joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43ea87
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x838
mov eax, 0x744161
call fcn.005f004f
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x828]
mov eax, dword [ebp + 0x14]
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x840], edi
mov dword [ebp - 0x82c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x840], eax
mov eax, dword [ebp + 0x1c]
push eax
call fcn.00409440
xor ecx, ecx
lea eax, [ebp - 0x830]
push eax
push 0x20119
push ecx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push reloc.WS2_32.dll_closesocket
mov dword [ebp - 4], ecx
mov dword [ebp - 0x830], ecx
mov dword [ebp - 0x83c], ecx
mov dword [ebp - 0x838], ecx
mov dword [ebp - 0x834], ecx
call esi
test eax, eax
je 0x43eb29
xor eax, eax
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], eax
mov byte [ebp - 0x82c], al
push dword [ebp - 0x82c]
mov ecx, edi
lea eax, [ebp - 0x828]
push eax
call fcn.0040a530
jmp 0x43ec79
lea eax, [ebp - 0x83c]
push eax
push 0x20119
push 0
push str.SoftWare
push dword [ebp - 0x830]
call esi
test eax, eax
je 0x43eb56
push dword [ebp - 0x830]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x43eb02
lea eax, [ebp - 0x838]
push eax
push 0x20119
push 0
push ebx
push dword [ebp - 0x83c]
call esi
test eax, eax
je 0x43eb8c
push dword [ebp - 0x83c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x830]
call esi
jmp 0x43eb02
lea eax, [ebp - 0x834]
xor ebx, ebx
push eax
push 0x20119
push ebx
push dword [ebp - 0x82c]
push dword [ebp - 0x838]
call esi
test eax, eax
je 0x43ebdc
push dword [ebp - 0x834]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x838]
call esi
push dword [ebp - 0x830]
call esi
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
mov byte [ebp - 0x82c], bl
jmp 0x43eb10
push 0x800
lea eax, [ebp - 0x810]
push ebx
push eax
call fcn.005c1f30
add esp, 0xc
mov dword [ebp - 0x844], 0x400
lea eax, [ebp - 0x844]
push eax
lea eax, [ebp - 0x810]
push eax
push ebx
push ebx
push dword [ebp - 0x840]
push dword [ebp - 0x834]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x834]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x838]
call esi
push dword [ebp - 0x83c]
call esi
push dword [ebp - 0x830]
call esi
lea eax, [ebp - 0x810]
push eax
call fcn.005c5a2e
pop ecx
mov ecx, edi
test eax, eax
jne 0x43ec6d
mov byte [ebp - 0x840], bl
push dword [ebp - 0x840]
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
jmp 0x43eb18
lea eax, [ebp - 0x810]
push eax
call fcn.00409440
lea ecx, [ebp - 0x828]
call fcn.0040a140
mov eax, edi
call fcn.005f000a
ret
Function at 0x43ec8c
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x834
mov eax, 0x744194
call fcn.005f004f
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x828]
mov eax, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x83c], edi
mov dword [ebp - 0x82c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x83c], eax
mov eax, dword [ebp + 0x18]
push eax
call fcn.00409440
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x838]
push eax
xor ecx, ecx
push 0x20119
push ecx
push str.SoftWare
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], ecx
mov dword [ebp - 0x838], ecx
mov dword [ebp - 0x834], ecx
mov dword [ebp - 0x830], ecx
call esi
test eax, eax
je 0x43ed2a
and dword [edi + 0x10], 0
and dword [edi + 0x14], 0
mov byte [ebp - 0x82c], 0
push dword [ebp - 0x82c]
mov ecx, edi
lea eax, [ebp - 0x828]
push eax
call fcn.0040a530
jmp 0x43ee3e
lea eax, [ebp - 0x834]
push eax
push 0x20119
push 0
push ebx
push dword [ebp - 0x838]
call esi
test eax, eax
je 0x43ed61
push dword [ebp - 0x838]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], eax
mov byte [ebp - 0x82c], al
jmp 0x43ed11
lea eax, [ebp - 0x830]
xor ebx, ebx
push eax
push 0x20119
push ebx
push dword [ebp - 0x82c]
push dword [ebp - 0x834]
call esi
test eax, eax
je 0x43eda9
push dword [ebp - 0x834]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x830]
call esi
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
mov byte [ebp - 0x82c], bl
jmp 0x43ed11
push 0x800
lea eax, [ebp - 0x810]
push ebx
push eax
call fcn.005c1f30
add esp, 0xc
mov dword [ebp - 0x840], 0x400
lea eax, [ebp - 0x840]
push eax
lea eax, [ebp - 0x810]
push eax
push ebx
push ebx
push dword [ebp - 0x83c]
push dword [ebp - 0x830]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x830]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x834]
call esi
push dword [ebp - 0x838]
call esi
lea eax, [ebp - 0x810]
push eax
call fcn.005c5a2e
pop ecx
mov ecx, edi
test eax, eax
jne 0x43ee32
mov byte [ebp - 0x83c], bl
push dword [ebp - 0x83c]
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
jmp 0x43ed19
lea eax, [ebp - 0x810]
push eax
call fcn.00409440
lea ecx, [ebp - 0x828]
call fcn.0040a140
mov eax, edi
call fcn.005f000a
ret
Function at 0x43ee51
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7441c7
mov eax, dword fs:[0]
push eax
mov eax, 0x2030
call fcn.005f0180
mov eax, dword [0x85e00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x2028]
mov eax, dword [ebp + 0x14]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0x203c], edi
mov dword [ebp - 0x202c], eax
mov eax, dword [ebp + 0x18]
push eax
call fcn.00409440
xor ecx, ecx
lea eax, [ebp - 0x2038]
push eax
push 0xf013f
push ecx
push str.SoftWare
push reloc.WS2_32.dll_accept
mov dword [ebp - 4], ecx
mov dword [ebp - 0x2038], ecx
mov dword [ebp - 0x2034], ecx
mov dword [ebp - 0x2030], ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x43ef09
xor eax, eax
mov ecx, edi
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], eax
mov byte [ebp - 0x202c], al
push dword [ebp - 0x202c]
lea eax, [ebp - 0x2028]
push eax
call fcn.0040a530
jmp 0x43f009
xor ecx, ecx
lea eax, [ebp - 0x2034]
push ecx
push eax
push ecx
push 0xf013f
push ecx
push ecx
push ecx
push esi
push dword [ebp - 0x2038]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
call esi
test eax, eax
je 0x43ef3d
push dword [ebp - 0x2038]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x43eee2
xor ecx, ecx
lea eax, [ebp - 0x2030]
push ecx
push eax
push ecx
push 0xf013f
push ecx
push ecx
push ecx
push ebx
push dword [ebp - 0x2034]
call esi
test eax, eax
je 0x43ef78
push dword [ebp - 0x2034]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x2030]
call esi
jmp 0x43eee2
push 0x2000
xor ebx, ebx
lea eax, [ebp - 0x2010]
push ebx
push eax
call fcn.005c1f30
add esp, 0xc
mov dword [ebp - 0x203c], 0x1000
lea eax, [ebp - 0x203c]
push eax
lea eax, [ebp - 0x2010]
push eax
push ebx
push ebx
push dword [ebp - 0x202c]
push dword [ebp - 0x2030]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x2030]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x2034]
call esi
push dword [ebp - 0x2038]
call esi
lea eax, [ebp - 0x2010]
push eax
call fcn.005c5a2e
pop ecx
mov ecx, edi
test eax, eax
jne 0x43effd
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
mov byte [ebp - 0x202c], bl
jmp 0x43eef2
lea eax, [ebp - 0x2010]
push eax
call fcn.00409440
lea ecx, [ebp - 0x2028]
call fcn.0040a140
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00419933
leave
ret
Function at 0x43f030
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push edi
lea eax, [ebp - 0xc]
xor edi, edi
push eax
mov ebx, 0xf013f
mov dword [ebp - 0xc], edi
push ebx
push edi
push str.SoftWare
push reloc.WS2_32.dll_accept
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43f0ed
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea eax, [ebp - 8]
push edi
push eax
push edi
push ebx
push edi
push edi
push edi
push dword [ebp + 8]
push dword [ebp - 0xc]
call esi
test eax, eax
je 0x43f08e
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x43f0ec
push edi
lea eax, [ebp - 4]
push eax
push edi
push ebx
push edi
push edi
push edi
push dword [ebp + 0xc]
push dword [ebp - 8]
call esi
test eax, eax
je 0x43f0b4
push dword [ebp - 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 4]
jmp 0x43f0ea
push dword [ebp + 0x14]
call fcn.005c5a2e
pop ecx
lea eax, [eax*2 + 2]
push eax
push dword [ebp + 0x14]
push 1
push edi
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 8]
call esi
push dword [ebp - 0xc]
call esi
pop esi
pop edi
pop ebx
leave
ret

Function at 0x43f28b
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 8]
mov eax, ecx
push esi
push edi
mov dword [ebp - 4], eax
lea edi, [eax + 0x210]
mov esi, dword [edi]
mov dword [ebp - 8], edi
cmp esi, dword [eax + 0x214]
je 0x43f358
lea edi, [esi + 0x28]
lea ecx, [ebx + 0xa8]
mov dword [ebp + 8], edi
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x75bacc
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
sub edi, 0xffffff80
push edi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x75bacc
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea eax, [ebx + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x75bacc
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x75bacc
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea eax, [ebx + 0xa8]
push edi
push eax
call fcn.005d5d60
mov edi, dword [ebp + 8]
pop ecx
pop ecx
test eax, eax
jne 0x43f334
lea eax, [ebx + 0x28]
push edi
push eax
call fcn.005d5d60
pop ecx
pop ecx
test eax, eax
je 0x43f375
mov eax, 0x1b0
lea ecx, [ebx + 0xa8]
add edi, eax
add esi, eax
mov eax, dword [ebp - 4]
mov dword [ebp + 8], edi
cmp esi, dword [eax + 0x214]
jne 0x43f2be
mov edi, dword [ebp - 8]
lea eax, [ebx + 0xa8]
push eax
call fcn.005c5710
pop ecx
test eax, eax
je 0x43f375
push ebx
mov ecx, edi
call fcn.0043f1dd
mov al, 1
jmp 0x43f377
xor al, al
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x43fb57
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x85e00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov ebx, 0x114
push edi
push ebx
xor edi, edi
mov eax, dword [esi + 0x210]
mov dword [esi + 0x214], eax
lea eax, [ebp - 0x118]
push edi
push eax
call fcn.005c1f30
add esp, 0xc
mov dword [ebp - 0x118], ebx
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x108], 2
jne 0x43fbb8
mov ecx, esi
call fcn.0043f644
jmp 0x43fbcd
mov ebx, edi
test edi, edi
jne 0x43fbcd
mov ecx, esi
call fcn.0043f521
inc ebx
mov edi, eax
cmp ebx, 0xa
jl 0x43fbba
mov eax, dword [esi + 0x214]
mov ecx, 0x1b0
sub eax, dword [esi + 0x210]
cdq
idiv ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00419933
leave
ret
Function at 0x470310
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 0
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x80
je 0x470360
cmp dword [ebp + 0xc], 0x61
jb 0x470345
cmp dword [ebp + 0xc], 0x7a
ja 0x470345
mov ecx, dword [ebp + 0xc]
sub ecx, 0x20
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0xc]
push edx
mov ecx, dword [ebp - 4]
add ecx, 0x20c
call fcn.004f71f0
test eax, eax
je 0x470360
mov eax, dword [ebp - 8]
jmp 0x4703c3
mov ecx, dword [ebp - 4]
add ecx, 0x20c
call fcn.004f75f0
push eax
call fcn.004847f0
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4703b3
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0xc]
call fcn.00461720
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x10]
push ecx
mov ecx, dword [ebp - 4]
add ecx, 0x18
call fcn.004022f0
jmp 0x4703c0
push 0
mov ecx, dword [ebp - 4]
add ecx, 0x18
call fcn.004022f0
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x476cd0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x14], ecx
call fcn.00404880
test eax, eax
je 0x476cf3
call fcn.00403cd0
mov ecx, eax
call fcn.0044a710
mov dword [ebp - 0xc], eax
jmp 0x476cfa
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
push 0x2801
call fcn.005cd8ee
add esp, 4
mov dword [ebp - 8], eax
mov ecx, 1
imul edx, ecx, 0x2800
mov eax, dword [ebp - 8]
mov byte [eax + edx], 0
push 0x2800
mov ecx, dword [ebp - 8]
push ecx
lea ecx, [ebp - 0x20]
call fcn.00477630
lea ecx, [ebp + 8]
call fcn.0050b01a
push eax
push str.unhandled_xml_node:
lea ecx, [ebp - 0x20]
call fcn.00477b00
mov ecx, eax
call fcn.00477b20
cmp dword [ebp - 4], 0
je 0x476da3
push 1
push 0
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov ecx, dword [ebp - 4]
mov edx, dword [eax + 0x2c]
call edx
movzx eax, al
test eax, eax
je 0x476da3
mov ecx, dword [ebp + 4]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
push 0x7631c0
push 0x67d
push 0x7631e0
mov eax, dword [ebp - 8]
push eax
push 0x76322c
push 1
push 0
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov ecx, dword [ebp - 4]
mov eax, dword [edx + 0x34]
call eax
jmp 0x476e0b
mov ecx, 1
test ecx, ecx
je 0x476e0b
push 0x7632ac
push 0x67d
push 0x76325c
push str.F:PROJECT_BASE_st_pdfcommunalThirdParty_soui3SOUI_srccore_shostwnd.cpp
push 0x763258
push str.SOUI::SHostWnd::OnUserXmlNode
push 0x763234
lea ecx, [ebp - 0x20]
call fcn.00477b00
mov ecx, eax
call fcn.00477b00
mov ecx, eax
call fcn.00477b00
mov ecx, eax
call fcn.00477b00
mov ecx, eax
call fcn.00477b00
mov ecx, eax
call fcn.00477ad0
mov ecx, eax
call fcn.00477b00
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [ebp - 8]
push eax
call fcn.005cd8e9
add esp, 4
xor ecx, ecx
jne 0x476cd9
mov esp, ebp
pop ebp
ret 4
Function at 0x47a360
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x28], ecx
call fcn.00404880
test eax, eax
je 0x47a383
call fcn.00403cd0
mov ecx, eax
call fcn.0044a710
mov dword [ebp - 0x18], eax
jmp 0x47a38a
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 8], eax
push 0x2801
call fcn.005cd8ee
add esp, 4
mov dword [ebp - 4], eax
xor ecx, ecx
je 0x47a3dd
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
push eax
mov ecx, dword [ebp + 8]
call fcn.004022d0
push eax
push 0x763a30
push 0xffffffffffffffff
push 0x2800
mov ecx, dword [ebp - 4]
push ecx
call fcn.00413eb0
add esp, 0x18
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0x1c]
mov byte [edx], 0
jmp 0x47a471
push 0x5002
call fcn.005cd8ee
add esp, 4
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push ecx
mov ecx, dword [ebp + 8]
call fcn.004022d0
push eax
push str.Warning:_no_object__s_of_type:_d_in_SOUI__
push 0xffffffffffffffff
push 0x2800
mov edx, dword [ebp - 0x10]
push edx
call fcn.00413de0
add esp, 0x18
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0xc], 0x2800
jge 0x47a465
push 0
push 0
mov edx, dword [ebp - 0x20]
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x10]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0xc]
mov byte [eax], 0
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.005cd8e9
add esp, 4
cmp dword [ebp - 8], 0
je 0x47a4bb
push 1
push 0
mov edx, dword [ebp - 8]
mov eax, dword [edx]
mov ecx, dword [ebp - 8]
mov edx, dword [eax + 0x2c]
call edx
movzx eax, al
test eax, eax
je 0x47a4bb
mov ecx, dword [ebp + 4]
push ecx
push 0x763ae0
push 0x77
push 0x763b10
mov edx, dword [ebp - 4]
push edx
push 0x763b64
push 1
push 0
mov eax, dword [ebp - 8]
mov edx, dword [eax]
mov ecx, dword [ebp - 8]
mov eax, dword [edx + 0x34]
call eax
jmp 0x47a51e
mov ecx, 1
test ecx, ecx
je 0x47a51e
push 0x2801
call fcn.005cd8ee
add esp, 4
mov dword [ebp - 0x14], eax
push 0x77
push str.F:PROJECT_BASE_st_pdfcommunalThirdParty_soui3SOUI_srccoreSObjectFactory.cpp
push str.SOUI::SObjectFactoryMgr::OnCreateUnknownObject
mov edx, dword [ebp - 4]
push edx
push 0x763bf4
push 0xffffffffffffffff
push 0x2800
mov eax, dword [ebp - 0x14]
push eax
call fcn.00413eb0
add esp, 0x20
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x14]
add ecx, dword [ebp - 0x24]
mov byte [ecx], 0
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [ebp - 0x14]
push eax
call fcn.005cd8e9
add esp, 4
mov ecx, dword [ebp - 4]
push ecx
call fcn.005cd8e9
add esp, 4
xor edx, edx
jne 0x47a369
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x47ae80
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], ecx
push 0x15
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 8]
push edx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x47aef3
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 8]
push edx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 8]
push edx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x14], eax
push 0x30000
push 0
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.USER32.dll_CreateIconFromResource]
jmp 0x47af04
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 8]
push edx
call dword [sym.imp.USER32.dll_LoadCursorW]
mov esp, ebp
pop ebp
ret 4

Function at 0x47b010
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 8], ecx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 8]
call fcn.0047b1e0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x47b039
xor eax, eax
jmp 0x47b0c3
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x47b057
xor eax, eax
jmp 0x47b0c3
mov edx, dword [ebp + 0x14]
cmp edx, dword [ebp - 0xc]
jae 0x47b06b
push 0x7a
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x47b0c3
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 8]
push edx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x47b089
xor eax, eax
jmp 0x47b0c3
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x47b0a0
xor eax, eax
jmp 0x47b0c3
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
call fcn.005c1780
add esp, 0xc
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, 1
mov esp, ebp
pop ebp
ret 0x10
Function at 0x47b150
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 8], ecx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 8]
call fcn.0047b1e0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x47b176
xor eax, eax
jmp 0x47b1cc
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x47b194
xor eax, eax
jmp 0x47b1cc
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x47b1b2
xor eax, eax
jmp 0x47b1cc
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret 8

Function at 0x47b470
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push 0x763c10
mov eax, dword [ebp + 8]
push eax
call fcn.005d5978
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x47b494
xor eax, eax
jmp 0x47b50c
mov ecx, dword [ebp - 4]
push ecx
call fcn.005dae87
add esp, 4
push eax
call fcn.005dafbd
add esp, 4
mov dword [ebp - 8], eax
mov edx, dword [ebp - 8]
cmp edx, dword [ebp + 0x10]
jbe 0x47b4cc
push 0x7a
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 4]
push eax
call fcn.005d5a63
add esp, 4
xor eax, eax
jmp 0x47b50c
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 8]
push edx
push 1
mov eax, dword [ebp + 0xc]
push eax
call fcn.005d5caf
add esp, 0x10
cmp dword [ebp - 8], eax
jne 0x47b4f0
mov dword [ebp - 0xc], 1
jmp 0x47b4f7
mov dword [ebp - 0xc], 0
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 4]
push edx
call fcn.005d5a63
add esp, 4
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret