joyce8/EMBER2024-capa huggingface dataset:
Function at 0x438b4b
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
lea ebp, [esp - 0x70]
sub esp, 0x98
push ebx
push esi
xor esi, esi
cmp dword [ebp + 0x78], esi
push edi
mov edi, ecx
jne 0x438b6c
mov eax, 0x8876086c
jmp 0x438c4e
cmp dword [ebp + 0x7c], esi
je 0x438be6
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 0x28], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x18], 2
je 0x438bc6
mov ebx, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push esi
push esi
push esi
push esi
push 0xffffffffffffffff
push dword [ebp + 0x78]
push esi
push esi
call ebx
mov dword [ebp + 0x6c], eax
add eax, 3
and eax, 0xfffffffc
call fcn.00418ad0
mov dword [ebp + 0x7c], esp
push esi
push esi
push dword [ebp + 0x6c]
push dword [ebp + 0x7c]
push 0xffffffffffffffff
push dword [ebp + 0x78]
push esi
push esi
call ebx
mov eax, dword [ebp + 0x7c]
mov dword [ebp + 0x78], eax
mov dword [ebp + 0x7c], esi
cmp dword [ebp + 0x7c], esi
je 0x438be6
push esi
push 0x10000000
push 3
push esi
push 1
push closesocket
push dword [ebp + 0x78]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
jmp 0x438bff
push esi
push 0x10000000
push 3
push esi
push 1
push closesocket
push dword [ebp + 0x78]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [edi], eax
je 0x438c3f
push esi
push esi
push esi
push 2
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
cmp eax, 0xffffffff
mov dword [edi + 4], eax
je 0x438c3f
push esi
push esi
push esi
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
cmp eax, esi
mov dword [edi + 8], eax
je 0x438c3f
push esi
push dword [edi]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [edi + 0xc], eax
jne 0x438c4c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, 0x88760b59
jmp 0x438c4e
xor eax, eax
lea esp, [ebp - 0x34]
pop edi
pop esi
pop ebx
add ebp, 0x70
leave
ret 8

Function at 0x438ca7
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push str.SoftwareMicrosoftDirect3D
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x438cff
push esi
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x438cff
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 8]
jne 0x438cff
xor eax, eax
inc eax
leave
ret
xor eax, eax
leave
ret
Function at 0x438d28
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
lea eax, [ebp - 4]
push eax
push str.SoftwareMicrosoftDirect3D
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
xor edi, edi
test eax, eax
jne 0x438d96
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push str.DisableMMX
push dword [ebp - 4]
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x438d8d
cmp dword [ebp - 0xc], 4
jne 0x438d8d
cmp dword [ebp - 0x10], edi
je 0x438d8d
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x4986c0], edi
xor eax, eax
jmp 0x438dbe
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x4986c0], edi
jge 0x438db9
mov dword [0x4986c0], edi
call fcn.00438d03
test eax, eax
je 0x438db9
emms
mov dword [0x4986c0], 1
mov eax, dword [0x4986c0]
pop edi
leave
ret

Function at 0x438e9e
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x98
push ebx
push edi
push 0x25
pop ecx
xor eax, eax
lea edi, [ebp - 0x24]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x24]
xor bl, bl
and byte [ebp + 0x73], bl
push eax
mov dword [ebp - 0x24], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x438ed5
inc bl
mov byte [ebp + 0x73], 1
cmp dword [ebp - 0x14], 1
jne 0x438ef7
cmp dword [ebp - 0x20], 4
ja 0x438f01
jne 0x438ef1
cmp dword [ebp - 0x1c], 0xa
jb 0x438ef1
cmp word [ebp - 0x18], 0x55d
jae 0x438f01
mov byte [ebp + 0x73], 1
jmp 0x438f01
cmp dword [ebp - 0x14], 2
jne 0x438f17
test bl, bl
je 0x438f32
mov eax, dword [ebp + 0x7c]
sub eax, 6
je 0x438f22
dec eax
je 0x438f1b
sub eax, 3
jne 0x438f17
cmp byte [ebp + 0x73], 0
je 0x438f43
xor eax, eax
jmp 0x438f4b
call fcn.00438dc1
jmp 0x438f4b
cmp byte [ebp + 0x73], 0
jne 0x438f17
call fcn.00438df9
and eax, 4
jmp 0x438f4b
cmp dword [ebp + 0x7c], 0xa
je 0x438f43
push dword [ebp + 0x7c]
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
jmp 0x438f4b
call fcn.00438df9
and eax, 8
pop edi
pop ebx
add ebp, 0x74
leave
ret
Function at 0x4391aa
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push edi
xor edi, edi
cmp dword [eax], 0x20000000
mov dword [ebp - 4], edi
jne 0x4392f1
push ebx
push esi
push 4
pop esi
add eax, esi
mov ecx, dword [eax]
cmp ecx, 0x40020000
jne 0x439250
add eax, esi
mov ecx, dword [eax]
xor edx, edx
cmp ecx, 0x40000001
je 0x4391fa
cmp ecx, 0x40010001
je 0x4391fa
cmp ecx, 0x40020001
je 0x4391fa
cmp ecx, 0x40030001
jne 0x439205
shr ecx, 0x10
and ecx, 0xf
inc ecx
mov edx, ecx
add eax, esi
cmp dword [eax], 0x40050002
jne 0x439217
inc edx
mov dword [ebp - 4], 0x1000
add eax, esi
mov ecx, edx
sub ecx, edi
je 0x43924a
dec ecx
je 0x439244
dec ecx
je 0x43923e
dec ecx
je 0x439238
dec ecx
je 0x439232
dec ecx
jne 0x43925d
or dword [ebp - 4], 0xe
jmp 0x43925d
or dword [ebp - 4], 0xc
jmp 0x43925d
or dword [ebp - 4], 0xa
jmp 0x43925d
or dword [ebp - 4], 8
jmp 0x43925d
or dword [ebp - 4], 6
jmp 0x43925d
or dword [ebp - 4], 2
jmp 0x43925d
cmp ecx, 0x40030000
jne 0x43925d
mov dword [ebp - 4], esi
add eax, esi
cmp dword [eax], 0x40020003
push 0x10
pop ecx
jne 0x43926d
or dword [ebp - 4], ecx
add eax, esi
cmp dword [eax], 0x40000004
jne 0x43927b
or dword [ebp - 4], 0x20
add eax, esi
cmp dword [eax], 0x40040005
jne 0x439289
or dword [ebp - 4], 0x40
add eax, esi
cmp dword [eax], 0x40040006
jne 0x439297
or byte [ebp - 4], 0x80
add eax, esi
push 7
pop esi
mov edx, dword [eax]
mov ebx, esi
or ebx, 0x40000000
cmp ebx, edx
jne 0x4392ac
push 3
jmp 0x4392d7
mov ebx, esi
or ebx, 0x40010000
cmp ebx, edx
je 0x4392dd
mov ebx, esi
or ebx, 0x40020000
cmp ebx, edx
jne 0x4392c9
xor edx, edx
inc edx
jmp 0x4392d8
mov ebx, esi
or ebx, 0x40030000
cmp ebx, edx
jne 0x4392e9
push 2
pop edx
shl edx, cl
or dword [ebp - 4], edx
add eax, 4
inc edi
inc ecx
inc ecx
inc esi
cmp ecx, 0x20
jb 0x43929a
shl edi, 8
or dword [ebp - 4], edi
pop esi
pop ebx
cmp dword [eax], 0xffffffff
pop edi
je 0x4392fe
mov eax, 0x8876086c
jmp 0x439308
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
xor eax, eax
leave
ret 8
Function at 0x4441d0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x4441fd
push esi
call fcn.0044bc42
cmp byte [esi + 0x40], 0
pop ecx
je 0x4441f6
mov dword [esi + 0x10], 0xcf
mov al, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x44426c
mov eax, dword [esi + 0x18c]
cmp byte [eax + 0x10], 0
je 0x444261
mov eax, dword [esi + 8]
test eax, eax
je 0x44421e
push esi
call dword [eax]
pop ecx
mov eax, dword [esi + 0x18c]
push esi
call dword [eax]
test eax, eax
pop ecx
je 0x44425d
cmp eax, 2
je 0x444261
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x444213
cmp eax, 3
je 0x444242
cmp eax, 1
jne 0x444213
inc dword [ecx + 4]
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
cmp dword [eax + 4], ecx
jl 0x444213
mov edx, dword [esi + 0x118]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x444213
xor al, al
pop esi
ret
mov eax, dword [esi + 0x7c]
mov dword [esi + 0x84], eax
jmp 0x44428a
cmp eax, 0xcc
je 0x44428a
mov eax, dword [esi]
mov dword [eax + 0x14], 0x12
mov eax, dword [esi]
mov ecx, dword [esi + 0x10]
mov dword [eax + 0x18], ecx
mov eax, dword [esi]
push esi
call dword [eax]
pop ecx
call fcn.004440a3
pop esi
ret

Function at 0x44d54c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x44d55a
xor eax, eax
pop ebp
ret
cmp dword [ebp + 0x10], 8
push esi
mov esi, dword [ebp + 8]
not esi
mov ecx, 0xff
jb 0x44d62e
mov eax, dword [ebp + 0x10]
push ebx
shr eax, 3
push edi
xor ebx, ebx
mov bl, byte [edx]
mov edi, esi
shr edi, 8
sub dword [ebp + 0x10], 8
xor ebx, esi
and ebx, ecx
mov esi, dword [ebx*4 + 0x480ca0]
xor ebx, ebx
xor esi, edi
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
mov edi, dword [ebx*4 + 0x480ca0]
xor ebx, ebx
shr esi, 8
xor edi, esi
inc edx
mov bl, byte [edx]
xor ebx, edi
and ebx, ecx
mov esi, dword [ebx*4 + 0x480ca0]
xor ebx, ebx
shr edi, 8
xor esi, edi
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
mov edi, dword [ebx*4 + 0x480ca0]
xor ebx, ebx
shr esi, 8
xor edi, esi
inc edx
mov bl, byte [edx]
xor ebx, edi
and ebx, ecx
mov esi, dword [ebx*4 + 0x480ca0]
xor ebx, ebx
shr edi, 8
xor esi, edi
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
mov edi, dword [ebx*4 + 0x480ca0]
shr esi, 8
xor edi, esi
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, edi
and ebx, ecx
mov esi, dword [ebx*4 + 0x480ca0]
shr edi, 8
xor esi, edi
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
mov edi, dword [ebx*4 + 0x480ca0]
shr esi, 8
xor esi, edi
inc edx
dec eax
jne 0x44d577
pop edi
pop ebx
cmp dword [ebp + 0x10], 0
je 0x44d64e
xor eax, eax
mov al, byte [edx]
xor eax, esi
and eax, ecx
mov eax, dword [eax*4 + 0x480ca0]
shr esi, 8
xor esi, eax
inc edx
dec dword [ebp + 0x10]
jne 0x44d634
mov eax, esi
not eax
pop esi
pop ebp
ret
Function at 0x464fa7
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x54], 0
mov eax, dword [edi + 0x58]
mov esi, dword [edi + 0x5c]
mov dword [ebp - 4], eax
je 0x464fde
call fcn.00472777
mov ebx, dword [eax + 0xc]
push 5
push dword [edi + 0x54]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x464fef
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
xor ebx, ebx
inc ebx
test esi, esi
je 0x465028
cmp word [esi + 2], 0xffff
mov ecx, dword [esi]
jne 0x46500d
mov ecx, dword [esi + 0xc]
mov ax, word [esi + 0x12]
mov si, word [esi + 0x14]
jmp 0x465015
mov ax, word [esi + 0xa]
mov si, word [esi + 0xc]
test cx, 0x1801
jne 0x465026
test ax, ax
jne 0x465026
test si, si
je 0x465028
xor ebx, ebx
cmp dword [edi + 0x54], 0
je 0x465037
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret
Function at 0x465297
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x475363
call fcn.0041a160
sub esp, 0x18
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x58]
mov ebx, dword [esi + 0x5c]
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], eax
call fcn.00472777
cmp dword [esi + 0x54], 0
mov edi, dword [eax + 0xc]
je 0x4652d7
call fcn.00472777
mov edi, dword [eax + 0xc]
push 5
push dword [esi + 0x54]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x4652e8
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
jne 0x4652f4
or eax, 0xffffffff
jmp 0x4653f7
mov ecx, esi
call fcn.00464dd1
mov dword [ebp - 0x14], eax
call fcn.00466d18
and dword [ebp - 0x20], 0
cmp dword [ebp - 0x14], 0
je 0x465337
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp dword [ebp - 0x14], eax
je 0x465337
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x465337
push 0
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [ebp - 0x20], 1
and dword [ebp - 4], 0
push esi
call fcn.00468263
push dword [ebp - 0x14]
call fcn.00466c70
push edi
push eax
push ebx
mov ecx, esi
call fcn.0046507c
xor ebx, ebx
cmp eax, ebx
je 0x4653ab
test byte [esi + 0x38], 0x10
je 0x465379
push 4
pop edi
mov ecx, esi
call fcn.00468f27
test ah, 1
je 0x465371
push 5
pop edi
push edi
mov ecx, esi
call fcn.00466714
cmp dword [esi + 0x1c], ebx
je 0x4653ab
push 0x97
push ebx
push ebx
push ebx
push ebx
push ebx
mov ecx, esi
call fcn.00469050
jmp 0x4653ab
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x20], ebx
je 0x4653bf
push 1
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
cmp dword [ebp - 0x14], ebx
je 0x4653d8
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [esi + 0x1c]
jne 0x4653d8
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x60]
mov ecx, esi
call fcn.00464e0b
cmp dword [esi + 0x54], ebx
je 0x4653f4
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [esi + 0x40]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret

Function at 0x467944
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x4c]
test ecx, ecx
jne 0x46797e
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004183f6
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004183ce
pop esi
ret 4
mov eax, dword [ecx]
pop esi
jmp dword [eax + 0x8c]
Function at 0x468bd0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push esi
push edi
xor edi, edi
xor ebx, ebx
cmp dword [esp + 0x14], edi
mov ebp, ecx
je 0x468c13
call fcn.00472777
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x468c13
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x468c2e
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
push ebx
mov ecx, ebp
call fcn.00467d37
test ebx, ebx
mov esi, eax
je 0x468c2c
test edi, edi
je 0x468c2c
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x4690c9
Capabilities:
Get graphical window text

Disassembly:
mov eax, 0x475493
call fcn.0041a160
push ecx
push esi
mov esi, ecx
cmp dword [esi + 0x4c], 0
jne 0x4690ee
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x46913a
call fcn.0046a0d9
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov ecx, dword [esi + 0x4c]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push dword [ebp + 0xc]
push dword [ebp - 0x10]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.0040aed0
mov eax, esi
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret 8
Function at 0x46a66c
Capabilities:
Get disk information

Disassembly:
mov eax, 0x4756f3
call fcn.0041a160
sub esp, 0x14c
mov eax, dword [0x48bcd8]
xor eax, dword [ebp + 4]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push eax
push edi
mov esi, 0x104
push esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
test eax, eax
jne 0x46a6b6
push esi
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
xor eax, eax
jmp 0x46a74b
push ebx
call fcn.0046a0d9
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
xor esi, esi
push edi
mov dword [ebp - 4], esi
call fcn.0046a62a
mov ebx, dword [ebp + 8]
push ebx
call dword [sym.imp.SHLWAPI.dll_PathIsUNCA]
test eax, eax
jne 0x46a73d
push esi
push esi
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x18]
push eax
push esi
push esi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
je 0x46a740
test byte [ebp + 8], 2
jne 0x46a70b
push edi
call dword [sym.imp.USER32.dll_CharUpperA]
test byte [ebp + 8], 4
jne 0x46a73d
lea eax, [ebp - 0x158]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x46a73d
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [ebp - 0x12c]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
xor esi, esi
inc esi
lea ecx, [ebx - 0x10]
call fcn.0040aed0
mov eax, esi
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
xor ecx, dword [ebp + 4]
pop edi
pop esi
call fcn.0041a0a4
leave
ret 8
Function at 0x46b00c
Capabilities:
Check if file exists
Get file attributes
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x128
xor ebx, ebx
push ebx
push esi
mov edi, ecx
call fcn.0041a100
add esp, 0xc
push 0x104
push dword [edi + 0xc]
lea eax, [esi + 0x22]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov eax, dword [edi + 4]
cmp eax, dword [0x47af78]
je 0x46b113
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
je 0x46b07c
push ebx
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], ebx
jne 0x46b083
cmp ebx, ebx
jne 0x46b083
xor eax, eax
jmp 0x46b116
mov edi, dword [edi + 0xc]
cmp dword [edi - 0xc], ebx
jne 0x46b090
mov byte [esi + 0x20], bl
jmp 0x46b0a4
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
sete cl
dec cl
and ecx, eax
mov byte [esi + 0x20], cl
push 0xffffffffffffffff
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x20]
call fcn.004187fa
mov ecx, dword [eax]
mov dword [esi], ecx
mov eax, dword [eax + 4]
mov dword [esi + 4], eax
push 0xffffffffffffffff
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x20]
call fcn.004187fa
mov ecx, dword [eax]
mov dword [esi + 0x10], ecx
mov eax, dword [eax + 4]
mov dword [esi + 0x14], eax
push 0xffffffffffffffff
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x20]
call fcn.004187fa
mov ecx, dword [eax]
mov dword [esi + 8], ecx
mov ecx, dword [eax + 4]
mov dword [esi + 0xc], ecx
mov ecx, dword [esi]
or ecx, dword [esi + 4]
jne 0x46b0ff
mov ecx, dword [eax]
mov dword [esi], ecx
mov eax, dword [eax + 4]
mov dword [esi + 4], eax
mov eax, dword [esi + 0x10]
or eax, dword [esi + 0x14]
jne 0x46b113
mov eax, dword [esi + 8]
mov dword [esi + 0x10], eax
mov eax, dword [esi + 0xc]
mov dword [esi + 0x14], eax
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x46c678
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x48bcd8]
xor eax, dword [ebp + 4]
push esi
push dword [ebp + 0xc]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
mov eax, 0x100
cmp esi, eax
ja 0x46c6ca
push eax
lea eax, [ebp - 0x104]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextA]
cmp eax, esi
jne 0x46c6ca
push dword [ebp + 0xc]
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x46c6d6
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
pop esi
call fcn.0041a0a4
leave
ret 8
Function at 0x46cdb6
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [ebp - 0x10], eax
je 0x46cf39
push ebx
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
mov dword [ebp - 8], ebx
jne 0x46cded
xor eax, eax
jmp 0x46cf36
mov edi, dword [ebx]
add edi, 0x40
push edi
call fcn.00418a4a
mov esi, eax
test esi, esi
pop ecx
je 0x46cde6
push edi
push ebx
push esi
call fcn.0041a180
mov edi, dword [esi]
add esp, 0xc
add edi, esi
and dword [ebp + 0xc], 0
mov ecx, dword [ebp + 0xc]
mov ecx, dword [edi + ecx*4]
xor eax, eax
cmp ecx, dword [eax*8 + 0x47a4d8]
je 0x46ce2b
inc eax
cmp eax, 4
jb 0x46ce1a
jmp 0x46ce8d
cmp dword [ebp + 0x10], 0
je 0x46ce47
cmp dword [eax*8 + 0x47a4dc], 0x12
je 0x46ce8d
mov eax, dword [ebp + 0xc]
mov dword [edi + eax*4], 0xffffff
jmp 0x46ce8d
lea ebx, [eax*8 + 0x47a4dc]
push dword [ebx]
mov dword [ebp - 4], ebx
call dword [sym.imp.USER32.dll_GetSysColor]
push dword [ebx]
movzx eax, ah
mov dword [ebp + 8], eax
call dword [sym.imp.USER32.dll_GetSysColor]
mov ecx, dword [ebp + 8]
mov ch, al
mov eax, ebx
push dword [eax]
shl ecx, 8
mov dword [ebp + 8], ecx
call dword [sym.imp.USER32.dll_GetSysColor]
mov ecx, dword [ebp + 8]
shr eax, 0x10
movzx eax, al
or ecx, eax
mov eax, dword [ebp + 0xc]
mov dword [edi + eax*4], ecx
inc dword [ebp + 0xc]
cmp dword [ebp + 0xc], 0x10
jl 0x46ce12
mov edi, dword [esi + 4]
mov ebx, dword [esi + 8]
push 0
mov dword [ebp + 8], edi
mov dword [ebp + 0xc], ebx
call dword [sym.imp.USER32.dll_GetDC]
push ebx
push edi
push eax
mov dword [ebp + 0x10], eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
test eax, eax
mov dword [ebp - 4], eax
je 0x46cf18
push dword [ebp + 0x10]
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push dword [ebp - 4]
mov ebx, dword [sym.imp.GDI32.dll_SelectObject]
mov edi, eax
push edi
call ebx
mov cl, byte [esi + 0xe]
push 0xcc0020
xor edx, edx
inc edx
shl edx, cl
mov ecx, dword [ebp - 8]
mov dword [ebp - 0xc], eax
xor eax, eax
push eax
push esi
lea ecx, [ecx + edx*4 + 0x28]
push ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
push eax
push edi
call dword [sym.imp.GDI32.dll_StretchDIBits]
push dword [ebp - 0xc]
push edi
call ebx
push edi
call dword [sym.imp.GDI32.dll_DeleteDC]
push dword [ebp + 0x10]
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
push esi
call fcn.00418a5c
pop ecx
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0xc