joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d720
Capabilities:
Get file system object information

Disassembly:
mov eax, dword [esp + 0x10]
sub esp, 0x6b4
test eax, eax
push ebp
je 0x40d742
mov eax, dword [eax]
test eax, eax
jge 0x40d8b6
cmp eax, 0xfffffffe
je 0x40d8b6
mov ebp, dword [esp + 0x6c0]
test ebp, ebp
jne 0x40d759
xor al, al
pop ebp
add esp, 0x6b4
ret 0x14
mov eax, dword [esp + 0x6bc]
test eax, eax
jne 0x40d770
xor al, al
pop ebp
add esp, 0x6b4
ret 0x14
push ebx
push esi
push edi
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x2c6]
mov word [esp + 0x2c4], 0
push ebp
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
mov esi, eax
mov ebx, 0x4010
test esi, esi
je 0x40d7f5
push str..lnk
push esi
call fcn.00432f95
add esp, 8
test eax, eax
je 0x40d7f0
push str..url
push esi
call fcn.00432f95
add esp, 8
test eax, eax
je 0x40d7f0
push str..exe
push esi
call fcn.00432f95
add esp, 8
test eax, eax
je 0x40d7e9
push str..scr
push esi
call fcn.00432f95
add esp, 8
test eax, eax
jne 0x40d7f5
mov ebx, 0x4000
jmp 0x40d7f5
mov ebx, 0x4140
test bl, 0x10
je 0x40d7fe
mov edx, ebp
jmp 0x40d82c
mov eax, dword [esp + 0x6c8]
lea ecx, [esp + 0x2c4]
push eax
push ecx
call fcn.004330d3
add esp, 8
lea edx, [esp + 0x2c4]
push ebp
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea edx, [esp + 0x2c4]
mov ecx, 0xac
xor eax, eax
lea edi, [esp + 0x14]
mov dword [esp + 0x10], 0
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x6d0]
push ebx
and cl, 0x10
lea eax, [esp + 0x14]
neg cl
sbb ecx, ecx
push 0x2b4
and ecx, 0xffffff90
push eax
add ecx, 0x80
push ecx
push edx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebx
test eax, eax
je 0x40d87d
push eax
call dword [sym.imp.USER32.dll_DestroyIcon]
mov eax, dword [esp + 0x6c8]
test eax, eax
je 0x40d894
mov edx, dword [esp + 8]
and edx, 0xffffff
mov dword [eax], edx
mov ecx, dword [esp + 0x6cc]
test ecx, ecx
je 0x40d8a7
xor edx, edx
mov dl, byte [esp + 0xb]
mov dword [ecx], edx
test eax, eax
je 0x40d8b6
cmp dword [eax], 0
jge 0x40d8b6
mov dword [eax], 0xfffffffe
mov al, 1
pop ebp
add esp, 0x6b4
ret 0x14

Function at 0x40da80
Capabilities:
Read .ini file

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
push edi
push str..url
mov ebp, ecx
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
push eax
call fcn.00432f95
add esp, 8
test eax, eax
je 0x40daad
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret 8
mov esi, dword [esp + 0x18]
mov ecx, 0xc0
xor eax, eax
mov edi, esi
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea edi, [esi + 2]
push ebx
push 0x7f
push edi
push 0x4681a0
push 0x462e44
push str.InternetShortcut
mov byte [esi], 2
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
jne 0x40daeb
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret 8
cmp word [edi], 0
jne 0x40dafb
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret 8
push 0
push 0x302
push esi
mov ecx, ebp
call fcn.0040d130
pop edi
pop esi
pop ebp
pop ebx
ret 8
Function at 0x40f5e0
Capabilities:
Create thread

Disassembly:
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 0x60]
test eax, eax
je 0x40f5f0
mov al, 1
pop esi
pop ecx
ret
lea eax, [esp + 4]
mov byte [esi + 0x5d], 0
push eax
push 0
push esi
push 0x40f480
push 0
push 0
mov byte [esi + 0x5c], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
xor ecx, ecx
mov dword [esi + 0x60], eax
test eax, eax
setne cl
mov al, cl
pop esi
pop ecx
ret

Function at 0x40f620
Capabilities:
Terminate thread

Disassembly:
push edi
mov edi, ecx
mov eax, dword [edi + 0x60]
test eax, eax
je 0x40f662
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push esi
mov byte [edi + 0x5d], 1
xor esi, esi
mov eax, dword [edi + 0x60]
test eax, eax
je 0x40f649
push 0x64
call ebx
inc esi
cmp esi, 0x32
jl 0x40f638
mov eax, dword [edi + 0x60]
pop esi
test eax, eax
pop ebx
je 0x40f662
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [edi + 0x60], 0
mov al, 1
pop edi
ret

Function at 0x40fbd0
Capabilities:
Get file size

Disassembly:
mov eax, dword [ecx]
xor ecx, ecx
sub esp, 8
cmp eax, ecx
jne 0x40fbe3
xor eax, eax
xor edx, edx
add esp, 8
ret
mov dword [esp], ecx
mov dword [esp + 4], ecx
lea ecx, [esp + 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, dword [esp + 4]
add esp, 8
ret
Function at 0x411b30
Capabilities:
Get file system object information

Disassembly:
sub esp, 0x2bc
mov eax, dword [esp + 0x2c0]
push ebx
push ebp
push esi
push edi
mov edi, ecx
push eax
mov dword [esp + 0x18], edi
call fcn.0040df40
mov ebx, edx
mov ebp, eax
test ebx, ebx
jg 0x411b63
jl 0x411cec
test ebp, ebp
jb 0x411cec
push ebx
push ebp
mov ecx, edi
call fcn.0040df60
mov esi, eax
test esi, esi
je 0x411cec
mov al, byte [edi + 0x2098]
test al, al
jne 0x411cec
lea eax, [esi + 0x2c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
test eax, eax
mov dword [esp + 0x10], eax
je 0x411bca
push str..lnk
push eax
call fcn.00432f95
add esp, 8
test eax, eax
je 0x411cb2
mov ecx, dword [esp + 0x10]
push str..url
push ecx
call fcn.00432f95
add esp, 8
test eax, eax
je 0x411cb2
mov eax, dword [esp + 0x10]
push str..exe
push eax
call fcn.00432f95
add esp, 8
test eax, eax
je 0x411cb2
mov edx, dword [esp + 0x10]
push str..scr
push edx
call fcn.00432f95
add esp, 8
test eax, eax
je 0x411cb2
mov ecx, 0xac
xor eax, eax
lea edi, [esp + 0x1c]
mov dword [esp + 0x18], 0
rep stosd dword es:[edi], eax
mov ecx, dword [esi]
push 0x4410
and cl, 0x10
lea eax, [esp + 0x1c]
neg cl
sbb ecx, ecx
push 0x2b4
and ecx, 0xffffff90
push eax
add ecx, 0x80
lea eax, [esi + 0x2c]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov eax, dword [esp + 0x18]
test eax, eax
je 0x411c4a
push eax
call dword [sym.imp.USER32.dll_DestroyIcon]
or ecx, 0xffffffff
mov dword [esi + 0x474], ecx
mov eax, dword [esp + 0x1c]
and eax, 0xffffff
cmp eax, ecx
mov dword [esi + 0x46c], eax
jne 0x411c70
mov dword [esi + 0x46c], 0xfffffffe
mov eax, dword [esi]
xor edx, edx
mov dl, byte [esp + 0x1f]
push eax
mov eax, dword [esp + 0x18]
mov dword [esi + 0x470], edx
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x230]
push ecx
push edx
lea ecx, [eax + 0xc88]
call fcn.0040d3e0
mov dword [esi + 0x468], eax
pop edi
mov eax, ebp
pop esi
mov edx, ebx
pop ebp
pop ebx
add esp, 0x2bc
ret 4
mov ecx, dword [esi]
mov edx, dword [esp + 0x10]
push ecx
push edx
lea ecx, [edi + 0xc88]
call fcn.0040d480
or ecx, 0xffffffff
push 0
push ecx
push 0
mov dword [esi + 0x474], ecx
mov dword [esi + 0x46c], ecx
push ebx
push ebp
lea ecx, [edi + 0xcc8]
mov dword [esi + 0x468], eax
call fcn.0040f6f0
pop edi
mov eax, ebp
pop esi
mov edx, ebx
pop ebp
pop ebx
add esp, 0x2bc
ret 4
Function at 0x416700
Capabilities:
Check if file exists

Disassembly:
mov eax, dword [esp + 8]
sub esp, 8
push esi
mov esi, ecx
mov ecx, dword [esp + 0x18]
mov byte [eax], 0
mov eax, dword [esp + 0x10]
test eax, eax
mov byte [ecx], 0
jne 0x416725
xor al, al
pop esi
add esp, 8
ret 0xc
push ebx
push ebp
push edi
push 0
push 0x4681a0
mov ecx, esi
mov byte [esp + 0x1b], 0
call fcn.00401630
mov ebx, eax
test ebx, ebx
je 0x41675d
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41675d
push ebx
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
setne al
inc eax
mov byte [esp + 0x13], al
push 0
push 0x463540
mov ecx, esi
call fcn.00401630
mov edi, eax
test edi, edi
jne 0x41677e
test ebx, ebx
je 0x41677e
cmp byte [esp + 0x13], 1
jne 0x41677e
mov edi, ebx
push 0
push 0x463538
mov ecx, esi
call fcn.00401630
push 0
push str.DelayDoNow
mov ecx, esi
mov ebp, eax
call fcn.00401630
push 0
push str.Quit
mov ecx, esi
mov dword [esp + 0x1c], eax
call fcn.00401630
test edi, edi
mov esi, eax
je 0x4167ca
cmp word [edi], 0
je 0x4167ca
push 0
push edi
mov edi, dword [esp + 0x24]
mov ecx, edi
call fcn.00413290
jmp 0x4167ce
mov edi, dword [esp + 0x1c]
cmp byte [esp + 0x13], 2
jne 0x4167f2
push 0x1ff
push ebx
mov ecx, edi
call fcn.00411ea0
mov ecx, eax
call fcn.0040f2e0
push eax
call fcn.00432ab0
add esp, 0xc
xor al, al
test ebp, ebp
je 0x416821
cmp word [ebp], 0
je 0x416821
push 0
push 0
push 0
mov ecx, edi
call fcn.004118e0
cmp word [ebp], 0
je 0x416821
test al, al
je 0x416821
push 0
push ebp
mov ecx, edi
call fcn.00411ee0
test esi, esi
je 0x41682c
mov edx, dword [esp + 0x20]
mov byte [edx], 1
test ebp, ebp
je 0x41683e
cmp word [ebp], 0
je 0x41683e
mov eax, dword [esp + 0x20]
mov byte [eax], 1
mov eax, dword [esp + 0x14]
pop edi
pop ebp
pop ebx
test eax, eax
je 0x416850
mov ecx, dword [esp + 0x18]
mov byte [ecx], 1
mov al, 1
pop esi
add esp, 8
ret 0xc
Function at 0x4169a0
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x210
push ebp
mov ebp, dword [esp + 0x21c]
test ebp, ebp
mov dword [esp + 8], ecx
jne 0x4169c2
xor al, al
pop ebp
add esp, 0x210
ret 8
cmp word [ebp], 0
jne 0x4169d5
xor al, al
pop ebp
add esp, 0x210
ret 8
mov ecx, dword [esp + 0x218]
lea eax, [esp + 4]
push eax
push ebp
push ecx
mov dword [esp + 0x10], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x416a01
xor al, al
pop ebp
add esp, 0x210
ret 8
push esi
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x16]
mov word [esp + 0x14], 0
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea edx, [esp + 0x14]
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0x14]
push 0x104
push edx
rep stosd dword es:[edi], eax
push eax
mov eax, dword [esp + 0x18]
push eax
call esi
cmp eax, 0x103
je 0x416a60
test eax, eax
jne 0x416a1f
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x14]
push edx
call fcn.004169a0
test al, al
jne 0x416a1f
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x220]
push ebp
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
pop edi
pop esi
sete al
pop ebp
add esp, 0x210
ret 8

Function at 0x416e28
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x108
xor eax, eax
push esi
mov esi, ecx
push edi
mov ecx, 0x82
mov edi, esi
push 0x104
push esi
push eax
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x416e51
pop edi
pop esi
add esp, 0x108
ret 4
mov ecx, 0x31
xor eax, eax
lea edi, [esp + 0x4a]
mov word [esp + 0x48], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [esp + 0x114]
lea ecx, [esp + 0x48]
push eax
push str.__Shell_d
push ecx
call fcn.004330f8
mov ecx, 0xe
xor eax, eax
lea edi, [esp + 0x1c]
add esp, 0xc
rep stosd dword es:[edi], eax
mov dword [esp + 0x28], eax
lea eax, [esp + 0xc]
lea edx, [esp + 0x48]
push eax
mov dword [esp + 0x10], 0x3c
mov dword [esp + 0x14], 0x40
mov dword [esp + 0x1c], str.runas
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], edx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x416ed0
pop edi
pop esi
add esp, 0x108
ret 4
mov eax, dword [esp + 0x44]
test eax, eax
jne 0x416ee3
pop edi
pop esi
add esp, 0x108
ret 4
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [esp + 0x44]
lea ecx, [esp + 8]
push ecx
push edx
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, dword [esp + 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 8]
pop edi
pop esi
add esp, 0x108
ret 4
Function at 0x418514
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [esp + 8]
push esi
mov esi, ecx
push edi
mov dword [esi + 8], eax
mov al, byte [esp + 0xc]
test al, al
mov dword [esi], 0x453ecc
mov dword [esi + 4], 1
je 0x418558
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 1
call edi
test ax, ax
jge 0x418548
mov dword [esi + 8], 1
jmp 0x418558
push 2
call edi
test ax, ax
jge 0x418558
mov dword [esi + 8], 2
mov eax, dword [esi + 8]
cmp eax, 1
jne 0x41856e
mov dword [esi + 0xc], 0x12
mov eax, esi
pop edi
pop esi
ret 8
cmp eax, 2
jne 0x418581
mov dword [esi + 0xc], 0x11
mov eax, esi
pop edi
pop esi
ret 8
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov eax, esi
pop edi
pop esi
ret 8
Function at 0x4195b0
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x451337
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov eax, dword [esp + 0x24]
push ebx
xor ebx, ebx
push esi
cmp eax, ebx
mov esi, ecx
mov dword [esp + 0x10], ebx
jne 0x4195ef
mov esi, dword [esp + 0x28]
push 0x4681a0
mov ecx, esi
call fcn.00444b90
jmp 0x41972d
cmp word [eax], bx
jne 0x419609
mov esi, dword [esp + 0x28]
push 0x4681a0
mov ecx, esi
call fcn.00444b90
jmp 0x41972d
push eax
lea ecx, [esp + 0x30]
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebx
call fcn.00444b90
push str._shellopencommand
lea ecx, [esp + 0x30]
mov dword [esp + 0x24], 1
call fcn.00444f0d
mov ecx, dword [esp + 0x2c]
lea eax, [esp + 8]
push eax
push 0x20019
push ebx
push ecx
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x419708
lea edx, [esp + 0xc]
push edi
push edx
push 0x105
lea ecx, [esp + 0x38]
mov dword [esp + 0x18], 0x208
call fcn.00444f4c
push eax
mov eax, dword [esp + 0x14]
push ebx
push ebx
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [esp + 0xc]
mov edi, eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0xffffffffffffffff
lea ecx, [esp + 0x34]
call fcn.00444f9c
cmp edi, ebx
pop edi
jne 0x419708
mov edx, dword [esp + 0x2c]
push ebx
push 1
lea eax, [esp + 0x1c]
push edx
push eax
mov ecx, esi
call fcn.00418ca0
push eax
lea ecx, [esp + 0x30]
mov byte [esp + 0x24], 2
call fcn.00444c63
lea ecx, [esp + 0x14]
mov byte [esp + 0x20], 1
call fcn.00444b1c
mov ecx, dword [esp + 0x2c]
lea edx, [esp + 0x14]
push ecx
push edx
mov ecx, esi
call fcn.00419100
mov eax, dword [eax]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea ecx, [esp + 0x14]
mov esi, eax
call fcn.00444b1c
cmp esi, ebx
je 0x419708
mov esi, dword [esp + 0x28]
lea eax, [esp + 0x2c]
push eax
mov ecx, esi
call fcn.00444889
jmp 0x419718
mov esi, dword [esp + 0x28]
push 0x4681a0
mov ecx, esi
call fcn.00444b90
lea ecx, [esp + 0x2c]
mov dword [esp + 0x10], 1
mov byte [esp + 0x20], bl
call fcn.00444b1c
mov ecx, dword [esp + 0x18]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 8
Function at 0x41a0c0
Capabilities:
Create process on windows

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x451400
push eax
mov dword fs:[0], esp
sub esp, 0x54
push ebx
push esi
push edi
mov edi, dword [esp + 0x74]
xor ebx, ebx
mov esi, ecx
cmp edi, ebx
je 0x41a1ca
mov eax, dword [esp + 0x70]
lea ecx, [esi + 4]
cdq
push edx
push eax
call fcn.0040df60
cmp eax, ebx
je 0x41a1ca
cmp word [eax], bx
je 0x41a1ca
push edi
push 1
push eax
lea eax, [esp + 0x7c]
push eax
mov ecx, esi
call fcn.00418ca0
mov ecx, dword [esp + 0x70]
mov dword [esp + 0x68], ebx
cmp dword [ecx - 8], ebx
jle 0x41a1b9
push edi
lea ecx, [esp + 0x78]
call fcn.00444b90
mov edx, dword [esp + 0x74]
mov byte [esp + 0x68], 1
push edx
call fcn.00432a93
add esp, 4
inc eax
lea ecx, [esp + 0x74]
push eax
call fcn.00444f4c
cmp eax, ebx
je 0x41a1ac
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0xffffffffffffffff
lea ecx, [esp + 0x78]
call fcn.00444f9c
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x20]
mov dword [esp + 0xc], ebx
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x74]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
push ecx
mov dword [esp + 0x20], 0x44
mov dword [esp + 0x1c], eax
call fcn.00432a93
add esp, 4
add eax, 0xa
lea ecx, [esp + 0x70]
push eax
call fcn.00444f4c
cmp eax, ebx
jne 0x41a1e0
lea ecx, [esp + 0x74]
mov byte [esp + 0x68], bl
call fcn.00444b1c
lea ecx, [esp + 0x70]
mov dword [esp + 0x68], 0xffffffff
call fcn.00444b1c
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [esp + 0x54]
mov dword fs:[0], ecx
add esp, 0x60
ret 8
lea edx, [esp + 0xc]
lea ecx, [esp + 0x1c]
push edx
mov edx, dword [esp + 0x78]
push ecx
push edx
push ebx
push ebx
push ebx
push ebx
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x41a21c
mov eax, dword [esp + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, ebx
je 0x41a211
push eax
call esi
mov eax, dword [esp + 0xc]
cmp eax, ebx
je 0x41a21c
push eax
call esi
push 0xffffffffffffffff
lea ecx, [esp + 0x74]
call fcn.00444f9c
lea ecx, [esp + 0x74]
mov byte [esp + 0x68], bl
call fcn.00444b1c
lea ecx, [esp + 0x70]
mov dword [esp + 0x68], 0xffffffff
call fcn.00444b1c
mov ecx, dword [esp + 0x60]
pop edi
pop esi
mov al, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x60
ret 8
Function at 0x41ae00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x268
push ebx
mov ebx, ecx
push ebp
push esi
mov eax, dword [ebx + 0x1c]
push edi
push eax
call dword [sym.imp.USER32.dll_GetMenu]
push eax
call fcn.004497cd
mov dword [esp + 0x14], eax
call dword [sym.imp.USER32.dll_CreatePopupMenu]
push eax
lea ecx, [ebx + 0xb94]
call fcn.00449800
xor edx, edx
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x7a]
mov word [esp + 0x78], dx
mov word [esp + 0x178], dx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0xb
xor eax, eax
lea edi, [esp + 0x1c]
mov dword [esp + 0x10], edx
rep stosd dword es:[edi], eax
mov ecx, 0xb
lea edi, [esp + 0x4c]
rep stosd dword es:[edi], eax
mov ecx, 0x3f
lea edi, [esp + 0x17a]
rep stosd dword es:[edi], eax
mov dword [esp + 0x18], 0x30
mov dword [esp + 0x1c], 0x16
stosw word es:[edi], ax
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
push ecx
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.USER32.dll_GetSubMenu]
push eax
call fcn.004497cd
mov edi, eax
mov ecx, dword [edi + 4]
push ecx
call dword [sym.imp.USER32.dll_GetMenuItemCount]
mov ebp, eax
xor esi, esi
test ebp, ebp
jle 0x41af5b
lea edx, [esp + 0x78]
lea eax, [esp + 0x18]
mov dword [esp + 0x40], 0x80
mov dword [esp + 0x3c], edx
mov ecx, dword [edi + 4]
push eax
push 1
push esi
push ecx
call dword [sym.imp.USER32.dll_GetMenuItemInfoW]
test eax, eax
je 0x41af23
mov ecx, dword [esp + 0x28]
cmp ecx, 0x84d5
je 0x41af2a
cmp ecx, 0x84e8
je 0x41af5b
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x3c]
test eax, eax
push edx
je 0x41af10
push eax
mov eax, dword [ebx + 0xb98]
push 0x10
push eax
jmp 0x41af1d
mov eax, dword [esp + 0x24]
push ecx
mov ecx, dword [ebx + 0xb98]
push eax
push ecx
call dword [sym.imp.USER32.dll_AppendMenuW]
inc esi
cmp esi, ebp
jl 0x41aebd
jmp 0x41af5b
mov ecx, 0xc
lea esi, [esp + 0x18]
lea edi, [esp + 0x48]
lea eax, [esp + 0x78]
rep movsd dword es:[edi], dword [esi]
push 0x7f
lea ecx, [esp + 0x17c]
lea edx, [esp + 0x17c]
push eax
push ecx
mov dword [esp + 0x78], edx
call fcn.00432ab0
add esp, 0xc
mov eax, dword [esp + 0x10]
inc eax
cmp eax, 2
mov dword [esp + 0x10], eax
jl 0x41ae8c
cmp dword [esp + 0x58], 0x84d5
jne 0x41afe7
mov edx, dword [ebx + 0xb98]
push edx
call dword [sym.imp.USER32.dll_GetMenuItemCount]
dec eax
push 0x400
push eax
mov eax, dword [ebx + 0xb98]
push eax
call dword [sym.imp.USER32.dll_GetMenuState]
test ah, 8
jne 0x41afb7
mov ecx, dword [ebx + 0xb98]
mov esi, dword [sym.imp.USER32.dll_AppendMenuW]
push 0
push 0
push 0x800
push ecx
call esi
jmp 0x41afbd
mov esi, dword [sym.imp.USER32.dll_AppendMenuW]
mov eax, dword [esp + 0x5c]
test eax, eax
je 0x41afcf
mov edx, dword [esp + 0x6c]
push edx
push eax
push 0x10
jmp 0x41afde
mov ecx, dword [esp + 0x6c]
mov edx, dword [esp + 0x50]
push ecx
push 0x84d5
push edx
mov eax, dword [ebx + 0xb98]
push eax
call esi
mov ecx, dword [ebx + 0xb98]
push 0
push 0x84d0
push ecx
call dword [sym.imp.USER32.dll_SetMenuDefaultItem]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x268
ret
Function at 0x41bfa0
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x414
push ebx
push esi
mov esi, dword [esp + 0x420]
mov ebx, ecx
test esi, esi
push edi
mov dword [esp + 0x10], ebx
jne 0x41bfc8
pop edi
pop esi
xor al, al
pop ebx
add esp, 0x414
ret 4
push esi
call dword [sym.imp.KERNEL32.dll_GlobalSize]
cmp eax, 0x14
ja 0x41bfe2
pop edi
pop esi
xor al, al
pop ebx
add esp, 0x414
ret 4
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edi, eax
test edi, edi
jne 0x41bffd
pop edi
pop esi
xor al, al
pop ebx
add esp, 0x414
ret 4
cmp dword [edi], 0x14
je 0x41c017
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
pop edi
pop esi
xor al, al
pop ebx
add esp, 0x414
ret 4
mov eax, dword [edi + 0x10]
test eax, eax
jne 0x41c033
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
pop edi
pop esi
xor al, al
pop ebx
add esp, 0x414
ret 4
call fcn.0044d486
mov esi, dword [edi]
mov ecx, dword [ebx + 0x248c]
mov eax, dword [eax + 4]
push 0
push 0
add esi, edi
push 0x1004
push ecx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x1c], esi
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [esp + 0x14], eax
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x22]
mov word [esp + 0x20], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
cmp word [esi], 0
je 0x41c1ae
push ebp
jmp 0x41c08c
mov esi, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
test eax, eax
mov dword [esp + 0x1c], eax
je 0x41c192
cmp word [eax], 0
je 0x41c192
mov eax, dword [esp + 0x18]
xor ebp, ebp
test eax, eax
jle 0x41c192
add ebx, 0x2470
mov ecx, 0x100
xor eax, eax
lea edi, [esp + 0x24]
lea edx, [esp + 0x24]
push 0x200
push edx
rep stosd dword es:[edi], eax
push eax
push ebp
mov ecx, ebx
call fcn.00443c0d
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x24]
push eax
push ecx
call fcn.00432f95
add esp, 8
test eax, eax
jne 0x41c15f
push ebp
mov ecx, ebx
call fcn.00443c52
mov edx, dword [esp + 0x20]
push 0
push eax
lea ecx, [edx + 0x110]
call fcn.00411d00
mov esi, eax
test esi, esi
je 0x41c15b
lea eax, [esi + 0x250]
lea ecx, [esp + 0x24]
push eax
push ecx
call fcn.004330d3
add esp, 8
lea edx, [esi + 0x2c]
lea eax, [esp + 0x24]
push edx
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x24]
push ecx
push edx
call fcn.00432f95
add esp, 8
test eax, eax
jne 0x41c15b
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41c16e
mov esi, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
inc ebp
cmp ebp, eax
jl 0x41c0bd
jmp 0x41c192
mov ecx, dword [esp + 0x14]
push 0
push ebp
push 0x1008
mov edx, dword [ecx + 0x248c]
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
mov byte [esi + 0x478], 1
mov esi, dword [esp + 0x10]
push esi
call fcn.00432a93
lea esi, [esi + eax*2 + 2]
add esp, 4
mov dword [esp + 0x10], esi
cmp word [esi], 0
jne 0x41c084
pop ebp
pop edi
pop esi
mov al, 1
pop ebx
add esp, 0x414
ret 4