0x28]
push 0x36e2
push 0x3c18
push dword [ebp - 0x2c]
push 0
push 0x6589
push 0x3a9f
push 0x752
call fcn.00453988
add esp, 0x34
jmp 0x44263e
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x3c], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0x30], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x4425c3
push 1
call fcn.00442168
pop ecx
jmp 0x44263e
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x40]
movzx eax, byte [eax]
test eax, eax
je 0x44262c
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x44260d
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 1
jge 0x44262a
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x54]
call fcn.00434a1c
mov dword [eax], 0x49fe
jmp 0x442602
jmp 0x44263e
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x44263e
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov esp, ebp
pop ebp
ret
Function at 0x444fdf
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x4450cb
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x34], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x44509c
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x445088
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x445069
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 3
jge 0x445086
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x2c]
call fcn.00434a1c
mov dword [eax], 0x962e
jmp 0x44505e
jmp 0x44509a
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
jmp 0x4450c9
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
push dword [ebp - 0x38]
push dword [ebp - 0x3c]
push 1
push 0x3aec
push 0x7cbe
push 0x6491
push 1
call fcn.00443b85
add esp, 0x1c
jmp 0x4450d3
push 1
call fcn.0043dbe6
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x4471f0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x44723d
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
push dword [ebp - 0xc]
push 0x6256
push 0x3291
push 0xac2
push dword [ebp - 0x10]
push 1
push 0x1033
push 0x5dc5
push 0x3ac1
call fcn.004472f8
add esp, 0x24
jmp 0x4472f4
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x4472e2
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x447295
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x447293
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
jmp 0x4472e0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x4472c3
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 4
jge 0x4472e0
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x38]
call fcn.00434a1c
mov dword [eax], 1
jmp 0x4472b8
jmp 0x4472f4
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
push 0
push dword [ebp - 0x40]
call fcn.0043e993
pop ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x4488da
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x4489ae
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x448994
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x448983
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x448944
mov eax, dword [ebp - 4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 0xffffffff
je 0x448981
push 1
push 0x1eef
push 0x94f
push 1
push 0x2631
push 0x249b
push 0x16fa
push 0x23fd
push 0
push 1
push 0x755
call fcn.0043eb75
add esp, 0x2c
jmp 0x448939
jmp 0x448992
push 0
push 0x21ec
push 0
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
jmp 0x4489ac
push 0x2a80
push 0x1554
push 0
push 0
push 1
call fcn.0045a0b8
add esp, 0x14
jmp 0x4489c6
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
push 0x11a
push dword [ebp - 0x20]
push 1
call fcn.0043b012
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x44fa60
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x44fb79
lea eax, [ebp + 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x44fb2c
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x44fb13
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x44fb11
push 0x6c1c
push 0x4dff
push 0x7f8
push 0x2d0a
push 0x2346
push 0x467a
push 0x3f41
push 0x454f
push 0x12d2
push 1
push 0
push 0
call fcn.00449ca9
add esp, 0x30
jmp 0x44fb2a
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
jmp 0x44fb74
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x44], eax
push 0x441
push 0x5f4a
push 0x4ff5
push dword [ebp - 0x40]
push 0x3c1b
push dword [ebp - 0x44]
push 1
push 0x6fc6
push 0x3d3f
push 0x7689
push 0
push 0
push 0x5b00
call fcn.0045c0c5
add esp, 0x34
jmp 0x44fc2e
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x54], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x50], eax
lea eax, [ebp + 0x2c]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x48]
movzx eax, byte [eax]
test eax, eax
je 0x44fbb1
push 1
push 0x627f
push 0xe1c
call fcn.004498e7
add esp, 0xc
jmp 0x44fc2e
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x58]
movzx eax, byte [eax]
test eax, eax
je 0x44fc1a
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x64]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x44fbfb
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 4
jge 0x44fc18
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x6c]
call fcn.00434a1c
mov dword [eax], 0x20f8
jmp 0x44fbf0
jmp 0x44fc2e
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x44fc2e
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov esp, ebp
pop ebp
ret
Function at 0x45094a
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
movzx eax, byte [ebp + 0x2c]
test eax, eax
je 0x4509b0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x40]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x3c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 8], eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push 0xec
push 1
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push 0x9cd
call fcn.00450afd
add esp, 0x28
jmp 0x450af9
lea eax, [ebp + 0x28]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x34], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp + 0x38]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x2c], eax
lea eax, [ebp + 0x34]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x450a84
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test eax, eax
je 0x450a3a
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
movzx eax, byte [eax]
test eax, eax
je 0x450a38
push 1
push 0x1087
push 1
push 1
push 0x528d
call fcn.00439b34
add esp, 0x14
jmp 0x450a82
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x450a68
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 1
jge 0x450a82
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x58]
call fcn.00434a1c
and dword [eax], 0
jmp 0x450a5d
jmp 0x450af9
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x64]
movzx eax, byte [eax]
test eax, eax
je 0x450aef
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x70]
movzx eax, byte [eax]
test eax, eax
je 0x450aed
push 1
push 0x149f
push 0x45
push 0
push 0xf7d
push 0x67e5
push 0x1930
push 1
push 0x26bb
push 0x5f55
push 0x66e0
push 0x33e2
push 0x2f7
call fcn.0043d1a7
add esp, 0x34
jmp 0x450af9
push 0
push 0
call dword [sym.imp.USER32.dll_EnumWindows]
mov esp, ebp
pop ebp
ret
Function at 0x451792
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
movzx eax, byte [ebp + 0x28]
test eax, eax
je 0x451858
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x451831
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x451827
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x14], 0x483bbb66
push 0x1c06
lea eax, [ebp - 0x14]
push eax
push 0x7699
push 0x6a0c
push 0x2c72
lea eax, [ebp - 0x18]
push eax
push 0x7045
push 0x3e79
push 0x16a6
push 1
push 0x568e
push 0x17ee
push 0x42dd
push 1
push 1
push 0xe70
call fcn.00441eac
add esp, 0x40
jmp 0x45182f
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jmp 0x451853
push 0x5cfd
push 0
push 0
push 1
push 0x676
push 0x25ea
push 0x7dac
call fcn.00441daa
add esp, 0x1c
jmp 0x45193d
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x2c], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x451910
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x4518f9
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x4518da
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 4
jge 0x4518f7
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x44]
call fcn.00434a1c
mov dword [eax], 8
jmp 0x4518cf
jmp 0x45190e
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
mov dword [eax], 0xffffffff
jmp 0x45193d
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x58], eax
push 0x2ce0
push 0x9ec
push 1
push 0x3ced
push 1
push 1
push 0x524
push 1
push dword [ebp - 0x58]
call fcn.00445100
add esp, 0x24
mov esp, ebp
pop ebp
ret