joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4115c4
Capabilities:
Get file version info

Disassembly:
push 0x10
mov eax, 0x57e398
call fcn.00552e13
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [esi], vtable.NGUtils::AFileVersionInfo.0
xor edi, edi
mov dword [ebp - 4], edi
mov dword [esi], vtable.NGUtils::CFileVersionInfo.0
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 4], edi
mov eax, dword [ebp + 8]
test eax, eax
je 0x41169a
mov dword [ebp - 0x18], edi
lea ecx, [ebp - 0x18]
push ecx
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov ebx, eax
mov dword [ebp - 0x1c], ebx
test ebx, ebx
je 0x41169a
mov byte [ebp - 4], 1
push ebx
call fcn.00417e9f
pop ecx
mov dword [esi + 0xc], eax
mov dword [ebp - 4], edi
jmp 0x411643
cmp dword [esi + 0xc], 0
je 0x41169a
push dword [esi + 0xc]
push ebx
push dword [ebp - 0x18]
push dword [ebp + 8]
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x41169a
mov dword [ebp + 8], edi
mov dword [ebp - 0x1c], edi
lea eax, [ebp + 8]
push eax
lea eax, [esi + 0x10]
push eax
push 0x5cc728
push dword [esi + 0xc]
mov edi, dword [sym.imp.VERSION.dll_VerQueryValueW]
call edi
test eax, eax
je 0x411688
mov eax, dword [ebp + 8]
shr eax, 2
mov dword [esi + 8], eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [esi + 4]
push eax
push 0x5c9b48
push dword [esi + 0xc]
call edi
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.00552d71
ret 4

Function at 0x411ab0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 0x2c]
push eax
mov ecx, dword [ebp + 0x28]
push ecx
mov edx, dword [ebp + 0x24]
push edx
mov eax, dword [ebp + 0x20]
push eax
mov ecx, dword [ebp + 0x1c]
push ecx
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov esp, ebp
pop ebp
ret 0x28

Function at 0x411b80
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esp, ebp
pop ebp
ret 0x18

Function at 0x411c60
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov esp, ebp
pop ebp
ret 8

Function at 0x411e20
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esp, ebp
pop ebp
ret 4
Function at 0x412970
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov esp, ebp
pop ebp
ret 8

Function at 0x412f60
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov esp, ebp
pop ebp
ret 4

Function at 0x412f80
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov esp, ebp
pop ebp
ret 0x18

Function at 0x413f53
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push 0x7c
mov eax, 0x57db87
call fcn.00552ddc
mov esi, ecx
push ecx
push ecx
push 0x1ac
push str.NGUtils::CFileUtils::DeleteFileW
push 0x5fba2c
push dword [0x5faf74]
lea ecx, [ebp - 0x88]
call fcn.00404d12
and dword [ebp - 4], 0
mov ecx, esi
call fcn.00403d10
mov esi, eax
push 8
pop edi
cmp dword [esi + 0x14], edi
jb 0x413f9a
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x413ff5
test bl, 1
je 0x41400e
and ebx, 0xfffffffe
cmp dword [esi + 0x14], edi
jb 0x413fb9
mov eax, dword [esi]
jmp 0x413fbb
mov eax, esi
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x41400e
cmp dword [esi + 0x14], edi
jb 0x413fce
mov esi, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebx
push esi
push str.::SetFileAttributes__s__0x_X___error_d
push 0x1bb
lea eax, [ebp - 0x88]
push 0x80
push eax
call fcn.00405025
add esp, 0x1c
xor ebx, ebx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x88]
call fcn.00404d7b
mov al, bl
call fcn.00552d86
ret
cmp dword [esi + 0x14], edi
jb 0x414017
mov eax, dword [esi]
jmp 0x414019
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x414053
cmp dword [esi + 0x14], edi
jb 0x41402b
mov esi, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.::DeleteFile__s___error_d
push 0x1c2
lea eax, [ebp - 0x88]
push 0x80
push eax
call fcn.00405025
add esp, 0x18
jmp 0x413ff5
mov bl, 1
jmp 0x413ff7
Function at 0x4143f4
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
xor edi, edi
mov dword [ebp - 4], ebx
mov esi, edi
jmp 0x414409
mov ebx, dword [ebp - 4]
add edi, 0x200
test esi, esi
je 0x41441a
push esi
call fcn.00417ea8
pop ecx
xor ecx, ecx
mov eax, edi
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00417e9f
mov esi, eax
pop ecx
test esi, esi
je 0x414483
xor eax, eax
lea ecx, [ebx + 4]
mov word [esi], ax
call fcn.00403d10
cmp dword [eax + 0x14], 8
jb 0x41444c
mov eax, dword [eax]
push eax
push edi
push esi
push 0x5c5700
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov ebx, eax
lea ecx, [edi - 1]
cmp ebx, ecx
jae 0x414406
mov ecx, dword [ebp + 0x10]
push esi
call fcn.00403b00
push esi
call fcn.00417ea8
xor eax, eax
cmp eax, ebx
pop ecx
sbb eax, eax
neg eax
jmp 0x414485
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x41448e
Capabilities:
Read .ini file

Disassembly:
push 0x30
mov eax, 0x57e768
call fcn.00552ddc
mov ebx, ecx
mov dword [ebp - 0x2c], ebx
mov eax, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x34], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x38], eax
jmp 0x4144ba
mov ebx, dword [ebp - 0x2c]
add edi, 0x200
test esi, esi
je 0x4144cb
push esi
call fcn.00417ea8
pop ecx
push edi
call fcn.00417e9f
mov esi, eax
pop ecx
test esi, esi
je 0x414580
xor eax, eax
mov byte [esi], al
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x28], al
mov dword [ebp - 4], eax
lea ecx, [ebx + 4]
call fcn.00403d10
mov ebx, eax
cmp dword [ebx + 0x14], 8
jb 0x414508
mov ebx, dword [ebx]
mov ecx, dword [ebp - 0x2c]
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ecx + 4]
call fcn.0040a732
lea ecx, [ebp - 0x28]
push dword [eax]
push ebx
call fcn.00414ade
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push edi
push esi
push 0x5c986c
push dword [ebp - 0x30]
push dword [ebp - 0x34]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov ebx, eax
or dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.00409798
lea edx, [edi - 1]
cmp ebx, edx
jae 0x4144b7
push esi
call fcn.004054a5
pop ecx
mov ecx, dword [ebp - 0x38]
push eax
push esi
call fcn.004097ed
push esi
call fcn.00417ea8
xor eax, eax
cmp eax, ebx
pop ecx
sbb eax, eax
neg eax
jmp 0x414582
xor al, al
call fcn.00552d86
ret 0xc
Function at 0x417380
Capabilities:
Get common file path

Disassembly:
push 0x4d8
mov eax, 0x57eb19
call fcn.00552ddc
lea eax, [ebp - 0x21c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
jne 0x4173b3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 3
pop eax
jmp 0x417520
lea ecx, [ebp - 0x234]
call fcn.00404928
xor ebx, ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x264]
call fcn.00403aa0
mov byte [ebp - 4], 1
mov esi, 0x5cd874
push esi
call fcn.00403b80
pop ecx
push eax
push ebx
push esi
lea ecx, [ebp - 0x264]
call fcn.0040b709
dec eax
lea ecx, [ebp - 0x264]
push eax
push ebx
lea eax, [ebp - 0x24c]
push eax
call fcn.0040b55e
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x24c]
call fcn.00403d10
cmp dword [eax + 0x14], 8
jb 0x41741f
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x294]
call fcn.00403aa0
mov byte [ebp - 4], 3
mov esi, str.config.ini
push esi
call fcn.00403b80
pop ecx
push eax
push esi
lea ecx, [ebp - 0x24c]
call fcn.004051a0
lea ecx, [ebp - 0x234]
or ebx, 0xffffffff
cmp ecx, eax
je 0x41745e
push ebx
push 0
push eax
call fcn.00403d20
lea ecx, [ebp - 0x234]
call fcn.00403d10
cmp dword [eax + 0x14], 8
jb 0x417471
mov eax, dword [eax]
lea ecx, [ebp - 0x4e4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, ebx
jne 0x41748a
push 2
pop esi
jmp 0x4174e3
lea ecx, [ebp - 0x294]
call fcn.00403d10
cmp dword [eax + 0x14], 8
jb 0x41749d
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x27c]
call fcn.00403aa0
mov byte [ebp - 4], 4
lea eax, [ebp - 0x27c]
push ebx
push 0
push eax
mov ecx, 0x5fba9c
call fcn.00403d20
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x27c]
call fcn.00404340
call fcn.00415441
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FindClose]
call fcn.00415247
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x294]
call fcn.00404340
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x24c]
call fcn.00404340
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x264]
call fcn.00404340
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x234]
call fcn.00404340
mov eax, esi
call fcn.00552d86
ret

Function at 0x417cf0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 0x30]
push eax
mov ecx, dword [ebp + 0x2c]
push ecx
mov edx, dword [ebp + 0x28]
push edx
mov eax, dword [ebp + 0x24]
push eax
mov ecx, dword [ebp + 0x20]
push ecx
mov edx, dword [ebp + 0x1c]
push edx
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov esp, ebp
pop ebp
ret 0x2c
Function at 0x41bdfb
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x18
mov eax, 0x57ef0a
call fcn.00552da8
mov eax, ecx
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp + 0x10]
xor edi, edi
mov ecx, dword [ebp + 0x14]
push edi
mov dword [ebx], edi
mov dword [ecx], edi
cmp dword [eax + 0x58], edi
je 0x41bea5
push dword [ebp + 8]
mov ecx, eax
call fcn.0041c133
mov esi, eax
test esi, esi
je 0x41bf38
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], edi
lea eax, [ebp - 0x14]
mov dword [ebp - 4], edi
push eax
push edi
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], edi
push eax
push edi
push dword [ebp + 0xc]
mov dword [ebp - 0x14], edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp - 0x14]
mov dword [ecx], edx
test eax, eax
jne 0x41be8e
push edx
call fcn.00417e9f
pop ecx
lea ecx, [ebp - 0x14]
mov dword [ebx], eax
push ecx
push eax
lea eax, [ebp - 0x18]
push eax
push edi
push dword [ebp + 0xc]
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41be8e
xor edi, edi
inc edi
jmp 0x41be98
push dword [ebx]
call fcn.00417ea8
pop ecx
mov dword [ebx], edi
lea ecx, [ebp - 0x24]
call fcn.0041bcc0
jmp 0x41bf36
mov esi, dword [eax]
lea eax, [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
mov esi, dword [esi + 0x84]
mov ecx, esi
push eax
call fcn.00552d6b
mov ecx, dword [ebp - 0x18]
call esi
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], 1
mov esi, dword [eax - 0xc]
mov dword [ebp - 0x18], esi
test esi, esi
je 0x41bf2e
mov ecx, dword [ebp + 0x14]
mov eax, esi
shr eax, 1
push eax
mov dword [ecx], eax
call fcn.00417e9f
mov dword [ebx], eax
pop ecx
test esi, esi
jle 0x41bf28
mov esi, dword [ebp + 0x10]
lea eax, [edi + 1]
push eax
lea ecx, [ebp - 0x10]
call fcn.0041bc9c
push edi
lea ecx, [ebp - 0x10]
lea ebx, [eax - 1]
shl bl, 4
sub bl, 0x41
call fcn.0041bc9c
add al, bl
mov edx, edi
test edx, edx
jns 0x41bf19
add edx, 1
sar edx, 1
mov ecx, dword [esi]
add edi, 2
mov byte [edx + ecx], al
cmp edi, dword [ebp - 0x18]
jl 0x41bef0
mov eax, dword [ebp - 0x10]
xor edi, edi
inc edi
lea ecx, [eax - 0x10]
call fcn.0041060b
mov eax, edi
call fcn.00552d71
ret 0x10

Function at 0x41bf40
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
push edi
cmp dword [ecx + 0x58], esi
je 0x41bf93
push esi
push dword [ebp + 8]
call fcn.0041c133
mov edi, eax
test edi, edi
jne 0x41bf63
mov eax, dword [ebp + 0x10]
jmp 0x41bfa5
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp + 0xc]
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x41bf5e
mov eax, dword [ebp - 8]
jmp 0x41bfa5
push dword [ecx + 0x6c]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x41d1cf
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor esi, esi
call fcn.00425815
push 5
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x41d206
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
mov ecx, dword [ebp - 4]
push ebx
push dword [ebp + 0xc]
push esi
call fcn.0041d227
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x420062
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 4], ecx
mov esi, edi
cmp dword [ebp + 8], esi
je 0x4200a7
call fcn.00425815
push 0xf0
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x4200a7
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x4200c3
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.0045b7a3
mov ebx, eax
test edi, edi
je 0x4200c1
test esi, esi
je 0x4200c1
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x420ad3
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
je 0x420b91
cmp dword [esi + 0x20], 0
je 0x420b91
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x420b91
cmp dword [ebp + 8], 0
je 0x420b91
xor eax, eax
mov ebx, eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], ebx
mov edi, eax
call fcn.00425815
push 0x58fa10
push dword [ebp + 8]
mov eax, dword [eax + 0xc]
push eax
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x420b62
mov edi, dword [ebp - 0xc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp - 0x10]
mov dword [ebp - 4], eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x420b91
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov dword [ebp - 8], eax
push dword [ebp - 4]
push ebx
push esi
call fcn.0045d36e
add esp, 0xc
mov ebx, eax
cmp dword [ebp - 8], 0
je 0x420b82
test edi, edi
je 0x420b82
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
test ebx, ebx
je 0x420b8d
mov ecx, esi
call fcn.00420876
mov eax, ebx
jmp 0x420b93
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4250c0
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x58aea8
call fcn.00552da8
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x74], ebx
jne 0x4250e6
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x425145
call fcn.00426f07
push eax
lea ecx, [ebp - 0x10]
call fcn.004104fc
mov edi, dword [edi + 0x74]
lea ecx, [ebp - 0x10]
push ecx
mov dword [ebp - 4], ebx
mov eax, dword [edi]
mov esi, dword [eax + 0x8c]
mov ecx, esi
call fcn.00552d6b
mov ecx, edi
call esi
mov esi, dword [ebp + 8]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push esi
call fcn.0055a31c
push eax
call fcn.0040ffe8
add esp, 0x14
test esi, esi
je 0x425138
push esi
call fcn.00558353
pop ecx
mov ebx, eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.0041060b
mov eax, ebx
call fcn.00552d71
ret 8
Function at 0x437fc6
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
test esi, esi
jne 0x437fdf
call fcn.00425815
mov esi, dword [eax + 0xc]
push 0x5c77b0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x438035
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x438034
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
test eax, eax
jne 0x438015
xor esi, esi
jmp 0x43802b
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 8]
push eax
push dword [ebp - 4]
call fcn.0043803d
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x45ee4a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
mov dword [ebp - 4], ebx
test byte [esi + 4], 1
je 0x45ee64
mov edi, dword [esi + 0xc]
jmp 0x45eea4
push 5
push dword [esi + 0xc]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x45ee7d
call fcn.0042c351
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x45ee92
call fcn.0042c351
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x45eea4
call fcn.0042c351
call fcn.00425815
cmp dword [eax + 0x3c], 0
je 0x45eeb9
push edi
mov ecx, ebx
call fcn.0045e4de
mov edi, eax
push dword [ebp + 0xc]
push edi
call fcn.0045f096
mov ebx, eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x88]
test ecx, ecx
je 0x45eee2
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 4]
and dword [eax + 0x88], 0
test ebx, ebx
je 0x45eeee
mov edi, ebx
mov dword [eax + 0x88], ebx
or dword [esi + 4], 1
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4e3b34
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, ecx
call fcn.00540dbb
call fcn.00425869
cmp dword [eax + 0x14], 0
jne 0x4e3b4f
mov ecx, esi
pop esi
jmp fcn.004e2e7a
pop esi
ret
Function at 0x4e3c7d
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
mov ecx, dword [esi + 4]
call fcn.00424fed
push 0xfffffffffffffff0
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
push dword [ebp + 0xc]
and eax, 3
mov ecx, esi
cmp al, 3
je 0x4e3cb9
call fcn.004e3e9f
mov dword [esi + 0xc], 1
jmp 0x4e3cbe
call fcn.004e3e9f
cmp dword [esi], 0
je 0x4e3d07
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov esi, dword [ebp + 0x10]
test eax, eax
jle 0x4e3ce1
lea ecx, [eax + 1]
push ecx
push eax
mov ecx, esi
call fcn.00420138
jmp 0x4e3cf2
push 0xff
mov ecx, esi
call fcn.00410727
push 0x100
push eax
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0xffffffffffffffff
mov ecx, esi
call fcn.0041c26f
jmp 0x4e3d2b
mov esi, dword [ebp + 0x10]
push dword [esi]
push 0xffffffffffffffff
push 0x14d
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
jne 0x4e3d2b
push dword [esi]
push dword [ebp - 4]
call fcn.00428b76
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4e3df4
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
push edi
push dword [ebp + 0xc]
call fcn.004e3e9f
cmp dword [esi], 0
mov edi, eax
mov dword [esi + 0xc], 1
je 0x4e3e3c
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.00420138
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.0041c26f
jmp 0x4e3e47
mov eax, dword [ebp + 0x10]
push dword [eax]
push edi
call fcn.00428b76
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x53e794
Capabilities:
Get common file path
Get file system object information

Disassembly:
push esi
mov esi, ecx
call fcn.00402720
call fcn.00425869
cmp dword [eax + 0x14], 0
jne 0x53e7af
mov ecx, esi
pop esi
jmp fcn.0053e012
pop esi
ret

Function at 0x56edbd
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0056ea80

Function at 0x56edc8
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0056ec01

Function at 0x570583
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00570243
Function at 0x577916
Capabilities:
Write file on windows

Disassembly:
push 0x20
mov eax, 0x58bfb5
call fcn.00552ddc
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x577a33
cmp byte [ebx + 0x3e], 0
je 0x577a33
mov eax, dword [ebx]
mov edi, 0xffff
push edi
mov esi, dword [eax + 0xc]
mov ecx, esi
call fcn.00552d6b
mov ecx, ebx
call esi
movzx eax, ax
cmp di, ax
sete al
test al, al
je 0x577962
xor al, al
jmp 0x577a35
xor eax, eax
mov dword [ebp - 0x14], 0xf
push eax
push 8
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x28], al
call fcn.00577c39
and dword [ebp - 4], 0
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov edx, ecx
cmp eax, 0x10
jae 0x577992
lea edx, [ebp - 0x28]
mov ecx, edx
mov edi, dword [ebx + 0x38]
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x18]
add eax, edx
mov esi, dword [edi]
push eax
push ecx
lea eax, [ebx + 0x40]
mov ecx, dword [esi + 0x20]
push eax
call fcn.00552d6b
mov ecx, edi
call dword [esi + 0x20]
sub eax, 0
je 0x5779c7
sub eax, 1
je 0x5779cb
dec eax
sub eax, 1
je 0x577a21
xor bl, bl
jmp 0x577a23
mov byte [ebx + 0x3e], 0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
mov edx, ecx
cmp eax, 0x10
jae 0x5779db
lea edx, [ebp - 0x28]
mov esi, dword [ebp - 0x2c]
sub esi, edx
je 0x577a03
cmp eax, 0x10
jae 0x5779ea
lea ecx, [ebp - 0x28]
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call fcn.00564116
add esp, 0x10
cmp esi, eax
jne 0x5779c3
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
cmp byte [ebx + 0x3e], 0
je 0x577a21
test esi, esi
jne 0x577986
push esi
push 8
lea ecx, [ebp - 0x28]
call fcn.00409df4
jmp 0x577980
mov bl, 1
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.00409798
mov al, bl
jmp 0x577a35
mov al, 1
call fcn.00552d86
ret