joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a200
Capabilities:
Check mutex on windows

Disassembly:
push 0x54
mov eax, 0x57d490
call fcn.00552eab
mov esi, ecx
mov dword [ebp - 0x5c], esi
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x60], esi
call fcn.00404998
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp dword [esi + 8], ebx
jne 0x40a290
lea ecx, [ebp - 0x28]
call fcn.00404998
mov byte [ebp - 4], 1
lea edx, [ebp - 0x40]
mov ecx, str.RegValues
call fcn.0040aee9
push str.Lock
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0x58]
call fcn.0040a7c8
pop ecx
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x28]
push eax
call fcn.0040a6e2
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x58]
call fcn.004043b0
lea ecx, [ebp - 0x28]
call fcn.00403d80
cmp dword [eax + 0x14], 8
jb 0x40a279
mov eax, dword [eax]
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi + 8], eax
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x28]
call fcn.004043b0
push 0x32
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x40a33d
push str.MappedFile
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0x28]
call fcn.0040a7c8
pop ecx
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x28]
call fcn.00403d80
cmp dword [eax + 0x14], 8
jb 0x40a2c8
mov eax, dword [eax]
push eax
mov edi, 0x88
push edi
push ebx
push 4
push ebx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [esi + 4], eax
test eax, eax
je 0x40a329
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
push 0
push 0
xor ebx, ebx
cmp eax, 0xb7
push 0xf001f
push dword [esi + 4]
setne bl
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 0xc], eax
test eax, eax
je 0x40a327
test ebx, ebx
je 0x40a322
mov dword [ebp - 0x5c], eax
mov byte [ebp - 4], 4
mov ecx, eax
call fcn.00406748
mov byte [ebp - 4], 3
mov eax, dword [esi + 0xc]
inc dword [eax]
xor ebx, ebx
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x28]
call fcn.004043b0
mov esi, dword [esi + 0xc]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.004043b0
mov eax, esi
call fcn.00552e55
ret 4
Function at 0x40a393
Capabilities:
Check mutex on windows

Disassembly:
push 0x54
mov eax, 0x57d4fc
call fcn.00552eab
mov esi, ecx
mov dword [ebp - 0x5c], esi
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x60], esi
call fcn.00404998
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp dword [esi + 8], ebx
jne 0x40a423
lea ecx, [ebp - 0x28]
call fcn.00404998
mov byte [ebp - 4], 1
lea edx, [ebp - 0x40]
mov ecx, str.ExtMonitor
call fcn.0040aee9
push str.Lock
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0x58]
call fcn.0040a7c8
pop ecx
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x28]
push eax
call fcn.0040a6e2
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x58]
call fcn.004043b0
lea ecx, [ebp - 0x28]
call fcn.00403d80
cmp dword [eax + 0x14], 8
jb 0x40a40c
mov eax, dword [eax]
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi + 8], eax
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x28]
call fcn.004043b0
push 0x32
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x40a50a
push str.MappedFile
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0x28]
call fcn.0040a7c8
pop ecx
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x28]
call fcn.00403d80
cmp dword [eax + 0x14], 8
jb 0x40a45b
mov eax, dword [eax]
push eax
push 0x48
push ebx
push 4
push ebx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [esi + 4], eax
test eax, eax
je 0x40a4f6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x48
push 0
push 0
xor ebx, ebx
cmp eax, 0xb7
push 0xf001f
push dword [esi + 4]
setne bl
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
mov dword [esi + 0xc], edi
test edi, edi
je 0x40a4f4
test ebx, ebx
je 0x40a4e2
mov dword [ebp - 0x5c], edi
mov byte [ebp - 4], 4
xor ebx, ebx
mov dword [edi + 4], ebx
lea ecx, [edi + 0x14]
mov dword [edi], vtable.NGLogging::CExtMonitorSettings.0
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
mov byte [edi + 0x10], bl
call fcn.00404998
mov byte [ebp - 4], 5
lea ecx, [edi + 0x2c]
call fcn.00404998
mov byte [ebp - 4], 6
mov dword [edi + 0x44], ebx
mov byte [ebp - 4], 3
jmp 0x40a4e4
xor ebx, ebx
mov ecx, dword [esi + 0xc]
lea eax, [ecx + 4]
neg ecx
sbb ecx, ecx
and ecx, eax
inc dword [ecx]
jmp 0x40a4f6
xor ebx, ebx
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x28]
call fcn.004043b0
mov esi, dword [esi + 0xc]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.004043b0
mov eax, esi
call fcn.00552e55
ret 4
Function at 0x40adb6
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push edi
mov edi, ecx
mov ebx, edx
test edi, edi
je 0x40ae30
xor ecx, ecx
lea eax, [ebp - 4]
push eax
push ecx
lea eax, [ebp - 8]
mov dword [ebp - 4], ecx
push eax
push ecx
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40ae30
cmp dword [ebp - 8], 1
jne 0x40ae30
mov eax, dword [ebp - 4]
xor ecx, ecx
push esi
shr eax, 1
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00417f6f
mov esi, eax
pop ecx
test esi, esi
je 0x40ae2f
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 8]
push eax
push 0
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40ae28
mov ecx, dword [ebp + 8]
push esi
call fcn.00403b70
push esi
call fcn.00417f78
pop ecx
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40f13e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
je 0x40f1ad
push ebx
push edi
call fcn.004259a9
push 5
push dword [ebp + 8]
mov edi, dword [eax + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x40f1ab
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40f1ab
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp + 8], eax
test eax, eax
je 0x40f1ab
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test edi, edi
je 0x40f1ab
push edi
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x40f1ab
push edi
push dword [ebp + 8]
mov edx, edi
mov ecx, esi
call fcn.004105e4
pop ecx
pop ecx
pop edi
pop ebx
mov eax, esi
pop esi
pop ebp
ret 4
Function at 0x411637
Capabilities:
Get file version info

Disassembly:
push 0x10
mov eax, 0x57e468
call fcn.00552ee2
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [esi], vtable.NGUtils::AFileVersionInfo.0
xor edi, edi
mov dword [ebp - 4], edi
mov dword [esi], vtable.NGUtils::CFileVersionInfo.0
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 4], edi
mov eax, dword [ebp + 8]
test eax, eax
je 0x41170d
mov dword [ebp - 0x18], edi
lea ecx, [ebp - 0x18]
push ecx
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov ebx, eax
mov dword [ebp - 0x1c], ebx
test ebx, ebx
je 0x41170d
mov byte [ebp - 4], 1
push ebx
call fcn.00417f6f
pop ecx
mov dword [esi + 0xc], eax
mov dword [ebp - 4], edi
jmp 0x4116b6
cmp dword [esi + 0xc], 0
je 0x41170d
push dword [esi + 0xc]
push ebx
push dword [ebp - 0x18]
push dword [ebp + 8]
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x41170d
mov dword [ebp + 8], edi
mov dword [ebp - 0x1c], edi
lea eax, [ebp + 8]
push eax
lea eax, [esi + 0x10]
push eax
push 0x5cc74c
push dword [esi + 0xc]
mov edi, dword [sym.imp.VERSION.dll_VerQueryValueW]
call edi
test eax, eax
je 0x4116fb
mov eax, dword [ebp + 8]
shr eax, 2
mov dword [esi + 8], eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [esi + 4]
push eax
push 0x5c9b58
push dword [esi + 0xc]
call edi
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.00552e40
ret 4

Function at 0x411b20
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 0x2c]
push eax
mov ecx, dword [ebp + 0x28]
push ecx
mov edx, dword [ebp + 0x24]
push edx
mov eax, dword [ebp + 0x20]
push eax
mov ecx, dword [ebp + 0x1c]
push ecx
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov esp, ebp
pop ebp
ret 0x28

Function at 0x411bf0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esp, ebp
pop ebp
ret 0x18

Function at 0x411cd0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov esp, ebp
pop ebp
ret 8

Function at 0x411e90
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esp, ebp
pop ebp
ret 4
Function at 0x4129e0
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov esp, ebp
pop ebp
ret 8

Function at 0x412fd0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov esp, ebp
pop ebp
ret 4

Function at 0x412ff0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov esp, ebp
pop ebp
ret 0x18

Function at 0x413fc3
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push 0x7c
mov eax, 0x57dc57
call fcn.00552eab
mov esi, ecx
push ecx
push ecx
push 0x1ac
push str.NGUtils::CFileUtils::DeleteFileW
push 0x5fba34
push dword [0x5faf7c]
lea ecx, [ebp - 0x88]
call fcn.00404d82
and dword [ebp - 4], 0
mov ecx, esi
call fcn.00403d80
mov esi, eax
push 8
pop edi
cmp dword [esi + 0x14], edi
jb 0x41400a
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x414065
test bl, 1
je 0x41407e
and ebx, 0xfffffffe
cmp dword [esi + 0x14], edi
jb 0x414029
mov eax, dword [esi]
jmp 0x41402b
mov eax, esi
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x41407e
cmp dword [esi + 0x14], edi
jb 0x41403e
mov esi, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebx
push esi
push str.::SetFileAttributes__s__0x_X___error_d
push 0x1bb
lea eax, [ebp - 0x88]
push 0x80
push eax
call fcn.00405095
add esp, 0x1c
xor ebx, ebx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x88]
call fcn.00404deb
mov al, bl
call fcn.00552e55
ret
cmp dword [esi + 0x14], edi
jb 0x414087
mov eax, dword [esi]
jmp 0x414089
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x4140c3
cmp dword [esi + 0x14], edi
jb 0x41409b
mov esi, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.::DeleteFile__s___error_d
push 0x1c2
lea eax, [ebp - 0x88]
push 0x80
push eax
call fcn.00405095
add esp, 0x18
jmp 0x414065
mov bl, 1
jmp 0x414067
Function at 0x414464
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
xor edi, edi
mov dword [ebp - 4], ebx
mov esi, edi
jmp 0x414479
mov ebx, dword [ebp - 4]
add edi, 0x200
test esi, esi
je 0x41448a
push esi
call fcn.00417f78
pop ecx
xor ecx, ecx
mov eax, edi
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00417f6f
mov esi, eax
pop ecx
test esi, esi
je 0x4144f3
xor eax, eax
lea ecx, [ebx + 4]
mov word [esi], ax
call fcn.00403d80
cmp dword [eax + 0x14], 8
jb 0x4144bc
mov eax, dword [eax]
push eax
push edi
push esi
push 0x5c5710
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov ebx, eax
lea ecx, [edi - 1]
cmp ebx, ecx
jae 0x414476
mov ecx, dword [ebp + 0x10]
push esi
call fcn.00403b70
push esi
call fcn.00417f78
xor eax, eax
cmp eax, ebx
pop ecx
sbb eax, eax
neg eax
jmp 0x4144f5
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x417451
Capabilities:
Get common file path

Disassembly:
push 0x4d8
mov eax, 0x57ebe9
call fcn.00552eab
lea eax, [ebp - 0x21c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
jne 0x417484
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 3
pop eax
jmp 0x4175f1
lea ecx, [ebp - 0x234]
call fcn.00404998
xor ebx, ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x264]
call fcn.00403b10
mov byte [ebp - 4], 1
mov esi, 0x5cd8b4
push esi
call fcn.00403bf0
pop ecx
push eax
push ebx
push esi
lea ecx, [ebp - 0x264]
call fcn.0040b77c
dec eax
lea ecx, [ebp - 0x264]
push eax
push ebx
lea eax, [ebp - 0x24c]
push eax
call fcn.0040b5d1
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x24c]
call fcn.00403d80
cmp dword [eax + 0x14], 8
jb 0x4174f0
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x294]
call fcn.00403b10
mov byte [ebp - 4], 3
mov esi, str.config.ini
push esi
call fcn.00403bf0
pop ecx
push eax
push esi
lea ecx, [ebp - 0x24c]
call fcn.00405210
lea ecx, [ebp - 0x234]
or ebx, 0xffffffff
cmp ecx, eax
je 0x41752f
push ebx
push 0
push eax
call fcn.00403d90
lea ecx, [ebp - 0x234]
call fcn.00403d80
cmp dword [eax + 0x14], 8
jb 0x417542
mov eax, dword [eax]
lea ecx, [ebp - 0x4e4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, ebx
jne 0x41755b
push 2
pop esi
jmp 0x4175b4
lea ecx, [ebp - 0x294]
call fcn.00403d80
cmp dword [eax + 0x14], 8
jb 0x41756e
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x27c]
call fcn.00403b10
mov byte [ebp - 4], 4
lea eax, [ebp - 0x27c]
push ebx
push 0
push eax
mov ecx, 0x5fbaa4
call fcn.00403d90
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x27c]
call fcn.004043b0
call fcn.004154b1
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FindClose]
call fcn.004152b7
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x294]
call fcn.004043b0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x24c]
call fcn.004043b0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x264]
call fcn.004043b0
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x234]
call fcn.004043b0
mov eax, esi
call fcn.00552e55
ret

Function at 0x417dc0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 0x30]
push eax
mov ecx, dword [ebp + 0x2c]
push ecx
mov edx, dword [ebp + 0x28]
push edx
mov eax, dword [ebp + 0x24]
push eax
mov ecx, dword [ebp + 0x20]
push ecx
mov edx, dword [ebp + 0x1c]
push edx
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov esp, ebp
pop ebp
ret 0x2c
Function at 0x41c02d
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
push edi
cmp dword [ecx + 0x58], esi
je 0x41c080
push esi
push dword [ebp + 8]
call fcn.0041c220
mov edi, eax
test edi, edi
jne 0x41c050
mov eax, dword [ebp + 0x10]
jmp 0x41c092
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp + 0xc]
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x41c04b
mov eax, dword [ebp - 8]
jmp 0x41c092
push dword [ecx + 0x6c]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x41d2bc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor esi, esi
call fcn.004259a9
push 5
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x41d2f3
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
mov ecx, dword [ebp - 4]
push ebx
push dword [ebp + 0xc]
push esi
call fcn.0041d314
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4201f6
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 4], ecx
mov esi, edi
cmp dword [ebp + 8], esi
je 0x42023b
call fcn.004259a9
push 0xf0
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x42023b
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x420257
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.0045bb30
mov ebx, eax
test edi, edi
je 0x420255
test esi, esi
je 0x420255
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x420c67
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
je 0x420d25
cmp dword [esi + 0x20], 0
je 0x420d25
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x420d25
cmp dword [ebp + 8], 0
je 0x420d25
xor eax, eax
mov ebx, eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], ebx
mov edi, eax
call fcn.004259a9
push 0x58fa20
push dword [ebp + 8]
mov eax, dword [eax + 0xc]
push eax
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x420cf6
mov edi, dword [ebp - 0xc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp - 0x10]
mov dword [ebp - 4], eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x420d25
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov dword [ebp - 8], eax
push dword [ebp - 4]
push ebx
push esi
call fcn.0045d718
add esp, 0xc
mov ebx, eax
cmp dword [ebp - 8], 0
je 0x420d16
test edi, edi
je 0x420d16
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
test ebx, ebx
je 0x420d21
mov ecx, esi
call fcn.00420a0a
mov eax, ebx
jmp 0x420d27
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x425254
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x58afc8
call fcn.00552e77
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x74], ebx
jne 0x42527a
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x4252d9
call fcn.0042709b
push eax
lea ecx, [ebp - 0x10]
call fcn.0041056f
mov edi, dword [edi + 0x74]
lea ecx, [ebp - 0x10]
push ecx
mov dword [ebp - 4], ebx
mov eax, dword [edi]
mov esi, dword [eax + 0x8c]
mov ecx, esi
call fcn.00552e3a
mov ecx, edi
call esi
mov esi, dword [ebp + 8]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push esi
call fcn.0055a3ec
push eax
call fcn.0041005b
add esp, 0x14
test esi, esi
je 0x4252cc
push esi
call fcn.00558423
pop ecx
mov ebx, eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.0041067e
mov eax, ebx
call fcn.00552e40
ret 8
Function at 0x438157
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
test esi, esi
jne 0x438170
call fcn.004259a9
mov esi, dword [eax + 0xc]
push 0x5c77c0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x4381c6
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x4381c5
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
test eax, eax
jne 0x4381a6
xor esi, esi
jmp 0x4381bc
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 8]
push eax
push dword [ebp - 4]
call fcn.004381ce
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x45f14f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
mov dword [ebp - 4], ebx
test byte [esi + 4], 1
je 0x45f169
mov edi, dword [esi + 0xc]
jmp 0x45f1a9
push 5
push dword [esi + 0xc]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x45f182
call fcn.0042c513
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x45f197
call fcn.0042c513
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x45f1a9
call fcn.0042c513
call fcn.004259a9
cmp dword [eax + 0x3c], 0
je 0x45f1be
push edi
mov ecx, ebx
call fcn.0045e888
mov edi, eax
push dword [ebp + 0xc]
push edi
call fcn.0045f39b
mov ebx, eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x88]
test ecx, ecx
je 0x45f1e7
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 4]
and dword [eax + 0x88], 0
test ebx, ebx
je 0x45f1f3
mov edi, ebx
mov dword [eax + 0x88], ebx
or dword [esi + 4], 1
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x46758c
Capabilities:
Get file system object information

Disassembly:
push 0x4cc
mov eax, 0x581fb1
call fcn.00552eab
mov ebx, ecx
mov eax, dword [ebx + 0x14]
sub eax, 0x10
push eax
call fcn.00410494
pop ecx
lea esi, [eax + 0x10]
mov dword [ebp - 0x4d0], esi
and dword [ebp - 4], 0
lea ecx, [ebp - 0x4d0]
push 0
push 0x5c9b58
call fcn.0040fb43
cmp eax, 0xffffffff
jne 0x467657
push 0
push 0x591214
lea ecx, [ebp - 0x4d0]
call fcn.0040fb43
cmp eax, 0xffffffff
jne 0x467657
push 0
push 0x5c9cec
lea ecx, [ebp - 0x4d0]
call fcn.0040fb43
cmp eax, 0xffffffff
jne 0x467657
mov eax, dword [ebx + 0x14]
sub eax, 0x10
push eax
call fcn.00410494
mov edi, eax
pop ecx
mov dword [ebp - 0x4d4], edi
lea ecx, [edi + 0x10]
mov dword [ebp - 0x4d8], ecx
xor edx, edx
mov byte [ebp - 4], 1
push edx
lea eax, [ebp - 0x218]
push eax
push 0x104
push edx
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_SearchPathW]
test eax, eax
jne 0x467634
mov eax, dword [ebx]
mov edi, dword [eax + 0x14]
mov ecx, edi
call fcn.00552e3a
mov ecx, ebx
call edi
mov ecx, dword [ebp - 0x4d4]
mov edi, eax
call fcn.0041067e
jmp 0x46768f
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x4d0]
call fcn.00410475
mov ecx, edi
mov byte [ebp - 4], 0
call fcn.0041067e
mov esi, dword [ebp - 0x4d0]
push 0x105
push 0x2b4
lea eax, [ebp - 0x4cc]
push eax
push 0
push esi
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x46767d
mov edi, dword [ebp - 0x4cc]
jmp 0x46768f
mov eax, dword [ebx]
mov edi, dword [eax + 0x14]
mov ecx, edi
call fcn.00552e3a
mov ecx, ebx
call edi
mov edi, eax
lea ecx, [esi - 0x10]
call fcn.0041067e
mov eax, edi
call fcn.00552e55
ret