joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4cac40
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov eax, dword [0x59c388]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x88]
push ecx
lea ecx, [ebp - 0x84]
mov dword [ebp - 0x88], 0x80
push ecx
mov eax, dword [edi + 0x1ac]
or esi, 0xffffffff
mov ebx, dword [edi]
push eax
mov dword [ebp - 0x8c], eax
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x4cacb3
lea eax, [ebp - 0x88]
mov dword [ebp - 0x88], 0x80
push eax
lea eax, [ebp - 0x84]
push eax
push dword [ebp - 0x8c]
call dword [sym.imp.WS2_32.dll_accept]
mov esi, eax
push dword [ebp - 0x8c]
push edi
call fcn.004acb40
add esp, 8
cmp esi, 0xffffffff
jne 0x4caceb
push str.Error_accept__ing_server_connect
push ebx
call fcn.004ac0c0
add esp, 8
mov eax, 0x1e
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004f3d68
mov esp, ebp
pop ebp
ret
push str.Connection_accepted_from_server_n
push ebx
call fcn.004ac1a0
push 1
push esi
mov byte [edi + 0x28c], 0
mov dword [edi + 0x1ac], esi
call fcn.004d1370
add esp, 0x10
mov byte [edi + 0x1b9], 1
cmp dword [ebx + 0x1d8], 0
je 0x4cad67
push 1
push ebx
call fcn.0049c3b0
mov eax, dword [ebx + 0x1d8]
push 1
push esi
push dword [ebx + 0x1dc]
call eax
push 0
push ebx
mov esi, eax
call fcn.0049c3b0
add esp, 0x1c
test esi, esi
je 0x4cad67
push edi
call fcn.004cb220
add esp, 4
mov eax, 0x2a
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004f3d68
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004f3d68
mov esp, ebp
pop ebp
ret
Function at 0x4ccc20
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
lea eax, [ecx - 0xc8]
mov edx, dword [edi]
cmp eax, 0x64
jb 0x4ccc4f
push str.Couldnt_set_desired_mode
push edx
call fcn.004ac0c0
add esp, 8
lea eax, [esi + 0x11]
pop edi
pop esi
pop ebp
ret
cmp ecx, 0xc8
je 0x4ccc66
push ecx
push str.Got_a__03d_response_code_instead_of_the_assumed_200_n
push edx
call fcn.004ac1a0
add esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
cmp eax, 0x13
jne 0x4ccc7f
push edi
call fcn.004ccb30
add esp, 4
mov esi, eax
pop ebx
pop edi
pop esi
pop ebp
ret
cmp eax, 0x14
jne 0x4ccd9b
mov ebx, dword [edi]
xor edx, edx
mov esi, dword [ebx + 0x4ba4]
mov dword [ebp + 8], edx
cmp dword [ebx + 0x4e0], 2
jne 0x4cccff
test esi, esi
je 0x4cccff
cmp byte [esi], dl
je 0x4cccff
push 0x2f
push esi
call fcn.0050c050
add esp, 8
test eax, eax
je 0x4cccfc
mov ecx, esi
lea edx, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4cccc0
sub ecx, edx
cmp byte [ecx + esi - 1], 0x2f
je 0x4cccdf
push 0x2f
push esi
call fcn.0050c5f0
mov ecx, eax
add esp, 8
sub ecx, esi
push 1
push 0
lea eax, [ebp + 8]
push eax
push ecx
push esi
push ebx
call fcn.004c0000
mov esi, eax
add esp, 0x18
test esi, esi
jne 0x4ccdc8
mov edx, dword [ebp + 8]
mov ecx, dword [ebx + 0x550]
test ecx, ecx
jne 0x4ccd1d
cmp byte [ebx + 0x4f5], 0
mov ecx, str.NLST
mov eax, str.LIST
cmove ecx, eax
mov esi, 0x543890
test edx, edx
mov eax, esi
cmovne eax, edx
push eax
mov eax, 0x545754
cmove eax, esi
push eax
push ecx
push 0x553a20
call fcn.004ae930
mov ebx, eax
add esp, 0x10
test ebx, ebx
jne 0x4ccd5f
push dword [ebp + 8]
call dword [0x59c2b4]
add esp, 4
mov esi, 0x1b
mov eax, esi
pop ebx
pop edi
pop esi
pop ebp
ret
push ebx
lea eax, [edi + 0x518]
push 0x5457ac
push eax
call fcn.004d7090
push dword [ebp + 8]
mov esi, eax
call dword [0x59c2b4]
push ebx
call dword [0x59c2b4]
add esp, 0x14
test esi, esi
jne 0x4ccdc8
pop ebx
mov dword [edi + 0x590], 0x1f
mov eax, esi
pop edi
pop esi
pop ebp
ret
cmp eax, 0x15
jne 0x4ccdb4
push 0xd
push 1
push edi
call fcn.004cc690
add esp, 0xc
mov esi, eax
pop ebx
pop edi
pop esi
pop ebp
ret
cmp eax, 0x16
jne 0x4ccdc8
push 0xe
push 1
push edi
call fcn.004cc690
add esp, 0xc
mov esi, eax
pop ebx
pop edi
mov eax, esi
pop esi
pop ebp
ret
Function at 0x4d82e0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push esi
push edi
mov byte [edi], 0
call dword [sym.imp.WS2_32.dll_gethostname]
mov byte [edi + esi - 1], 0
test eax, eax
jne 0x4d8313
push 0x2e
push edi
call fcn.0050c050
add esp, 8
test eax, eax
je 0x4d8311
mov byte [eax], 0
xor eax, eax
pop edi
pop esi
pop ebp
ret

Function at 0x4f6f9e
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x529929
Capabilities:
Hash data using murmur3

Disassembly:
sti
dec dword [ebx + 0x2b]
fadd qword [ebx + 0x31]
add eax, 0x5a1e89
xor edi, esp
dec edi
xchg ebx, esi
or eax, dword [0x5a1f5f]
xchg ebx, eax
call fcn.0043b013
xor ecx, dword [0x5a1f0e]
dec esi
rol edx, 0x1d
sub esi, edx
call fcn.00429b05
lock inc dword [ecx]
or eax, 0x5a1eb7
ror ebx, 0x14
or ecx, dword [0x5a1f8b]
call fcn.0041a8b4
mov dword [0x5a1e73], eax
call fcn.00474daa
jge 0x5298df
hlt
inc ecx
ret
adc al, 0xe8
in eax, dx
xchg edx, eax
idiv edi
add esi, edx
ror edx, 0x1d
inc esi
call fcn.004ab20d
xchg ebx, eax
xchg ebx, esi
inc edi
xor edi, esp
add dword [0x5a1e39], edi
dec ebx
add ebx, esp
inc ebx
push ebx
sub edx, dword [0x5a1f22]
jge 0x5298df
hlt
dec ebx
xor ecx, edx
sub ecx, dword [0x5a1efb]
ror ebx, 0x13
call fcn.00497664
xor ecx, 0xe5652a8e
not esi
rol esi, 3
neg esi
call fcn.0050b51a
not esi
call fcn.00508e1b
not ebx
and dword [0x5a1e51], ecx
invalid
Function at 0x529ca6
Capabilities:
Hash data using murmur3

Disassembly:
or eax, 0x5a1f1a
add ecx, 0xa22b7898
add dword [0x5a1e1f], ecx
call fcn.004748d9
xor eax, ebx
rol eax, 0xa
sub eax, 0x87eb05d8
call fcn.0047ebb3
call fcn.0041a5a2
add eax, 0x87eb05d8
ror eax, 0xa
xor eax, ebx
call fcn.0051718d
or dword [0x5a1edd], esi
sub ecx, 0xa22b7898
call fcn.0048e389
sub edi, 0x59874b4f
inc ecx
inc ecx
push ecx
not esi
inc edi
call fcn.004a0762
neg edi
xchg edx, eax
xor edi, dword [0x5a1f57]
ror esi, 0xa
call fcn.0040d0a1
sub ebx, edx
or dword [0x5a1eb8], edx
and dword [0x5a1e9e], ecx
xor esi, dword [0x5a1f91]
call fcn.004d1e49
call fcn.0041a82a
xor dword [0x5a1ea9], esi
add ebx, edx
call fcn.00519c90
rol esi, 0xa
xchg edx, eax
neg edi
dec edi
not esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
xor edx, 0xff4dcb72
xchg edx, eax
call fcn.0040b6a0
xor esi, dword [0x5a1f18]
sub ecx, 0x278154a1
add eax, dword [0x5a1f6f]
xor edx, dword [0x5a1f9b]
xor edi, eax
xor ecx, eax
add ecx, edi
or edi, dword [0x5a1fb8]
add eax, dword [0x5a1f20]
call fcn.00406850
xor edx, esi
and dword [0x5a1eb7], 0xd67b043d
xor dword [0x5a1eae], edi
or eax, dword [0x5a1f7e]
sub eax, 0x8fa8260a
xchg esi, eax
neg esi
and dword [0x5a1eb8], ecx
neg esi
xchg esi, eax
add eax, 0x8fa8260a
xor dword [0x5a1eca], esi
xor dword [0x5a1ed8], 0x85fb8632
xor edx, esi
call fcn.00468bf5
sub ecx, edi
xor ecx, eax
xor edi, eax
add ecx, 0x278154a1
call fcn.00511fcd
xchg edx, eax
xor edx, 0xff4dcb72
lea esi, [0xaf7ac2]
add esi, esp
neg ecx
xor esi, dword [0x5a1f6a]
inc esi
mov dword [0x5a1e15], esi
sub edi, 0x1813954e
inc eax
inc esi
neg ecx
add eax, esi
xor dword [0x5a1ec9], edx
ror ecx, 4
call fcn.004c42e9
neg esi
inc eax
xor dword [0x5a1e39], ebx
call fcn.004d326d
call fcn.00416f68
dec eax
neg esi
call fcn.005115af
rol ecx, 4
mov dword [0x5a1e7d], ebx
sub eax, esi
neg ecx
dec esi
dec eax
add edi, 0x1813954e
xor dword [0x5a1edc], ebx
dec esi
neg ecx
sub esi, esp
or esi, 0x8000
neg edx
add edx, edi
ror ecx, 1
xor eax, dword [0x5a1f01]
neg ebx
add edi, dword [0x5a1f3c]
rol ebx, 0x1f
dec ecx
call fcn.0044fa19
ror edi, 0x12
rol edi, 0x12
call fcn.00409480
inc ecx
ror ebx, 0x1f
neg ebx
rol ecx, 1
sub edx, edi
Function at 0x529e94
Capabilities:
Hash data using murmur3

Disassembly:
neg edx
xor esi, 0x7ac2
xor eax, ebp
xchg eax, esi
mov dword [0x5a1e04], ebx
sub esi, eax
inc edi
not ebx
sub edi, dword [0x5a1f74]
xor esi, 0x5ab06391
or dword [0x5a1e91], ebx
add dword [0x5a1e55], 0xc849b04a
rol edi, 0x18
sub ebx, ebp
call fcn.004c2bc6
add ebx, ebp
ror edi, 0x18
mov dword [0x5a1e54], 0x78e257fc
xor esi, 0x5ab06391
not ebx
dec edi
add esi, eax
xchg eax, esi
xor eax, ebp
mov edi, eax
add dword [0x5a1e2d], edi
sub eax, ebx
rol eax, 0x1a
neg esi
xor ebx, dword [0x5a1f97]
xor edi, eax
neg eax
sub ebx, 0x44b914ca
and dword [0x5a1edc], esi
ror ebx, 2
neg esi
mov dword [0x5a1e71], eax
or ebx, dword [0x5a1f05]
xor ecx, edx
xor ecx, ebp
neg eax
rol ebx, 0x1d
xchg ecx, eax
add dword [0x5a1e4e], edi
add ebx, 0x1e58810d
call fcn.0046ee5c
sub ebx, 0x1e58810d
xchg ecx, eax
ror ebx, 0x1d
neg eax
xor ecx, ebp
xor ecx, edx
add dword [0x5a1e48], ecx
neg esi
rol ebx, 2
xor dword [0x5a1e0c], edi
add ebx, 0x44b914ca
neg eax
xor edi, eax
neg esi
ror eax, 0x1a
add eax, ebx
or dword [0x5a1e80], esi
mov ecx, 0x4fc3e
or edi, dword [0x5a1f73]
xchg edi, esi
add dword [0x5a1e28], ecx
dec edx
xchg edi, eax
rol ecx, 0x17
add edx, ebp
ror esi, 1
xor esi, dword [0x5a1fbd]
neg ebx
inc eax
xor edx, ebp
xor edx, 0xf1058588
xor edi, ebp
xchg eax, edx
xor dword [0x5a1e64], eax
rol ecx, 0xf
sub edi, esp
xchg esi, eax
xor esi, edi
call fcn.004ae98b
call fcn.004daa1a
xor esi, edi
xchg esi, eax
add edi, esp
ror ecx, 0xf
and dword [0x5a1e0b], eax
xchg eax, edx
xor edi, ebp
xor edx, 0xf1058588
xor edx, ebp
dec eax
neg ebx
rol esi, 1
sub edx, ebp
ror ecx, 0x17
xchg edi, eax
inc edx
mov dword [0x5a1ed2], edx
add byte [edi - 0x85b0c09], al
rol dword [ecx - 0x102e8e10], 1
rol byte [ebx], 0x3d
push es
pop ds
pop edx
add cl, al
into
sbb eax, dword [ecx + 0x19f95ff6]
add ebx, ecx

Function at 0x52ba6b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0052b8e1
Function at 0x536ae0
Capabilities:
Get cpu information
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x541bd9
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x59c388]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x60]
mov edi, dword [ebp + 0xc]
push eax
push 0x20019
push 0
push str.HARDWAREDESCRIPTIONSystemCentralProcessor0
mov dword [ebp - 0x64], esi
push reloc.WS2_32.dll_bind
mov dword [ebp - 0x58], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x536b4c
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
jmp 0x536b99
lea eax, [ebp - 0x5c]
mov dword [ebp - 0x5c], 0x41
push eax
lea eax, [ebp - 0x54]
push eax
push 0
push 0
push edi
push dword [ebp - 0x60]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
test eax, eax
jne 0x536b99
lea ecx, [ebp - 0x54]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x536b84
sub ecx, edx
lea eax, [ebp - 0x54]
push ecx
push eax
mov ecx, esi
call fcn.00401b20
mov dword [ebp - 4], 0
mov dword [ebp - 0x58], 1
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004f3d68
mov esp, ebp
pop ebp
ret
Function at 0x401e80
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x5a9004]
sub esp, 0xc
cmp eax, 0xffffffff
jne 0x4020c6
push ebx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.SoftwareHNCGlobal_Settings9.6User_Locales
push SysReAllocString
call edi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x401efd
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
push 0x5a9004
lea eax, [ebp - 0xc]
push eax
push 0
push str.LCID
push dword [ebp - 4]
call ebx
test eax, eax
jne 0x401eee
cmp dword [ebp - 0xc], 4
je 0x401ef8
mov dword [0x5a9004], 0xffffffff
push dword [ebp - 4]
call esi
mov eax, dword [0x5a9004]
cmp eax, 0xffffffff
jne 0x4020c3
lea eax, [ebp - 4]
push eax
push 0x20219
push 0
push str.SoftwareHNCGlobal_Settings9.6User_Locales
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
jne 0x401f5f
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
push 0x5a9004
lea eax, [ebp - 0xc]
push eax
push 0
push str.LCID
push dword [ebp - 4]
call ebx
test eax, eax
jne 0x401f50
cmp dword [ebp - 0xc], 4
je 0x401f5a
mov dword [0x5a9004], 0xffffffff
push dword [ebp - 4]
call esi
mov eax, dword [0x5a9004]
cmp eax, 0xffffffff
jne 0x4020c3
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.SoftwareHNCGlobal_Settings9.0User_Locales
push SysReAllocString
call edi
test eax, eax
jne 0x401fc1
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
push 0x5a9004
lea eax, [ebp - 0xc]
push eax
push 0
push str.LCID
push dword [ebp - 4]
call ebx
test eax, eax
jne 0x401fb2
cmp dword [ebp - 0xc], 4
je 0x401fbc
mov dword [0x5a9004], 0xffffffff
push dword [ebp - 4]
call esi
mov eax, dword [0x5a9004]
cmp eax, 0xffffffff
jne 0x4020c3
lea eax, [ebp - 4]
push eax
push 0x20219
push 0
push str.SoftwareHNCGlobal_Settings9.0User_Locales
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
jne 0x402023
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
push 0x5a9004
lea eax, [ebp - 0xc]
push eax
push 0
push str.LCID
push dword [ebp - 4]
call ebx
test eax, eax
jne 0x402014
cmp dword [ebp - 0xc], 4
je 0x40201e
mov dword [0x5a9004], 0xffffffff
push dword [ebp - 4]
call esi
mov eax, dword [0x5a9004]
cmp eax, 0xffffffff
jne 0x4020c3
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLCID]
cmp eax, 0x412
je 0x4020b3
cmp eax, 0x409
je 0x4020b3
cmp eax, 0x401
je 0x4020b3
cmp eax, 0x804
je 0x4020b3
cmp eax, 0x404
je 0x4020b3
cmp eax, 0x411
je 0x4020b3
cmp eax, 0x407
je 0x4020b3
cmp eax, 0x419
je 0x4020b3
cmp eax, 0x40a
je 0x4020b3
cmp eax, 0x416
je 0x4020b3
cmp eax, 0x429
je 0x4020b3
cmp eax, 0x413
je 0x4020b3
cmp eax, 0x40c
je 0x4020b3
cmp eax, 0x809
je 0x4020b3
cmp eax, 0xc0a
je 0x4020b3
cmp eax, 0x410
je 0x4020b3
cmp eax, 0x415
je 0x4020b3
mov eax, dword [0x5a9004]
cmp eax, 0xffffffff
mov ecx, 0x409
cmove eax, ecx
mov dword [0x5a9004], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4048a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4048b5
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4048f4
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x4048f0
lea ebx, [ebx]
cmp esi, edx
jae 0x4048f4
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
dec ecx
jne 0x4048e0
cmp esi, edx
jb 0x4048f9
xor eax, eax
pop esi
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop ebp
ret

Function at 0x405c80
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
movzx eax, ax
mov dword [ebp + 8], eax
pop ebp
jmp fcn.00417cce
Function at 0x40b3db
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 4], ecx
mov esi, edi
cmp dword [ebp + 8], esi
je 0x40b420
call fcn.00408e83
push 0xf0
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x40b420
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x40b43c
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.00416e21
mov ebx, eax
test edi, edi
je 0x40b43a
test esi, esi
je 0x40b43a
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x416a1d
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
mov ecx, dword [esi + 4]
call fcn.004171b3
push 0xfffffffffffffff0
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
push dword [ebp + 0xc]
and eax, 3
mov ecx, esi
cmp al, 3
je 0x416a59
call fcn.00416c3c
mov dword [esi + 0xc], 1
jmp 0x416a5e
call fcn.00416c3c
cmp dword [esi], 0
je 0x416aa7
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov esi, dword [ebp + 0x10]
test eax, eax
jle 0x416a81
lea ecx, [eax + 1]
push ecx
push eax
mov ecx, esi
call fcn.004085be
jmp 0x416a92
push 0xff
mov ecx, esi
call fcn.00403800
push 0x100
push eax
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0xffffffffffffffff
mov ecx, esi
call fcn.004085e1
jmp 0x416acb
mov esi, dword [ebp + 0x10]
push dword [esi]
push 0xffffffffffffffff
push 0x14d
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
jne 0x416acb
push dword [esi]
push dword [ebp - 4]
call fcn.0041be23
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x416b91
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
push edi
push dword [ebp + 0xc]
call fcn.00416c3c
cmp dword [esi], 0
mov edi, eax
mov dword [esi + 0xc], 1
je 0x416bd9
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.004085be
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.004085e1
jmp 0x416be4
mov eax, dword [ebp + 0x10]
push dword [eax]
push edi
call fcn.0041be23
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x417d2a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor esi, esi
call fcn.00408e83
push 5
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x417d61
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
mov ecx, dword [ebp - 4]
push ebx
push dword [ebp + 0xc]
push esi
call fcn.00417d82
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x43d56b
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, ecx
call fcn.0047488e
call fcn.00408ed7
cmp dword [eax + 0x14], 0
jne 0x43d586
mov ecx, esi
pop esi
jmp fcn.0043c971
pop esi
ret

Function at 0x43e30c
Capabilities:
Get common file path
Get file system object information

Disassembly:
push esi
mov esi, ecx
call fcn.004632c0
call fcn.00408ed7
cmp dword [eax + 0x14], 0
jne 0x43e327
mov ecx, esi
pop esi
jmp fcn.0043db97
pop esi
ret
Function at 0x5407f8
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5aa060]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.005356c3
mov dword [ebp - 0x14], eax
cmp dword [0x5b5e50], esi
jne 0x5408eb
push 0x800
push esi
push 0x585420
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x540878
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x5409cb
push esi
push esi
push 0x585420
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x5409cb
push 0x585438
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x5409cb
push eax
call ebx
push 0x585444
push edi
mov dword [0x5b5e50], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x585454
push edi
mov dword [0x5b5e54], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x5b5e58], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x5b5e60], eax
test eax, eax
je 0x5408e8
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x5b5e5c], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x540910
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x540903
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x540925
push 4
pop eax
jmp 0x5409cd
cmp dword [ebp - 0x14], esi
je 0x540925
push dword [0x5b5e50]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x54090a
mov eax, dword [0x5b5e5c]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x540983
cmp dword [0x5b5e60], edi
je 0x540983
push eax
call ebx
push dword [0x5b5e60]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x540983
test eax, eax
je 0x540983
call ecx
test eax, eax
je 0x540978
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x540978
test byte [ebp - 8], 1
jne 0x540983
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x5409b3
mov eax, dword [0x5b5e54]
cmp eax, edi
je 0x5409b0
push eax
call ebx
test eax, eax
je 0x5409b0
call eax
mov esi, eax
test esi, esi
je 0x5409b0
mov eax, dword [0x5b5e58]
cmp eax, edi
je 0x5409b0
push eax
call ebx
test eax, eax
je 0x5409b0
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x5b5e50]
call ebx
test eax, eax
je 0x5409cb
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x5409cd
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0052e0dd
mov esp, ebp
pop ebp
ret