joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404d30
Capabilities:
Check os version

Disassembly:
sub esp, 0x384
mov eax, dword [0x5a2f48]
push ebx
push esi
mov dword [esp + 0x388], eax
mov esi, ecx
mov ecx, dword [0x5a0470]
mov eax, 0x64
cmp ecx, eax
push edi
jle 0x404d5b
mov dword [0x5a0470], eax
xor ebx, ebx
push 0x2d
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x58], 0x12
call dword [sym.imp.user32.dll_GetSystemMetrics]
mov dword [esi + 0x5c], eax
or eax, 0xffffffff
mov dword [esi + 0x60], eax
mov dword [esi + 0x64], eax
lea eax, [esp + 0x1a4]
push eax
mov dword [esi + 0x134], ebx
mov dword [esi + 0xc0], ebx
mov dword [esi + 0xc4], ebx
mov dword [esi + 0x138], ebx
mov dword [esp + 0x1a8], 0x94
call dword [sym.imp.kernel32.dll_GetVersionExA]
cmp dword [esp + 0x1b4], 2
jne 0x404dd8
mov eax, dword [esp + 0x1a8]
cmp eax, 5
ja 0x404dd1
jne 0x404dd8
cmp dword [esp + 0x1ac], 1
jb 0x404dd8
mov eax, 1
jmp 0x404dda
xor eax, eax
cmp eax, ebx
lea ecx, [esi + 0x140]
push ebp
mov ebp, dword [sym.imp.user32.dll_SystemParametersInfoA]
mov dword [esi + 0x13c], eax
mov dword [ecx], ebx
je 0x404dfd
push ebx
push ecx
push ebx
push 0x1022
call ebp
mov edi, dword [sym.imp.user32.dll_GetSysColor]
push 4
call edi
push 0xd
mov dword [esi + 0x144], eax
call edi
mov dword [esi + 0x148], eax
mov dword [esi + 0x14c], eax
cmp dword [esi + 0x13c], ebx
je 0x404e2f
push 0x1d
call edi
mov dword [esi + 0x14c], eax
push 0xe
call edi
push 7
mov dword [esi + 0x150], eax
call edi
movzx ecx, byte [esi + 0x146]
imul ecx, ecx, 0xcf
mov dword [esi + 0x154], eax
movzx eax, byte [esi + 0x14a]
lea edx, [eax + eax*2]
movzx eax, byte [esi + 0x149]
shl edx, 4
add ecx, edx
sar ecx, 8
xor edx, edx
mov dh, cl
movzx ecx, byte [esi + 0x145]
imul ecx, ecx, 0xcf
lea eax, [eax + eax*2]
shl eax, 4
add ecx, eax
movzx eax, byte [esi + 0x148]
mov dl, ch
movzx ecx, byte [esi + 0x144]
imul ecx, ecx, 0xcf
lea eax, [eax + eax*2]
shl eax, 4
add ecx, eax
mov eax, dword [esi + 0x5c]
sar ecx, 8
shl edx, 8
movzx ecx, cl
or edx, ecx
mov dword [esi + 0x158], edx
mov edx, dword [esi + 0x58]
shl eax, 1
sub edx, eax
sub edx, 2
cmp edx, 5
jge 0x404ec9
add eax, 7
mov dword [esi + 0x58], eax
push ebx
lea eax, [esp + 0x240]
push eax
push 0x154
push 0x29
mov dword [esp + 0x24c], 0x154
call ebp
lea ecx, [esp + 0x354]
push ecx
call dword [sym.imp.gdi32.dll_CreateFontIndirectA]
push eax
lea ecx, [esi + 0xb0]
call fcn.00528920
mov edi, dword [0x5a0470]
cmp edi, ebx
mov word [esp + 0x10], 0x300
mov word [esp + 0x12], di
pop ebp
jle 0x404f3f
mov ecx, 0x59dbd0
lea eax, [esp + 0x11]
mov dl, byte [ecx]
mov byte [eax - 1], dl
mov dl, byte [ecx + 1]
mov byte [eax], dl
mov dl, byte [ecx + 2]
mov byte [eax + 1], dl
mov byte [eax + 2], bl
add ecx, 0x104
add eax, 4
dec edi
jne 0x404f20
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.gdi32.dll_CreatePalette]
push eax
lea ecx, [esi + 0xb8]
call fcn.00528920
mov ecx, dword [esp + 0x38c]
pop edi
pop esi
pop ebx
call fcn.00464eaf
add esp, 0x384
ret
Function at 0x405cf0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x54d086
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xe8
push esi
mov esi, ecx
mov dword [esp + 8], esi
call dword [sym.imp.user32.dll_ReleaseCapture]
mov eax, dword [esp + 0xfc]
cmp eax, 0x7ed
je 0x405ebc
cmp dword [esi + 0x60], 0xfffffffe
jne 0x405eb5
mov eax, dword [esi + 0xc0]
push ebx
push ebp
push edi
push esi
push 0x102
push eax
lea ecx, [esp + 0x70]
mov dword [esi + 0x138], 1
call fcn.0051ca80
xor ebp, ebp
mov dword [esp + 0x100], ebp
call fcn.0051fbb3
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea ebx, [eax + 0x10]
mov dword [esp + 0x10], ebx
mov edi, dword [esi + 0x15c]
mov dword [esp + 0x1c], 4
mov eax, dword [edi - 0xc]
test eax, eax
mov byte [esp + 0x100], 1
je 0x405da2
call fcn.0053abfb
mov eax, dword [eax + 4]
push edi
mov ecx, eax
call fcn.0053b845
mov ebp, eax
xor edi, edi
test ebp, ebp
je 0x405de6
push edi
lea eax, [esp + 0x14]
push str.CUSTOM_COLOR__d
push eax
call fcn.00405cd0
mov ebx, dword [esp + 0x1c]
add esp, 0xc
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x28]
push eax
push 0
push ebx
push ebp
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
test eax, eax
jne 0x405de6
mov ecx, dword [esp + 0x18]
mov dword [esp + edi*4 + 0x24], ecx
jmp 0x405dee
mov dword [esp + edi*4 + 0x24], 0xffffff
inc edi
cmp edi, 0x10
jl 0x405da4
lea edx, [esp + 0x24]
lea ecx, [esp + 0x64]
mov dword [esp + 0xe4], edx
call fcn.0051ca0a
cmp eax, 1
jne 0x405e1c
mov eax, dword [esp + 0xe0]
mov dword [esi + 0xc4], eax
jmp 0x405e27
mov dword [esp + 0x108], 0x7ed
test ebp, ebp
je 0x405e6b
xor esi, esi
lea edi, [esp + 0x24]
push esi
lea ecx, [esp + 0x14]
push str.CUSTOM_COLOR__d
push ecx
call fcn.00405cd0
mov ebx, dword [esp + 0x1c]
add esp, 0xc
push 4
push edi
push 4
push 0
push ebx
push ebp
call dword [sym.imp.advapi32.dll_RegSetValueExA]
inc esi
add edi, 4
cmp esi, 0x10
jl 0x405e31
push ebp
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov esi, dword [esp + 0x14]
add ebx, 0xfffffff0
mov dword [esi + 0x138], 0
mov byte [esp + 0x100], 0
lea edx, [ebx + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x405e97
mov ecx, dword [ebx]
mov edx, dword [ecx]
push ebx
call dword [edx + 4]
lea ecx, [esp + 0x64]
mov dword [esp + 0x100], 0xffffffff
call fcn.0051fe6d
mov eax, dword [esp + 0x108]
pop edi
pop ebp
pop ebx
cmp eax, 0x7ed
jne 0x405ec8
mov ecx, dword [esi + 0xc0]
mov dword [esi + 0xc4], ecx
mov edx, dword [esi + 0xc4]
push 0
push edx
push eax
mov eax, dword [esi + 0x134]
mov ecx, dword [eax + 0x1c]
push ecx
call dword [sym.imp.user32.dll_SendMessageA]
mov eax, dword [esi + 0x138]
test eax, eax
jne 0x405ef3
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x60]
mov ecx, dword [esp + 0xec]
pop esi
mov dword fs:[0], ecx
add esp, 0xf4
ret 4
Function at 0x406ff0
Capabilities:
Check os version

Disassembly:
push 0xffffffffffffffff
push 0x54d185
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x9c
mov eax, dword [0x5a2f48]
push ebx
push esi
mov esi, ecx
mov dword [esp + 0xa0], eax
mov dword [esp + 8], esi
call fcn.00521511
xor ebx, ebx
push 0xc
mov dword [esp + 0xb0], ebx
mov dword [esi], 0x55a658
mov dword [esi + 0x50], 0xff000000
call dword [sym.imp.user32.dll_GetSysColor]
push 0x55a944
lea ecx, [esi + 0x58]
mov dword [esi + 0x54], eax
call fcn.00401bc0
push 0x55a934
lea ecx, [esi + 0x5c]
mov byte [esp + 0xb0], 1
call fcn.00401bc0
push 0x55a930
lea ecx, [esi + 0x78]
mov byte [esp + 0xb0], 2
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0x68], ebx
mov dword [esi + 0x70], ebx
mov dword [esi + 0x74], ebx
call fcn.00401bc0
push 0x559e91
lea ecx, [esi + 0x7c]
mov byte [esp + 0xb0], 3
call fcn.00401bc0
lea ecx, [esi + 0x80]
mov byte [esp + 0xac], 4
call fcn.004211d0
lea ecx, [esi + 0x84]
mov byte [esp + 0xac], 5
call fcn.004211d0
lea ecx, [esi + 0x88]
mov byte [esp + 0xac], 6
call fcn.004211d0
lea eax, [esp + 0xc]
push eax
mov dword [esp + 0x10], 0x94
call dword [sym.imp.kernel32.dll_GetVersionExA]
cmp dword [esp + 0x1c], 2
jne 0x407109
mov eax, dword [esp + 0x10]
cmp eax, 5
ja 0x407105
jne 0x407109
cmp dword [esp + 0x14], 1
jb 0x407109
mov cl, 1
jmp 0x40710b
xor cl, cl
cmp cl, bl
lea eax, [esi + 0x6c]
mov dword [eax], ebx
je 0x407122
push ebx
push eax
push ebx
push 0x1022
call dword [sym.imp.user32.dll_SystemParametersInfoA]
mov ecx, dword [esp + 0xa4]
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x9c]
pop ebx
call fcn.00464eaf
add esp, 0xa8
ret
Function at 0x4075b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x54d066
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
call fcn.00521511
mov dword [esp + 0x1c], 0
mov dword [esi], method.CWnd.virtual_0
lea edi, [esi + 0x68]
call fcn.0051fbb3
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [edi], eax
mov byte [esp + 0x1c], 1
lea ebp, [esi + 0x6c]
call fcn.0051fbb3
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp], eax
mov dword [esi + 0xb4], 0
mov dword [esi + 0xb0], vtable.CFont.0
mov dword [esi + 0xbc], 0
mov dword [esi + 0xb8], 0x55a5a4
lea ecx, [esi + 0xc8]
mov byte [esp + 0x1c], 4
call fcn.0051d967
mov byte [esp + 0x1c], 5
call fcn.0051fbb3
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esi + 0x15c], eax
mov ecx, esi
mov byte [esp + 0x1c], 6
call fcn.00404d30
mov eax, dword [esp + 0x2c]
mov dword [esi + 0xc0], eax
mov dword [esi + 0xc4], eax
mov eax, dword [esp + 0x30]
mov dword [esi + 0x134], eax
mov eax, dword [esp + 0x34]
test eax, eax
mov edx, eax
jne 0x407699
mov edx, 0x559e91
test edx, edx
jne 0x4076a1
xor eax, eax
jmp 0x4076bb
mov eax, edx
lea ecx, [eax + 1]
mov dword [esp + 0xc], ecx
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4076b0
sub eax, dword [esp + 0xc]
push eax
push edx
mov ecx, edi
call fcn.004017a0
mov edx, dword [esp + 0x38]
test edx, edx
jne 0x4076d9
mov edx, 0x559e91
test edx, edx
jne 0x4076d9
xor eax, eax
jmp 0x4076e9
mov eax, edx
lea edi, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4076e0
sub eax, edi
push eax
push edx
mov ecx, ebp
call fcn.004017a0
mov edx, dword [esp + 0x3c]
test edx, edx
jne 0x407707
mov edx, 0x559e91
test edx, edx
jne 0x407707
xor eax, eax
jmp 0x407719
mov eax, edx
lea ebp, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x407710
sub eax, ebp
push eax
push edx
lea ecx, [esi + 0x15c]
call fcn.004017a0
mov edx, dword [esp + 0x38]
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
push edx
mov edx, dword [esp + 0x30]
push eax
mov eax, dword [esp + 0x30]
push ecx
mov ecx, dword [esp + 0x30]
push edx
push eax
push ecx
mov ecx, esi
call fcn.00407150
mov ecx, dword [esp + 0x14]
pop edi
mov eax, esi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x14
ret 0x1c
Function at 0x4081f0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x1c
push edi
mov edi, dword [esp + 0x24]
push 0x1c
lea eax, [esp + 8]
push eax
push edi
call dword [sym.imp.kernel32.dll_VirtualQuery]
test eax, eax
jne 0x40820f
pop edi
add esp, 0x1c
ret
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
push esi
mov esi, dword [esp + 0xc]
push ecx
push edx
push esi
call dword [sym.imp.kernel32.dll_GetModuleFileNameA]
test eax, eax
jne 0x40822f
pop esi
pop edi
add esp, 0x1c
ret
mov eax, dword [esi + 0x3c]
movzx ecx, word [eax + esi + 0x14]
add eax, esi
push ebx
push ebp
movzx ebp, word [eax + 6]
sub edi, esi
xor ebx, ebx
test ebp, ebp
lea ecx, [ecx + eax + 0x18]
jbe 0x408270
lea eax, [ecx + 0x10]
mov edi, edi
mov ecx, dword [eax]
mov edx, dword [eax - 8]
cmp ecx, edx
mov esi, dword [eax - 4]
ja 0x40825e
mov ecx, edx
cmp edi, esi
jb 0x408268
add ecx, esi
cmp edi, ecx
jbe 0x40827a
inc ebx
add eax, 0x28
cmp ebx, ebp
jb 0x408250
pop ebp
pop ebx
pop esi
xor eax, eax
pop edi
add esp, 0x1c
ret
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x40]
inc ebx
pop ebp
mov dword [edx], ebx
sub edi, esi
pop ebx
mov dword [eax], edi
pop esi
mov eax, 1
pop edi
add esp, 0x1c
ret

Function at 0x4082a0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x408
mov eax, dword [0x5a2f48]
mov ecx, dword [esp + 0x40c]
mov dword [esp + 0x404], eax
push esi
lea eax, [esp + 0x414]
push eax
push ecx
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.user32.dll_wvsprintfA]
mov edx, dword [0x5a4db0]
push 0
mov esi, eax
lea eax, [esp + 8]
push eax
push esi
lea ecx, [esp + 0x14]
push ecx
push edx
call dword [sym.imp.kernel32.dll_WriteFile]
mov ecx, dword [esp + 0x408]
mov eax, esi
pop esi
call fcn.00464eaf
add esp, 0x408
ret
Function at 0x40e0d0
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x54d5b8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
push edi
mov edi, dword [esp + 0x20]
push edi
push str.Arial
push str.Font
lea eax, [esp + 0x2c]
push str.Font
push eax
mov esi, ecx
call fcn.0041e410
add esp, 0x14
lea ecx, [esi + 0xaa4]
push eax
mov dword [esp + 0x1c], 0
call fcn.00401a70
mov eax, dword [esp + 0x20]
or ebx, 0xffffffff
add eax, 0xfffffff0
mov dword [esp + 0x18], ebx
lea ecx, [eax + 0xc]
mov edx, ebx
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40e144
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
push edi
push 0
push str.Bold
push str.Font
call fcn.0041e330
push edi
push 0
push str.Italic
push str.Font
mov dword [esi + 0xaa8], eax
call fcn.0041e330
push edi
push 0
push str.Underline
push str.Font
mov dword [esi + 0xaac], eax
call fcn.0041e330
push edi
push 0xffffff
push str.Color
push str.Font
mov dword [esi + 0xab0], eax
call fcn.0041e330
add esp, 0x40
push edi
push 0x64
push 0x559c84
push str.Font
mov dword [esi + 0xab4], eax
call fcn.0041e330
push edi
push 0x1e
push str.Size
push str.Font
mov dword [esi + 0xab8], eax
call fcn.0041e330
push edi
push str.Center
push str.HAlign
mov dword [esi + 0xabc], eax
lea eax, [esp + 0x4c]
push str.Font
push eax
call fcn.0041e410
add esp, 0x34
lea ecx, [esi + 0xac0]
push eax
mov dword [esp + 0x1c], 1
call fcn.00401a70
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
mov dword [esp + 0x18], ebx
lea ecx, [eax + 0xc]
mov edx, ebx
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40e22c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
push edi
push 0
push str.HOffset
push str.Font
call fcn.0041e330
push edi
push str.Middle
push str.VAlign
mov dword [esi + 0xac4], eax
lea eax, [esp + 0x28]
push str.Font
push eax
call fcn.0041e410
add esp, 0x24
lea ecx, [esi + 0xac8]
push eax
mov dword [esp + 0x1c], 2
call fcn.00401a70
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov dword [esp + 0x18], ebx
lea ecx, [eax + 0xc]
lock xadd dword [ecx], ebx
dec ebx
test ebx, ebx
jg 0x40e294
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
push edi
push 0
push str.VOffset
push str.Font
call fcn.0041e330
push edi
push 0x64
push str.CharSpace
push str.Font
mov dword [esi + 0xacc], eax
call fcn.0041e330
push edi
push 0x64
push str.LineSpace
push str.Font
mov dword [esi + 0xad0], eax
call fcn.0041e330
push edi
push 0
push str.Rotation
push str.Font
mov dword [esi + 0xad4], eax
call fcn.0041e330
add esp, 0x40
push edi
push 0x64
push str.CharWidth
push str.Font
mov dword [esi + 0xad8], eax
call fcn.0041e330
push edi
push 0x64
push str.CharHeight
push str.Font
mov dword [esi + 0xadc], eax
call fcn.0041e330
mov ecx, dword [esp + 0x30]
add esp, 0x20
pop edi
mov dword [esi + 0xae0], eax
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x40e610
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x110
mov eax, dword [0x5a2f48]
mov ecx, dword [esp + 0x118]
mov edx, dword [esp + 0x114]
push esi
mov dword [esp + 0x110], eax
lea eax, [esp + 4]
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x40e684
mov edx, dword [esp + 4]
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x10]
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.advapi32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x120]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.kernel32.dll_lstrcpy]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov ecx, dword [esp + 0x110]
mov eax, esi
pop esi
call fcn.00464eaf
add esp, 0x110
ret 0xc

Function at 0x40ef40
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x54d7b8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
mov ebx, ecx
mov eax, dword [ebx + 0x78]
test eax, eax
jne 0x40f040
push esi
call fcn.0051fbb3
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea esi, [eax + 0x10]
mov dword [esp + 8], esi
mov eax, dword [esi - 4]
mov ecx, 1
sub ecx, eax
mov eax, dword [esi - 8]
sub eax, 0x104
or eax, ecx
mov dword [esp + 0x14], 0
jge 0x40efa8
push 0x104
lea ecx, [esp + 0xc]
call fcn.00401470
mov esi, dword [esp + 8]
push 0x104
push esi
call dword [sym.imp.kernel32.dll_GetWindowsDirectoryA]
test esi, esi
jne 0x40efbc
xor eax, eax
jmp 0x40efd0
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40efc1
sub eax, edx
js 0x40f050
cmp eax, dword [esi - 8]
jg 0x40f050
push edi
push 0xd
mov dword [esi - 0xc], eax
push str.winhlp32.exe
lea ecx, [esp + 0x14]
mov byte [eax + esi], 0
call fcn.00401840
mov edi, dword [esp + 0xc]
push edi
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x40f015
push 0x6a
push esi
call dword [sym.imp.user32.dll_LoadCursorA]
test eax, eax
je 0x40f015
push eax
call dword [sym.imp.user32.dll_CopyIcon]
mov dword [ebx + 0x78], eax
push esi
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [edi - 0x10]
mov dword [esp + 0x18], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
pop edi
jg 0x40f03f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
pop esi
mov ecx, dword [esp + 8]
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
push 0x80070057
call fcn.00401120
int3
Function at 0x410780
Capabilities:
Resume thread

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x54dae0
push eax
mov dword fs:[0], esp
sub esp, 0x14
push esi
push 0
push 4
push 0
push 0xfffffffffffffff1
push 0x55ce88
mov esi, ecx
call fcn.005266ec
test eax, eax
mov dword [esi + 0x4d54], eax
jne 0x4107c7
pop esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret
push 0
push 0
push 1
push 0
lea ecx, [esp + 0x14]
call fcn.0045d2b7
mov eax, dword [esi + 0x4d54]
lea ecx, [esp + 4]
mov dword [eax + 0x40], ecx
mov esi, dword [esi + 0x4d54]
mov edx, dword [esi + 0x28]
push edx
mov dword [esp + 0x24], 0
call dword [sym.imp.kernel32.dll_ResumeThread]
push 0
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x14]
call fcn.0045d371
push 0xffffffffffffffff
lea ecx, [esp + 0x10]
mov byte [esp + 0x24], 1
call fcn.0045d318
lea ecx, [esp + 0xc]
mov byte [esp + 0x20], 0
call fcn.0045d32d
lea ecx, [esp + 4]
mov dword [esp + 0x20], 0xffffffff
call fcn.0045d309
mov ecx, dword [esp + 0x18]
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x20
ret
Function at 0x412520
Capabilities:
Delete file
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x54dcfb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x27c
mov eax, dword [0x5a2f48]
push esi
mov esi, ecx
push 1
mov dword [esp + 0x280], eax
mov dword [esi + 0x4d58], 0
call fcn.00534273
mov ecx, eax
call fcn.00521a60
test eax, eax
je 0x412672
mov eax, dword [esi + 0x4d54]
add eax, 0x44
jne 0x412579
xor eax, eax
jmp 0x41257c
mov eax, dword [eax + 0x1c]
push edi
mov edi, dword [sym.imp.user32.dll_SendMessageA]
push 0
push 0
push 0x7ea
push eax
call edi
push 0
lea ecx, [esp + 0xc]
call fcn.0041e9c0
mov eax, dword [esp + 8]
push esi
push 0x9e
lea ecx, [esp + 0x10]
mov dword [esp + 0x294], 0
call dword [eax + 0x134]
push 0x55cd20
lea ecx, [esp + 0xc]
call fcn.0041e9f0
lea ecx, [esp + 0x17c]
push ecx
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathA]
lea edx, [esp + 0x78]
push edx
push 0
push 0x55cd1c
lea eax, [esp + 0x188]
push eax
call dword [sym.imp.kernel32.dll_GetTempFileNameA]
lea ecx, [esp + 0x78]
push ecx
mov ecx, esi
call fcn.004111a0
mov eax, dword [esi + 0x4d54]
add eax, 0x44
jne 0x41260f
xor eax, eax
jmp 0x412612
mov eax, dword [eax + 0x1c]
mov edx, dword [esi + 0x1e00]
mov ecx, dword [esi + 0x1dfc]
push edx
push ecx
push 0x7e8
push eax
call edi
mov esi, dword [esi + 0x4d54]
add esi, 0x44
jne 0x412637
xor esi, esi
jmp 0x41263a
mov esi, dword [esi + 0x1c]
lea edx, [esp + 0x78]
push edx
push 0
push 0x7e9
push esi
call edi
lea eax, [esp + 0x78]
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
lea ecx, [esp + 8]
call fcn.0041eae0
lea ecx, [esp + 8]
mov dword [esp + 0x28c], 0xffffffff
call fcn.0041e9e0
pop edi
mov ecx, dword [esp + 0x280]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x27c]
pop esi
call fcn.00464eaf
add esp, 0x288
ret
Function at 0x418340
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
mov esi, ecx
call fcn.004182d0
test eax, eax
je 0x418353
mov eax, 1
pop esi
ret
mov ecx, esi
pop esi
jmp fcn.005205a0

Function at 0x41e040
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x54eba2
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push esi
push edi
mov esi, ecx
call fcn.0051fbb3
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push eax
mov ecx, esi
mov dword [esp + 0x30], 0
call fcn.00522ff6
mov edx, dword [esp + 0xc]
lea ecx, [esp + 8]
push ecx
push 0x55cc84
push edx
call fcn.004668d8
add esp, 0xc
cmp eax, 1
jne 0x41e0b3
mov eax, dword [esp + 8]
cmp eax, dword [esi + 0xa8]
jl 0x41e0b3
cmp eax, dword [esi + 0xac]
jle 0x41e0bd
mov eax, dword [esi + 0xa8]
mov dword [esp + 8], eax
push 0x70
call fcn.005253b2
add esp, 4
mov dword [esp + 0x10], eax
test eax, eax
mov byte [esp + 0x2c], 1
je 0x41e0df
mov ecx, eax
call fcn.0041df00
mov edi, eax
jmp 0x41e0e1
xor edi, edi
mov edx, dword [esi + 0x6c]
lea ecx, [esp + 0x14]
push ecx
push edx
mov byte [esp + 0x34], 0
call dword [sym.imp.user32.dll_GetWindowRect]
mov eax, dword [esp + 8]
mov ecx, dword [esi + 0xac]
mov edx, dword [esi + 0xa8]
push esi
push esi
push eax
mov eax, dword [esp + 0x2c]
push ecx
mov ecx, dword [esp + 0x44]
push edx
mov edx, dword [ecx]
add eax, 4
push eax
push edx
mov ecx, edi
call fcn.0041d8c0
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov dword [esp + 0x2c], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
pop edi
pop esi
jg 0x41e148
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret 4
Function at 0x41e210
Capabilities:
Get file version info

Disassembly:
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
sub esp, 8
push ebx
mov ebx, dword [esp + 0x10]
push ebp
mov ebp, dword [esp + 0x24]
mov dword [ebp], 0xffffffff
mov dword [eax], 0xffffffff
push esi
lea eax, [esp + 0x10]
push eax
mov dword [ecx], 0xffffffff
push ebx
mov dword [edx], 0xffffffff
call sub.version.dll_GetFileVersionInfoSizeA
mov esi, eax
test esi, esi
jne 0x41e25b
pop esi
pop ebp
pop ebx
add esp, 8
ret
push edi
push esi
call fcn.005253dd
mov edi, eax
add esp, 4
test edi, edi
je 0x41e2e2
push edi
push esi
push 0
push ebx
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x41e2d9
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0x14]
push edx
push 0x55f368
push edi
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x41e2d9
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x41e2d9
mov eax, dword [esp + 0x10]
movzx ecx, word [eax + 0xa]
mov edx, dword [esp + 0x20]
mov dword [edx], ecx
movzx ecx, word [eax + 8]
mov edx, dword [esp + 0x24]
mov dword [edx], ecx
movzx ecx, word [eax + 0xe]
mov edx, dword [esp + 0x28]
mov dword [edx], ecx
movzx eax, word [eax + 0xc]
push edi
mov dword [ebp], eax
call fcn.005253e2
add esp, 4
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 8
ret
push edi
call fcn.005253e2
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret

Function at 0x41e330
Capabilities:
Read .ini file

Disassembly:
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x41e357
call fcn.0053abfb
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov eax, dword [eax + 4]
push ecx
mov ecx, dword [esp + 8]
push edx
push ecx
mov ecx, eax
call fcn.0053b88b
ret
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 4]
push eax
mov eax, dword [esp + 0xc]
push edx
push eax
push ecx
call dword [sym.imp.kernel32.dll_GetPrivateProfileIntA]
ret