joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406cf0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [0x447518]
push ebp
push 0x4448e8
push 0x4448e4
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x406db1
mov ecx, dword [0x447518]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebp, eax
test ebp, ebp
je 0x406db1
push ebx
push esi
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, dword [esp + 0x18]
mov edx, dword [eax + 0x14]
mov ecx, dword [eax + 0x10]
mov dword [ebx], edx
cmp word [ebx + 2], 0x100
jne 0x406d59
add ecx, 0xfffffffc
lea esi, [eax + 0x18]
mov eax, ecx
lea edi, [ebx + 4]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
jmp 0x406d78
add ecx, 0xfffffffc
cmp ecx, 0x3b0
jbe 0x406d69
mov ecx, 0x3b0
mov edx, ecx
lea esi, [eax + 0x18]
lea edi, [ebx + 0x2c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov edx, dword [esp + 0x14]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [edx + 0x60]
xor eax, eax
test ecx, ecx
jle 0x406da0
lea ecx, [ebx + 0x2c]
mov esi, dword [edx + 0x70]
mov edi, dword [ecx]
add ecx, 4
mov dword [esi + eax*4], edi
mov esi, dword [edx + 0x60]
inc eax
cmp eax, esi
jl 0x406d8d
push ebp
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
pop esi
pop ebx
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x406dc0
Capabilities:
Get file size

Disassembly:
sub esp, 0x198
push ebx
mov ebx, dword [esp + 0x1a0]
push esi
push edi
mov eax, dword [ebx + 4]
push 2
push eax
call fcn.00407800
lea ecx, [esp + 0xc]
lea edx, [esp + 0x14]
push ecx
push edx
push 0x12
push ebx
mov esi, eax
mov byte [esp + 0x24], 0
call fcn.004063d0
mov al, byte [esp + 0x14]
test al, al
jne 0x406e08
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x198
ret
push 0
push 0x2c
push 0x15
lea eax, [esp + 0x20]
push 0x28
push eax
push esi
call fcn.0042a840
lea ecx, [esp + 0x14]
push eax
push ecx
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [esp + 0x14]
push 0x4448f8
push edx
call fcn.0042c0b0
test eax, eax
jne 0x406e48
pop edi
pop esi
pop ebx
add esp, 0x198
ret
lea eax, [esp + 0x11c]
push 0
lea ecx, [esp + 0x18]
push eax
push ecx
call fcn.0042c7c0
mov esi, eax
cmp esi, 0xffffffff
jne 0x406e6f
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x198
ret
lea edx, [esp + 0x10]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, dword [sym.imp.KERNEL32.dll__lread]
mov dword [esp + 0xc], eax
lea eax, [esp + 0x14]
push 4
push eax
push esi
call edi
lea ecx, [esp + 0x14]
push 0x4448f0
push ecx
mov byte [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x406ebb
push esi
call dword [sym.imp.KERNEL32.dll__lclose]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x198
ret
push ebp
lea edx, [esp + 0x18]
push 0xc
push edx
push esi
call edi
lea eax, [esp + 0x10]
push 4
push eax
push esi
call edi
mov ebp, dword [esp + 0x1b0]
push 4
push ebp
push esi
call edi
cmp word [ebp + 2], 0x100
jne 0x406ef3
mov ecx, dword [esp + 0x10]
lea edx, [ebp + 4]
add ecx, 0xfffffffc
push ecx
push edx
jmp 0x406f0b
mov eax, dword [esp + 0x10]
add eax, 0xfffffffc
cmp eax, 0x3b0
jbe 0x406f06
mov eax, 0x3b0
lea ecx, [ebp + 0x2c]
push eax
push ecx
push esi
call edi
mov ecx, dword [ebx + 0x60]
xor eax, eax
test ecx, ecx
jle 0x406f2d
lea ecx, [ebp + 0x2c]
mov edx, dword [ebx + 0x70]
mov edi, dword [ecx]
add ecx, 4
mov dword [edx + eax*4], edi
mov edx, dword [ebx + 0x60]
inc eax
cmp eax, edx
jl 0x406f1a
push esi
call dword [sym.imp.KERNEL32.dll__lclose]
pop ebp
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x198
ret
Function at 0x407cc0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x158
push ebx
push ebp
push esi
mov esi, dword [esp + 0x168]
test esi, esi
push edi
je 0x407e00
mov eax, dword [esp + 0x170]
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [esp + 0x10]
push eax
push ecx
call ebp
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [esp + 0x10]
push 0x44495c
push edx
call edi
lea ecx, [esp + 0x10]
mov eax, dword [esp + 0x174]
push eax
push ecx
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push esi
lea edx, [esp + 0x64]
push 0x50
push edx
push 0x446cb4
lea eax, [esp + 0x20]
push str.Type
push eax
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
lea ecx, [esp + 0x60]
push str.String
push ecx
call edi
test eax, eax
jne 0x407d9f
push esi
lea edx, [esp + 0x64]
push 0x50
push edx
push 0x446cb8
lea eax, [esp + 0x20]
push 0x444970
push eax
call ebx
lea ecx, [esp + 0x60]
push 0x446cbc
push ecx
call edi
test eax, eax
je 0x407e00
mov eax, dword [esp + 0x178]
lea edx, [esp + 0x60]
push edx
push eax
call ebp
pop edi
pop esi
mov ecx, dword [esp + 0x174]
pop ebp
mov eax, 1
pop ebx
mov dword [ecx], 0
add esp, 0x158
ret 0x14
lea edx, [esp + 0x60]
push str.Number
push edx
call edi
test eax, eax
jne 0x407e00
push esi
lea eax, [esp + 0x64]
push 0x50
push eax
push 0x446cc0
lea ecx, [esp + 0x20]
push str.Data
push ecx
call ebx
lea edx, [esp + 0x60]
push 0x446cc4
push edx
call edi
test eax, eax
je 0x407e00
lea eax, [esp + 0x60]
push eax
call fcn.00439a20
mov ecx, dword [esp + 0x180]
add esp, 4
pop edi
pop esi
mov dword [ecx], eax
pop ebp
mov eax, 1
pop ebx
add esp, 0x158
ret 0x14
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x158
ret 0x14
Function at 0x40c9a0
Capabilities:
Get file size

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x8c
lea eax, [esp + 4]
push ebx
push esi
push 0
push eax
push ecx
call fcn.0042c7c0
mov esi, eax
cmp esi, 0xffffffff
jne 0x40c9cd
pop esi
xor eax, eax
pop ebx
add esp, 0x8c
ret 8
lea edx, [esp + 8]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0x3d0900
mov ebx, dword [esp + 0x9c]
mov dword [ebx], eax
jbe 0x40ca03
push esi
mov dword [ebx], 0
call dword [sym.imp.KERNEL32.dll__lclose]
pop esi
xor eax, eax
pop ebx
add esp, 0x8c
ret 8
shr eax, 6
add eax, 2
push edi
push eax
push 0x7ffe
call fcn.0042d3b0
mov edi, eax
mov eax, dword [ebx]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll__hread]
push esi
call dword [sym.imp.KERNEL32.dll__lclose]
mov eax, edi
pop edi
pop esi
pop ebx
add esp, 0x8c
ret 8
Function at 0x41c450
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x54
push edi
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
lea eax, [esp + 4]
mov edx, dword [esp + 0x5c]
lea ecx, [esp + 0x14]
push eax
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push edx
push 0
mov dword [esp + 0x3c], 0x44
mov dword [esp + 0x68], 0x41
mov word [esp + 0x6c], 0xa
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
pop edi
jne 0x41c4a9
mov eax, 1
add esp, 0x54
ret
mov eax, dword [esp]
push esi
push 0xffffffffffffffff
push eax
call dword [sym.imp.USER32.dll_WaitForInputIdle]
mov ecx, dword [esp + 4]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
mov edx, dword [esp + 8]
push edx
call esi
mov eax, 1
pop esi
add esp, 0x54
ret

Function at 0x423af0
Capabilities:
Get file size

Disassembly:
sub esp, 0x198
push esi
push edi
mov edi, dword [esp + 0x1a4]
test edi, edi
je 0x423be1
mov eax, dword [edi]
test eax, eax
je 0x423be1
mov esi, dword [esp + 0x1a8]
push 0
push 0x2e
push 0x1b
push 0x28
push esi
push eax
call fcn.0042a840
test eax, eax
mov dword [esp + 8], eax
je 0x423b6f
cmp eax, 0xffffffff
je 0x423b6f
mov ecx, dword [edi]
lea eax, [esp + 8]
push eax
push 0x1b
push esi
push ecx
call fcn.0042a590
mov esi, eax
mov edx, dword [esp + 8]
push edx
push esi
push edi
call fcn.00424a90
add esp, 0xc
mov edi, eax
push esi
push 0x7ffe
call fcn.0042d4d0
mov eax, edi
pop edi
pop esi
add esp, 0x198
ret 8
mov eax, dword [edi]
push 0
push 0x2c
push 0x1b
push 0x28
push esi
push eax
call fcn.0042a840
cmp eax, 0xffffffff
mov dword [esp + 8], eax
je 0x423be1
lea ecx, [esp + 0x10]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [esp + 0x10]
push str.Auto
push edx
call fcn.0042c0b0
test eax, eax
je 0x423be1
lea eax, [esp + 0x118]
push 0
lea ecx, [esp + 0x14]
push eax
push ecx
call fcn.0042c7c0
mov esi, eax
cmp esi, 0xffffffff
je 0x423be1
lea edx, [esp + 0xc]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0x989680
push esi
mov dword [esp + 0xc], eax
jbe 0x423bee
call dword [sym.imp.KERNEL32.dll__lclose]
pop edi
xor eax, eax
pop esi
add esp, 0x198
ret 8
push edi
call fcn.00424f60
add esp, 8
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll__lclose]
mov eax, edi
pop edi
pop esi
add esp, 0x198
ret 8
Function at 0x42a170
Capabilities:
Get common file path

Disassembly:
mov eax, dword [0x44515c]
sub esp, 0x108
cmp eax, 0xffffffff
push ebx
push esi
push edi
jne 0x42a1a9
push 0x1003
push 0x7d00
call fcn.0042d340
test eax, eax
mov dword [0x44515c], eax
jge 0x42a1a9
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x108
ret 0x18
push 0x38c
push eax
call fcn.0042d3b0
mov esi, eax
test esi, esi
jne 0x42a1c6
pop edi
pop esi
pop ebx
add esp, 0x108
ret 0x18
push 0xd5
push 0x7ffe
call fcn.0042d3b0
test eax, eax
mov dword [esi + 0x388], eax
jne 0x42a1eb
pop edi
pop esi
pop ebx
add esp, 0x108
ret 0x18
mov eax, dword [esp + 0x11c]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
test eax, eax
jne 0x42a247
mov ecx, dword [0x447518]
lea eax, [esp + 0xc]
push 0x105
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x42a236
lea edx, [esp + 0xc]
push 0x105
push edx
call fcn.0042c6d0
test eax, eax
jne 0x42a236
pop edi
pop esi
pop ebx
add esp, 0x108
ret 0x18
lea eax, [esp + 0xc]
lea ecx, [esp + 0xc]
push eax
push ecx
call fcn.0042ce70
jmp 0x42a24f
lea edx, [esp + 0xc]
push eax
push edx
call ebx
lea eax, [esp + 0xc]
push 1
push eax
call fcn.0042cef0
lea ecx, [esp + 0xc]
lea edx, [esi + 0x151]
push ecx
push edx
call ebx
lea edi, [esi + 0x4c]
push 0x105
push edi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x42a288
pop edi
pop esi
pop ebx
add esp, 0x108
ret 0x18
push 1
push edi
call fcn.0042cef0
lea eax, [esi + 0x256]
mov edi, dword [esp + 0x118]
push edi
push eax
call ebx
mov dword [esi + 4], 0xffffffff
push esi
mov eax, dword [esp + 0x124]
mov ecx, dword [esp + 0x12c]
mov edx, dword [esp + 0x130]
sub eax, 2
mov dword [esi + 8], ecx
mov dword [esi + 0x360], edx
je 0x42a2e5
mov eax, dword [0x44515c]
push eax
call fcn.0042d4d0
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x108
ret 0x18
push edi
call fcn.0042b700
add esp, 8
test eax, eax
jne 0x42a30d
mov ecx, dword [0x44515c]
push esi
push ecx
call fcn.0042d4d0
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x108
ret 0x18
cmp dword [esi + 0x10], 2
jne 0x42a35c
mov eax, dword [esp + 0x124]
mov edi, dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
mov dword [esi + 0x364], eax
mov dword [esi + 0x35c], 1
jne 0x42a343
push str.DemoNow
push 0
call edi
mov dword [esi + 0x364], eax
mov eax, dword [esi + 0x364]
test eax, eax
jne 0x42a35c
push str.InstallFromTheWeb
push 0
call edi
mov dword [esi + 0x364], eax
mov eax, dword [esi + 0x36c]
test eax, eax
je 0x42a373
push 0
call fcn.0042aac0
mov dword [esi + 0x368], eax
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x108
ret 0x18
Function at 0x42a610
Capabilities:
Get file size

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x198
push ebx
push esi
mov esi, dword [esp + 0x1a4]
push edi
push 0x13
push eax
push esi
call fcn.0042aa60
add esp, 0xc
test eax, eax
jne 0x42a640
pop edi
pop esi
pop ebx
add esp, 0x198
ret 0x10
mov ecx, dword [eax + 0x10]
test ecx, ecx
jne 0x42a6fd
mov ecx, dword [eax + 0x18]
lea edx, [esp + 0x14]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x14]
push str.Text
push eax
call fcn.0042c0b0
test eax, eax
jne 0x42a679
pop edi
pop esi
pop ebx
add esp, 0x198
ret 0x10
lea ecx, [esp + 0x11c]
push 0
lea edx, [esp + 0x18]
push ecx
push edx
call fcn.0042c7c0
mov esi, eax
cmp esi, 0xffffffff
jne 0x42a6a2
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x198
ret 0x10
lea eax, [esp + 0x10]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, dword [esp + 0x1b4]
mov dword [esp + 0xc], eax
mov ecx, dword [ebx]
dec ecx
cmp eax, ecx
jb 0x42a6c6
mov eax, ecx
mov dword [esp + 0xc], eax
mov edi, dword [esp + 0x1b0]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll__lread]
push esi
call dword [sym.imp.KERNEL32.dll__lclose]
mov eax, 1
mov ecx, dword [esp + 0xc]
mov byte [ecx + edi], 0
mov edx, dword [esp + 0xc]
inc edx
pop edi
mov dword [ebx], edx
pop esi
pop ebx
add esp, 0x198
ret 0x10
lea ecx, [esp + 0xc]
push 2
push ecx
push eax
push esi
call fcn.0042b2f0
test eax, eax
jne 0x42a71b
pop edi
pop esi
pop ebx
add esp, 0x198
ret 0x10
mov edi, dword [esp + 0x1b0]
push ebp
mov ebp, dword [esp + 0x10]
xor esi, esi
test ebp, ebp
jle 0x42a74c
mov edx, eax
sub edx, edi
mov ecx, dword [esp + 0x1b8]
mov ecx, dword [ecx]
dec ecx
cmp esi, ecx
jge 0x42a74c
lea ecx, [esi + edi]
inc esi
cmp esi, ebp
mov bl, byte [edx + ecx]
mov byte [ecx], bl
jl 0x42a731
push eax
push 0x7ffe
call fcn.0042d4d0
mov byte [esi + edi], 0
inc esi
mov edx, dword [esp + 0x1b8]
pop ebp
pop edi
mov eax, 1
mov dword [edx], esi
pop esi
pop ebx
add esp, 0x198
ret 0x10
Function at 0x42abd0
Capabilities:
Get file size

Disassembly:
sub esp, 0x194
push ebx
push ebp
mov ebp, dword [esp + 0x1b4]
push esi
mov esi, dword [esp + 0x1a4]
push edi
test esi, esi
mov dword [ebp], 0
je 0x42ad13
push esi
call fcn.0042aba0
test eax, eax
je 0x42ad13
lea eax, [esp + 0x14]
push 0x105
push eax
call fcn.0042c740
test eax, eax
je 0x42ad13
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [esp + 0x14]
push 0x44519c
push ecx
call ebx
lea edx, [esp + 0x14]
mov edi, dword [esp + 0x1b0]
push edi
push edx
call ebx
lea eax, [esp + 0x11c]
push 0x4000
lea ecx, [esp + 0x18]
push eax
push ecx
call fcn.0042c7c0
test eax, eax
ja 0x42ac77
mov eax, dword [esp + 0x1ac]
lea edx, [esp + 0x14]
push edx
push edi
push eax
push esi
call fcn.0042ad30
add esp, 0x10
test eax, eax
je 0x42ad13
mov eax, dword [esp + 0x1b4]
mov dword [ebp], 1
cmp eax, 2
jne 0x42ad13
lea ecx, [esp + 0x11c]
push 0
lea edx, [esp + 0x18]
push ecx
push edx
call fcn.0042c7c0
mov esi, eax
cmp esi, 0xffffffff
je 0x42ad13
lea eax, [esp + 0x10]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, dword [esp + 0x1b8]
sub eax, ebx
mov dword [ebp], eax
shr eax, 6
inc eax
push eax
push 0x7ffe
call fcn.0042d3b0
push 0
push ebx
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll__llseek]
mov ecx, dword [ebp]
push ecx
push edi
push esi
call dword [sym.imp.KERNEL32.dll__hread]
push esi
call dword [sym.imp.KERNEL32.dll__lclose]
lea edx, [esp + 0x14]
mov eax, dword [esp + 0x1a8]
push edx
mov ecx, dword [eax + 8]
push ecx
call fcn.0042c940
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x194
ret 0x18
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x194
ret 0x18
Function at 0x42ad30
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x19c
mov eax, dword [0x44515c]
push ebx
push ebp
push esi
push edi
push 0x1000
push eax
xor ebp, ebp
call fcn.0042d3b0
mov ecx, dword [esp + 0x1bc]
push ebp
push 0x80
push 2
push ebp
push ebp
push 0x40000000
push ecx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, dword [esp + 0x1b4]
lea edx, [esp + 0x1c]
push edi
push edx
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov cl, byte [esp + eax + 0x1b]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp cl, 0x2f
je 0x42ada4
lea eax, [esp + 0x1c]
push 0x4451a0
push eax
call edi
mov ecx, dword [esp + 0x1b8]
lea edx, [esp + 0x1c]
push ecx
push edx
call edi
mov ebx, dword [esp + 0x1b0]
push 0
push 0x4000000
push 0xffffffffffffffff
lea eax, [esp + 0x28]
push str.Accept:_r_n
push eax
push ebx
call fcn.0042aee0
mov edi, eax
add esp, 0x18
test edi, edi
je 0x42ae8c
lea ecx, [esp + 0x14]
push ecx
push 0xfa0
push esi
push edi
push ebx
call fcn.0042af70
add esp, 0x14
test eax, eax
je 0x42ae31
mov eax, dword [esp + 0x14]
test eax, eax
je 0x42ae31
jbe 0x42ae18
lea edx, [esp + 0x18]
push 0
push edx
push eax
mov eax, dword [esp + 0x1c]
push esi
push eax
inc ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea ecx, [esp + 0x14]
push ecx
push 0xfa0
push esi
push edi
push ebx
call fcn.0042af70
add esp, 0x14
test eax, eax
jne 0x42adf9
push edi
push ebx
call fcn.0042afb0
add esp, 8
cmp ebp, 1
jne 0x42ae57
push str._body_
push esi
mov byte [esi + 6], 0
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x42ae57
or ebp, 0xffffffff
test esi, esi
je 0x42ae68
mov edx, dword [0x44515c]
push esi
push edx
call fcn.0042d4d0
mov eax, dword [esp + 0x10]
test eax, eax
je 0x42ae77
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebp, 0xffffffff
je 0x42aeac
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x19c
ret
test esi, esi
je 0x42ae9d
mov edx, dword [0x44515c]
push esi
push edx
call fcn.0042d4d0
mov eax, dword [esp + 0x10]
test eax, eax
je 0x42aeac
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x1bc]
lea eax, [esp + 0x124]
push 0x200
push eax
push ecx
call fcn.0042c7c0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x19c
ret
Function at 0x42b220
Capabilities:
Get file size

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 0x194
lea edx, [esp + 4]
push ebp
mov ebp, dword [esp + 0x1a0]
push esi
xor esi, esi
mov dword [eax], esi
mov ecx, dword [ebp + 0x18]
push edi
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x10]
push str.Image
push eax
call fcn.0042c0b0
test eax, eax
je 0x42b2e0
lea ecx, [esp + 0x118]
push esi
lea edx, [esp + 0x14]
push ecx
push edx
call fcn.0042c7c0
mov edi, eax
cmp edi, 0xffffffff
je 0x42b2e0
lea eax, [esp + 0xc]
push ebx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
mov ecx, esi
shr ecx, 6
add ecx, 2
push ecx
push 0x7ffe
call fcn.0042d3b0
mov ebx, eax
mov eax, dword [ebp + 8]
cmp eax, 2
jne 0x42b2af
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll__hread]
jmp 0x42b2c3
mov ebp, dword [sym.imp.KERNEL32.dll__hread]
push 0xe
push ebx
push edi
call ebp
sub esi, 0xe
push esi
push ebx
push edi
call ebp
mov edx, dword [esp + 0x1b0]
push edi
mov dword [edx], esi
call dword [sym.imp.KERNEL32.dll__lclose]
mov eax, ebx
pop ebx
pop edi
pop esi
pop ebp
add esp, 0x194
ret
mov eax, esi
pop edi
pop esi
pop ebp
add esp, 0x194
ret

Function at 0x42c6d0
Capabilities:
Get common file path

Disassembly:
mov ecx, dword [esp + 8]
sub esp, 0x108
lea eax, [esp]
push esi
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov esi, eax
lea edx, [esp + 4]
mov eax, dword [esp + 0x110]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
xor eax, eax
test esi, esi
setne al
pop esi
add esp, 0x108
ret 8

Function at 0x42c710
Capabilities:
Set current directory

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x108
lea eax, [esp]
push eax
push ecx
call fcn.0042ce70
lea edx, [esp]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
add esp, 0x108
ret 4

Function at 0x42c740
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x108
lea eax, [esp]
push esi
mov esi, dword [esp + 0x114]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
push esi
push eax
push str.TEMP
call edi
test eax, eax
jne 0x42c790
lea ecx, [esp + 8]
push esi
push ecx
push str.temp
call edi
test eax, eax
jne 0x42c790
mov edx, dword [esp + 0x114]
push esi
push edx
call fcn.0042c6d0
pop edi
pop esi
add esp, 0x108
ret 8
mov ecx, dword [esp + 0x114]
lea eax, [esp + 8]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop edi
mov eax, 1
pop esi
add esp, 0x108
ret 8
Function at 0x42c7c0
Capabilities:
Delete file

Disassembly:
push esi
mov esi, dword [esp + 0x10]
cmp esi, 0x1000
ja 0x42c7fe
je 0x42c7ed
test esi, esi
je 0x42c80d
cmp esi, 0x200
jne 0x42c806
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
or eax, 0xffffffff
pop esi
ret 0xc
mov eax, 3
mov ecx, 0xc0000000
mov edx, 2
jmp 0x42c81c
cmp esi, 0x4000
je 0x42c80d
or eax, 0xffffffff
pop esi
ret 0xc
mov eax, 1
mov ecx, 0x80000000
mov edx, 3
push edi
push 0
push 0x80
push edx
push 0
push eax
push ecx
mov ecx, dword [esp + 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp esi, 0x4000
mov edi, eax
jne 0x42c853
cmp edi, 0xffffffff
je 0x42c851
push edi
call dword [sym.imp.KERNEL32.dll__lclose]
mov eax, edi
pop edi
pop esi
ret 0xc
xor edi, edi
mov eax, edi
pop edi
pop esi
ret 0xc

Function at 0x42d840
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x1c
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
push ebp
push esi
push edi
call ebx
mov esi, dword [esp + 0x34]
mov ebp, eax
mov edi, esi
and esi, 0x7fffffff
shr edi, 0x1f
cmp esi, 0x2bf20
jbe 0x42d875
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x1c
ret 0xc
call ebx
sub eax, ebp
cmp eax, esi
jae 0x42d8d9
test edi, edi
push 1
je 0x42d8b7
push 0
push 0
lea eax, [esp + 0x1c]
push 0
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x42d8bd
cmp dword [esp + 0x14], 0x12
je 0x42d8d1
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x42d8bd
call dword [sym.imp.KERNEL32.dll_Sleep]
call ebx
sub eax, ebp
cmp eax, esi
jb 0x42d87d
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1c
ret 0xc
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1c
ret 0xc
Function at 0x42dfc0
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x94
lea ecx, [esp + 0x44]
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push eax
push ecx
call edi
lea edx, [esp + 0x54]
push 0x445388
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
xor ebx, ebx
test eax, eax
jne 0x42e05a
lea eax, [esp + 0x14]
lea ecx, [esp + 0x10]
push eax
push ecx
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionFontSubstitutes
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, ebx
jne 0x42e05a
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x14]
lea eax, [esp + 0x7c]
push edx
push eax
push ebx
push ebx
push str.MS_Shell_Dlg
push ecx
mov dword [esp + 0x2c], 0x28
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
jne 0x42e05a
lea eax, [esp + 0x7c]
lea ecx, [esp + 0x54]
push eax
push ecx
call edi
cmp dword [0x446d54], ebx
jne 0x42e067
call fcn.0042df00
mov ebp, dword [esp + 0xa8]
cmp ebp, ebx
jne 0x42e078
mov ebp, dword [0x4478fc]
mov edx, dword [0x446d54]
xor esi, esi
push edx
call fcn.0042c8a0
mov edi, eax
cmp edi, ebx
je 0x42e0b2
lea eax, [esp + 0x54]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x42e09e
mov esi, edi
mov ecx, dword [0x446d54]
push ecx
call fcn.0042c8e0
cmp esi, ebx
mov edi, eax
je 0x42e088
jmp 0x42e0b6
cmp esi, ebx
je 0x42e102
lea edx, [esp + 0x34]
push esi
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov al, byte [esi + 0x2a]
imul ebp, dword [esp + 0xb0]
mov byte [esp + 0x2f], al
mov cl, byte [esi + 0x29]
mov byte [esp + 0x31], cl
mov dl, byte [esi + 0x28]
mov eax, 0xc71c71c7
mov byte [esp + 0x30], dl
imul ebp
sar edx, 4
mov eax, edx
mov byte [esp + 0x32], 1
shr eax, 0x1f
add edx, eax
mov dword [esp + 0x18], edx
mov cl, byte [esi + 0x24]
mov byte [esp + 0x33], cl
jmp 0x42e146
lea edx, [esp + 0x34]
push str.Arial
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, 0xc71c71c7
mov byte [esp + 0x32], 1
imul ebp, dword [esp + 0xb0]
imul ebp
sar edx, 4
mov eax, edx
mov byte [esp + 0x30], 7
shr eax, 0x1f
add edx, eax
mov byte [esp + 0x33], 0x22
mov dword [esp + 0x18], edx
mov byte [esp + 0x31], bl
mov byte [esp + 0x2f], bl
mov ecx, dword [esp + 0xb4]
mov edi, dword [esp + 0xb8]
neg ecx
mov esi, dword [esp + 0xbc]
mov dword [esp + 0x24], ebx
sbb ecx, ecx
mov byte [esp + 0x2e], bl
and ecx, 0x12c
mov dword [esp + 0x1c], ebx
add ecx, 0x190
cmp edi, ebx
setne dl
cmp esi, ebx
mov dword [esp + 0x28], ecx
setne al
mov byte [esp + 0x2d], al
mov eax, dword [esp + 0xc4]
mov byte [esp + 0x2c], dl
lea edx, [esp + 0x18]
lea ecx, [eax + eax*4]
push edx
shl ecx, 1
mov dword [esp + 0x24], ecx
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x94
ret 0x20