joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414a20
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x48c418
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4b5930]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov dword [esp + 0x28], 0
mov edi, dword [esp + 0x34]
push ecx
lea ebp, [edi - 0x10]
mov dword [esp + 0x18], esp
mov esi, esp
push ebp
call fcn.0040ae10
add eax, 0x10
add esp, 4
mov dword [esi], eax
call fcn.00423090
add esp, 4
test al, al
jne 0x414b6d
mov ebx, dword [edi - 0xc]
add ebx, 0xd
push ebx
call fcn.0044cd22
mov ecx, dword [esp + 0x34]
mov esi, eax
push 0
mov dword [esi], ecx
call fcn.004705e8
mov dword [esi + 4], eax
mov eax, dword [edi - 0xc]
cdq
mov dword [esi + 8], eax
mov eax, dword [edi - 0xc]
push eax
mov dword [esp + 0x24], edx
lea edx, [esi + 0xc]
push edi
push edx
call fcn.004778b0
add esp, 0x14
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x38]
push ecx
push 0
push 0x2001f
push 0
push 0
push 0
push str.DirectTime
push SysReAllocStringLen
mov dword [esp + 0x58], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x414b39
mov eax, dword [esp + 0x34]
push ebx
push esi
push 3
push 0
push 0
push eax
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x414b59
test edi, edi
je 0x414b0c
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call fcn.0044cd27
add esp, 4
mov dword [esp + 0x28], 0xffffffff
lea ecx, [ebp + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x414b8b
mov ecx, dword [ebp]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push ebp
call edx
jmp 0x414b8b
push esi
call fcn.0044cd27
add esp, 4
mov dword [esp + 0x28], 0xffffffff
lea edx, [ebp + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jmp 0x414b7e
test edi, edi
je 0x414b64
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call fcn.0044cd27
add esp, 4
or ecx, 0xffffffff
lea eax, [ebp + 0xc]
mov dword [esp + 0x28], ecx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x414b8b
mov ecx, dword [ebp]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push ebp
call eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 8
Function at 0x418f60
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x48c2db
mov eax, dword fs:[0]
push eax
sub esp, 0x20c
mov eax, dword [0x4b5930]
xor eax, esp
mov dword [esp + 0x204], eax
push esi
push edi
mov eax, dword [0x4b5930]
xor eax, esp
push eax
lea eax, [esp + 0x218]
mov dword fs:[0], eax
lea eax, [esp + 0x10]
mov esi, ecx
mov ecx, dword [0x4bb2a0]
push eax
push ecx
call fcn.004365c0
mov dword [esp + 0x220], 0
mov edx, dword [esi + 0x20]
mov dword [esp + 0x14], 0x1f8
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], 0x1000
mov dword [esp + 0x24], 0x402
mov dword [esp + 0x20], 7
call fcn.0044f60f
mov eax, dword [eax + 8]
push 0x1000
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
mov esi, dword [esp + 0x10]
push 0x80
mov dword [esp + 0x2c], eax
push esi
lea eax, [esp + 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov edx, dword [ebp + 8]
lea ecx, [esp + 0x14]
push ecx
push edx
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconA]
mov edi, eax
lea eax, [esi - 0x10]
mov dword [esp + 0x220], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x419049
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, edi
mov ecx, dword [esp + 0x218]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x204]
xor ecx, esp
call fcn.0046da06
mov esp, ebp
pop ebp
ret 4
Function at 0x423090
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x48c080
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4b5930]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
xor edi, edi
mov dword [esp + 0x30], edi
mov dword [esp + 0x20], 0x104
mov dword [esp + 0x18], edi
lea eax, [esp + 0x18]
push eax
call fcn.00423300
mov dword [esp + 0x14], edi
push 0x400
lea ecx, [esp + 0x18]
push ecx
call fcn.00423290
lea edx, [esp + 0x1c]
push edx
push 0x20019
push edi
push str.DirectTime
mov byte [esp + 0x40], 3
push SysReAllocStringLen
mov dword [esp + 0x30], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, edi
jne 0x42314e
mov esi, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
lea ecx, [esp + 0x20]
push ecx
push esi
lea edx, [esp + 0x24]
push edx
push edi
push edi
push ebx
mov dword [esp + 0x3c], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, edi
jne 0x423139
cmp dword [esp + 0x1c], 3
je 0x423186
cmp ebx, edi
je 0x423144
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x14]
push eax
jmp 0x423222
mov eax, dword [esp + 0x14]
push eax
call fcn.0044cd27
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.0044cd27
mov dword [esp + 0x38], 0xffffffff
mov eax, dword [esp + 0x40]
add eax, 0xfffffff0
add esp, 8
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jmp 0x42324c
cmp dword [esp + 0x20], edi
mov ebp, dword [esp + 0x14]
je 0x423216
mov edi, dword [esi + 8]
push edi
lea ecx, [esi + 0xc]
push ecx
push ebp
call fcn.004778b0
add esp, 0xc
test edi, edi
jle 0x423214
push ebp
lea ecx, [esp + 0x20]
mov byte [edi + ebp], 0
call fcn.0040aea0
lea edx, [esp + 0x38]
push edx
lea eax, [esp + 0x20]
push eax
call fcn.00415180
add esp, 8
test al, al
lea ecx, [esp + 0x1c]
je 0x42320f
call fcn.00411590
test ebx, ebx
je 0x4231e1
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebp
call fcn.0044cd27
push esi
call fcn.0044cd27
add esp, 8
lea ecx, [esp + 0x38]
call fcn.00411590
mov al, 1
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
call fcn.00411590
xor edi, edi
cmp ebx, edi
je 0x423221
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebp
call fcn.0044cd27
push esi
call fcn.0044cd27
mov dword [esp + 0x38], 0xffffffff
mov eax, dword [esp + 0x40]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
add esp, 8
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x423258
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor al, al
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x424fb0
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x30
push ebx
mov ebx, ecx
push ebp
xor ecx, ecx
test al, 1
push esi
je 0x424fca
mov dword [esp + 0x10], 1
mov ecx, dword [esp + 0x10]
test eax, 0x2000
je 0x424fd7
or ecx, 0x2000
test eax, 0x4000
je 0x424fe4
or ecx, 0x8000
test al, 0xc
je 0x424fed
and ecx, 0xffffffef
jmp 0x424ff0
or ecx, 0x10
test al, al
mov dword [esp + 0x10], ecx
jns 0x425002
or ecx, 0x800
mov dword [esp + 0x10], ecx
test eax, 0x8000
je 0x425013
or ecx, 0x4000
mov dword [esp + 0x10], ecx
test al, 2
je 0x42501e
or ecx, 2
mov dword [esp + 0x10], ecx
test eax, 0xc000
je 0x42502f
or ecx, 0x40000
mov dword [esp + 0x10], ecx
lea eax, [esp + 0x18]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetClientRect]
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov esi, eax
add esi, 1
push esi
call fcn.0044cd22
add esp, 4
test esi, esi
mov ebp, eax
mov ecx, esi
je 0x42506b
jmp 0x425060
mov byte [eax], 0
add eax, 1
sub ecx, 1
jne 0x425060
push esi
push ebp
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextA]
test byte [esp + 0x44], 0x20
mov dword [esp + 0x14], 0
jne 0x4250b8
push 2
push edi
call dword [sym.imp.GDI32.dll_SetBkMode]
mov ebx, dword [esp + 0x40]
mov ecx, dword [ebx + 4]
push ecx
push edi
call dword [sym.imp.GDI32.dll_SetBkColor]
mov edx, dword [ebx + 4]
push edx
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
mov dword [esp + 0x18], eax
lea eax, [esp + 0x1c]
push eax
push edi
call dword [sym.imp.USER32.dll_FillRect]
jmp 0x425103
push 1
push edi
call dword [sym.imp.GDI32.dll_SetBkMode]
push ebx
call dword [sym.imp.USER32.dll_GetParent]
test eax, eax
mov dword [esp + 0x44], eax
je 0x4250ff
lea ecx, [esp + 0x28]
push ecx
push ebx
call dword [sym.imp.USER32.dll_GetClientRect]
mov edx, dword [esp + 0x44]
push ebx
push edi
push 0x138
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
test eax, eax
je 0x4250ff
push eax
lea eax, [esp + 0x2c]
push eax
push edi
call dword [sym.imp.USER32.dll_FillRect]
mov ebx, dword [esp + 0x40]
mov ecx, dword [ebx]
push ecx
push edi
call dword [sym.imp.GDI32.dll_SetTextColor]
mov edx, dword [ebx + 0xc]
mov ebx, dword [sym.imp.GDI32.dll_SelectObject]
push edx
push edi
call ebx
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x10]
push eax
lea ecx, [esp + 0x1c]
push ecx
add esi, 0xffffffff
push esi
push ebp
push edi
call dword [sym.imp.USER32.dll_DrawTextA]
mov edx, dword [esp + 0x40]
push edx
push edi
call ebx
mov eax, dword [esp + 0x14]
test eax, eax
je 0x42514b
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
push ebp
call fcn.0044cd27
add esp, 4
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x30
ret 8
Function at 0x4257b0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x48e081
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4b5930]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, dword [esp + 0x28]
mov ecx, esi
call fcn.00452e06
xor ebx, ebx
mov dword [esp + 0x20], ebx
lea ecx, [esi + 0x60]
mov dword [esi], vtable.CxSkinButton.0
call fcn.0045ae84
mov eax, vtable.CBitmap.0
mov dword [esi + 0xd4], ebx
mov dword [esi + 0xd0], eax
mov dword [esi + 0xdc], ebx
mov dword [esi + 0xd8], eax
mov dword [esi + 0xe4], ebx
mov dword [esi + 0xe0], eax
mov dword [esi + 0xec], ebx
mov dword [esi + 0xe8], eax
mov dword [esi + 0xf4], ebx
mov dword [esi + 0xf0], eax
mov byte [esp + 0x20], 6
push 0x12
mov word [esi + 0x108], 1
mov word [esi + 0xf8], bx
mov dword [esi + 0x100], ebx
call dword [sym.imp.USER32.dll_GetSysColor]
mov dword [esi + 0xfc], eax
mov byte [esi + 0x5c], bl
mov byte [esi + 0x5d], bl
call fcn.00457afe
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x42587e
push 0x80004005
call fcn.00405140
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea edi, [eax + 0x10]
mov dword [esp + 0x14], edi
mov byte [esp + 0x20], 7
mov eax, dword [edi - 8]
mov ecx, 1
sub ecx, dword [edi - 4]
sub eax, 0x104
or eax, ecx
jge 0x4258b9
push 0x104
lea ecx, [esp + 0x18]
call fcn.0040ab10
mov edi, dword [esp + 0x14]
push 0x104
push edi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
cmp edi, ebx
jne 0x4258cd
xor eax, eax
jmp 0x4258e3
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x4258d2
sub eax, edx
js 0x425985
cmp eax, dword [edi - 8]
jg 0x425985
push 0x7f89
mov dword [edi - 0xc], eax
push ebx
mov byte [eax + edi], bl
call dword [sym.imp.USER32.dll_LoadCursorA]
push ebx
mov dword [esi + 0x54], eax
call dword [sym.imp.USER32.dll_GetDC]
mov ebp, eax
push 0x58
push ebp
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov dword [esp + 0x14], eax
fild dword [esp + 0x14]
push 0x5a
push ebp
fdiv qword [0x4a2880]
fstp qword [0x4bb120]
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov dword [esp + 0x14], eax
fild dword [esp + 0x14]
push ebp
push ebx
fdiv qword [0x4a2880]
fstp qword [0x4bb118]
call dword [sym.imp.USER32.dll_ReleaseDC]
lea eax, [edi - 0x10]
mov byte [esp + 0x20], 6
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42596d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 4
push 0x80070057
call fcn.00405140
int3
Function at 0x426cb0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x48bfce
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4b5930]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, dword [esp + 0x24]
mov ecx, esi
call fcn.00452e06
xor ebx, ebx
mov dword [esp + 0x1c], ebx
mov dword [esi], vtable.CPictureEx.0
mov dword [esi + 0xd0], ebx
mov dword [esi + 0xd4], ebx
mov dword [esi + 0xd8], ebx
mov byte [esp + 0x1c], 1
push ebx
push ebx
push ebx
push ebx
lea eax, [esi + 0x60]
mov dword [esi + 0xc8], ebx
mov dword [esi + 0xc0], ebx
mov dword [esi + 0xbc], ebx
mov dword [esi + 0xc4], ebx
mov dword [esi + 0xb4], ebx
mov dword [esi + 0xac], ebx
mov dword [esi + 0x9c], ebx
mov dword [esi + 0xa0], ebx
mov dword [esi + 0xa4], ebx
mov dword [esi + 0xa8], ebx
mov dword [esi + 0x98], ebx
push eax
mov dword [esi + 0x94], ebx
mov dword [esi + 0x90], ebx
mov dword [esi + 0x8c], ebx
mov dword [esi + 0x78], 0xffffff
mov dword [esi + 0x88], ebx
mov dword [esi + 0x84], ebx
mov dword [esi + 0x7c], ebx
mov dword [esi + 0x80], ebx
mov dword [esi + 0x74], ebx
mov dword [esi + 0x70], ebx
call dword [sym.imp.USER32.dll_SetRect]
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [esi + 0xb8], eax
call fcn.00457afe
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x426db1
push 0x80004005
call fcn.00405140
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea edi, [eax + 0x10]
mov dword [esp + 0x10], edi
mov byte [esp + 0x1c], 2
mov eax, dword [edi - 8]
mov ecx, 1
sub ecx, dword [edi - 4]
sub eax, 0x104
or eax, ecx
jge 0x426dec
push 0x104
lea ecx, [esp + 0x14]
call fcn.0040ab10
mov edi, dword [esp + 0x10]
push 0x104
push edi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
cmp edi, ebx
jne 0x426e00
xor eax, eax
jmp 0x426e12
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x426e05
sub eax, edx
js 0x426e67
cmp eax, dword [edi - 8]
jg 0x426e67
mov dword [edi - 0xc], eax
push 0x7f89
mov byte [eax + edi], bl
push ebx
mov byte [esi + 0x54], bl
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [esi + 0x58], eax
lea eax, [edi - 0x10]
mov byte [esp + 0x1c], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x426e50
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4
push 0x80070057
call fcn.00405140
int3
Function at 0x427540
Capabilities:
Create thread
Resume thread

Disassembly:
sub esp, 8
cmp dword [esi + 0x98], 0
je 0x4275a9
cmp dword [esi + 0x8c], 0
je 0x4275af
mov eax, dword [esi + 0xd0]
test eax, eax
je 0x4275af
mov ecx, dword [esi + 0xd4]
sub ecx, eax
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 1
jbe 0x4275af
lea eax, [esp + 4]
push eax
push 4
push esi
push 0x427ac0
push 0
push 0
call fcn.00470f5a
add esp, 0x18
test eax, eax
mov dword [esi + 0xb4], eax
je 0x4275a9
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
xor eax, eax
add esp, 8
ret
mov eax, dword [esi + 0xbc]
test eax, eax
je 0x4275a9
mov ecx, dword [eax]
push edi
lea edx, [esp + 8]
push edx
push eax
mov eax, dword [ecx + 0x18]
call eax
mov eax, dword [esi + 0xbc]
mov ecx, dword [eax]
lea edx, [esp + 4]
push edx
push eax
mov eax, dword [ecx + 0x1c]
call eax
mov ecx, dword [esp + 4]
mov eax, dword [esi + 0xbc]
mov edx, dword [eax]
push 0
mov edx, dword [edx + 0x20]
mov edi, ecx
neg edi
push edi
mov edi, dword [esp + 0x10]
push edi
push ecx
mov ecx, dword [esi + 0x74]
push 0
push ecx
mov ecx, dword [esi + 0x70]
push ecx
mov ecx, dword [esi + 0x9c]
push 0
push 0
push ecx
push eax
call edx
test eax, eax
pop edi
jne 0x4275a9
push eax
push eax
mov eax, dword [esi + 0x20]
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
mov eax, 1
add esp, 8
ret

Function at 0x427630
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
call fcn.0044f60f
mov ecx, dword [esp + 0x1c]
mov eax, dword [eax + 0xc]
push 0x499d08
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
je 0x4276de
call fcn.0044f60f
mov eax, dword [eax + 0xc]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebp, eax
test ebp, ebp
je 0x4276de
call fcn.0044f60f
mov eax, dword [eax + 0xc]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
push edi
push 0x22
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x4276de
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push ebp
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x4276d7
test ebx, ebx
je 0x4276d7
push edi
push eax
push ebx
call fcn.004778b0
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
mov edi, dword [esp + 0x1c]
push esi
call fcn.00426f60
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 8
Function at 0x429ae0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x48b948
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4b5930]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
cmp dword [0x4bb1d0], 0
jne 0x429c07
call fcn.00457afe
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x429b2a
push 0x80004005
call fcn.00405140
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea esi, [eax + 0x10]
mov dword [esp + 0xc], esi
mov dword [esp + 0x18], 0
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, 0x104
or eax, ecx
jge 0x429b68
push 0x104
lea ecx, [esp + 0x10]
call fcn.0040ab10
mov esi, dword [esp + 0xc]
push 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test esi, esi
jne 0x429b7c
xor eax, eax
jmp 0x429b92
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x429b81
sub eax, edx
js 0x429c19
cmp eax, dword [esi - 8]
jg 0x429c19
push 0xd
mov dword [esi - 0xc], eax
push str.winhlp32.exe
lea ecx, [esp + 0x14]
mov byte [eax + esi], 0
call fcn.0040ef80
mov edi, dword [esp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x429bdc
push 0x6a
push esi
call dword [sym.imp.USER32.dll_LoadCursorA]
test eax, eax
je 0x429bdc
push eax
call dword [sym.imp.USER32.dll_CopyIcon]
mov dword [0x4bb1d0], eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [edi - 0x10]
mov dword [esp + 0x18], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x429c07
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret
push 0x80070057
call fcn.00405140
int3

Function at 0x429c30
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10c
mov eax, dword [0x4b5930]
xor eax, esp
mov dword [esp + 0x108], eax
mov eax, dword [esp + 0x110]
push esi
mov esi, dword [eax]
lea eax, [esp + 4]
push eax
lea ecx, [esp + 0xc]
push ecx
push 0
push esi
mov dword [esp + 0x14], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
lea edx, [esp + 8]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x10c]
pop esi
xor ecx, esp
xor eax, eax
call fcn.0046da06
add esp, 0x10c
ret
Function at 0x429ef0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x214
mov eax, dword [0x4b5930]
xor eax, esp
mov dword [esp + 0x210], eax
mov eax, dword [esp + 0x218]
push ebp
push 5
push 0
push 0
push eax
push str.open
push 0
mov dword [esp + 0x20], eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ebp, eax
cmp ebp, 0x20
ja 0x42a008
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push edi
lea eax, [esp + 0xc]
push eax
push 1
push 0
push str..htm
push SysReAllocStringLen
call esi
test eax, eax
jne 0x42a022
lea ecx, [esp + 0xc]
push ecx
lea edi, [esp + 0x18]
call fcn.00429c30
add esp, 4
test eax, eax
jne 0x42a022
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
push str._shellopencommand
mov edx, edi
push edx
call ebx
lea eax, [esp + 0x10]
push eax
push 1
push 0
mov ecx, edi
push ecx
push SysReAllocStringLen
call esi
test eax, eax
jne 0x42a01e
lea edx, [esp + 0x10]
push edx
call fcn.00429c30
add esp, 4
test eax, eax
jne 0x42a01e
mov eax, edi
push str.__1_
push eax
call fcn.00471010
mov esi, eax
add esp, 8
test esi, esi
jne 0x429fe5
mov ecx, edi
push 0x49fa38
push ecx
call fcn.00471010
mov esi, eax
add esp, 8
test esi, esi
jne 0x429fe5
mov edx, edi
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x17]
jmp 0x429fe8
mov byte [esi], 0
push 0x49fa3c
push esi
call ebx
mov eax, dword [esp + 0x14]
push eax
push esi
call ebx
push 5
lea ecx, [esp + 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
pop ebx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.0046da06
add esp, 0x214
ret
mov eax, ebp
jmp 0x42a005
mov ecx, dword [esp + 0x21c]
pop edi
pop esi
mov eax, ebp
pop ebp
xor ecx, esp
call fcn.0046da06
add esp, 0x214
ret
Function at 0x430ca0
Capabilities:
Check for unmoving mouse cursor

Disassembly:
push 0xffffffffffffffff
push 0x48af08
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebp
push esi
push edi
mov eax, dword [0x4b5930]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
lea eax, [esp + 0x44]
push eax
lea ecx, [esp + 0x24]
push ecx
lea edi, [ebx + 0x1a4]
call fcn.004353d0
mov edi, dword [esp + 0x20]
test edi, edi
mov ebp, dword [ebx + 0x1ac]
lea eax, [ebx + 0x1a8]
je 0x430cf3
cmp edi, eax
je 0x430cf8
call fcn.0046ecbd
mov esi, dword [esp + 0x24]
cmp esi, ebp
jne 0x430d17
xor eax, eax
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x30
ret 4
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.USER32.dll_GetCursorPos]
xor eax, eax
mov dword [esp + 0x10], vtable.CMenu.0
mov dword [esp + 0x14], eax
cmp edi, eax
mov dword [esp + 0x3c], eax
jne 0x430d3d
call fcn.0046ecbd
cmp esi, dword [edi + 4]
jne 0x430d47
call fcn.0046ecbd
mov ebp, dword [esi + 0xc]
call fcn.0044f60f
mov eax, dword [eax + 0xc]
movzx ecx, bp
push ecx
push eax
call dword [sym.imp.USER32.dll_LoadMenuA]
push eax
lea ecx, [esp + 0x14]
call fcn.004599ef
lea edx, [esp + 0x28]
push edx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [ebx + 0x20]
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
cmp esi, dword [edi + 4]
jne 0x430d86
call fcn.0046ecbd
or ebp, 0xffffffff
cmp dword [esi + 0x10], ebp
jne 0x430d9c
mov ecx, dword [esp + 0x1c]
push 0
push ebx
push ecx
lea ecx, [esp + 0x1c]
jmp 0x430dc5
cmp esi, dword [edi + 4]
jne 0x430da6
call fcn.0046ecbd
mov esi, dword [esi + 0x10]
mov eax, dword [esp + 0x14]
push esi
push eax
call dword [sym.imp.USER32.dll_GetSubMenu]
push eax
call fcn.004599c7
mov ecx, dword [esp + 0x1c]
push 0
push ebx
push ecx
mov ecx, eax
mov edx, dword [esp + 0x24]
push edx
push 0
call fcn.00452f54
mov dword [esp + 0x3c], ebp
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], vtable.CMenu.0
call fcn.00459a42
mov eax, 1
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x30
ret 4