joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43ba40
Capabilities:
Get system information on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4760db
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push esi
mov eax, dword [0x49d00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x400000
mov dword [0x4a1e40], 0x4886d0
mov dword [0x4a1e48], 0x488b74
push 0
mov dword [ebp - 0x10], 0x4a1e40
mov dword [0x4a1e5c], 1
mov dword [0x4a1e58], 0x100
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x43bcee
lea eax, [ecx + 0x400000]
mov dword [0x4a1e54], ecx
mov dword [0x4a1e50], eax
mov edx, 0x1555
mov eax, dword [0x4a1e58]
mov dword [0x4a1e4c], ecx
add eax, ecx
mov dword [ecx], eax
mov eax, dword [0x4a1e58]
add ecx, eax
add eax, ecx
mov dword [ecx], eax
mov eax, dword [0x4a1e58]
add ecx, eax
add eax, ecx
mov dword [ecx], eax
mov eax, dword [0x4a1e58]
add ecx, eax
sub edx, 1
jne 0x43bad4
mov dword [ecx], edx
mov dword [ebp - 4], edx
mov dword [ebp - 0x14], 0x4a1e60
mov dword [ebp - 0x18], 0x4a1e60
mov dword [ebp - 0x1c], 0x4a1e60
mov dword [0x4a1e60], 0x482748
mov dword [0x4a1e64], edx
mov dword [0x4a1e68], edx
mov byte [ebp - 4], 1
mov dword [0x4a1e60], 0x4826e4
mov dword [0x4a1e6c], edx
mov dword [0x4a1e74], edx
mov dword [0x4a1e70], edx
mov dword [0x4a1e78], 0x40
mov byte [ebp - 4], 2
mov dword [0x4a1e78], 0x80
mov byte [ebp - 4], 5
mov dword [0x4a1e7c], edx
mov byte [ebp - 4], 6
mov esi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x4a1e90
mov dword [ebp - 0x1c], 0x4a1e90
call esi
mov byte [ebp - 4], 7
mov dword [0x4a1ea8], 0
mov byte [ebp - 4], 8
push 0x4a1eb4
mov dword [ebp - 0x1c], 0x4a1eb4
call esi
mov byte [ebp - 4], 9
mov dword [0x4a1ecc], 0x3e8
mov dword [ebp - 0x18], 0x4a1ee0
mov dword [ebp - 0x14], 0x4a1ee0
mov dword [0x4a1ee0], 0x482748
mov dword [0x4a1ee4], 0
mov dword [0x4a1ee8], 0
mov byte [ebp - 4], 0xa
mov dword [0x4a1ee0], 0x4826e4
mov dword [0x4a1eec], 0
mov dword [0x4a1ef4], 0
mov dword [0x4a1ef0], 0
mov dword [0x4a1ef8], 0x40
mov byte [ebp - 4], 0xb
mov dword [0x4a1ef8], 0x80
mov byte [ebp - 4], 0xd
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x2c]
mov dword [0x4a1ed4], 0x3e80
mov dword [0x4a1ed8], 1
mov dword [0x4a1edc], 0
lea eax, [eax*2 + 2]
mov dword [0x4a1ed0], eax
mov byte [ebp - 4], 0xe
push 0x4a1efc
call esi
mov byte [ebp - 4], 0xf
push ecx
mov ecx, 0x4a1f14
call fcn.0043abf0
mov byte [ebp - 4], 0x10
mov dword [0x4a1e80], 0
mov dword [0x4a1f3c], 0
movsd xmm0, qword [0x489618]
movsd qword [0x4a1e88], xmm0
xorps xmm0, xmm0
mov dword [0x4a1f40], 0
mov dword [0x4a1f44], 0
mov dword [0x4a1f48], 0
mov dword [0x4a1e84], 0
movq qword [0x4a1eac], xmm0
mov dword [ebp - 4], 0xffffffff
mov eax, 0x4a1e40
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00457262
int3
Function at 0x43c8c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
mov dword [esi + 0x14], 0
test ebx, ebx
jne 0x43c8df
pop esi
lea eax, [ebx + 1]
pop ebx
pop ebp
ret 0xc
mov eax, dword [ecx]
push edi
xor edi, edi
call dword [eax]
push dword [ebp + 0x10]
mov ecx, eax
movzx eax, bx
push eax
push ecx
mov dword [ebp + 0xc], ecx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp + 8], eax
test eax, eax
je 0x43c9b5
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp + 0x10], eax
test eax, eax
je 0x43c9b5
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x43c9ac
push dword [ebp + 8]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov dword [esi + 0x14], 0
cmp dword [esi + 0x10], edi
jl 0x43c990
cmp edi, 1
jne 0x43c955
mov eax, dword [esi + 0xc]
mov cl, byte [ebx]
mov byte [eax], cl
inc dword [esi + 0x14]
jmp 0x43c9a7
cmp edi, 2
jne 0x43c968
mov eax, dword [esi + 0xc]
movzx ecx, word [ebx]
mov word [eax], cx
add dword [esi + 0x14], edi
jmp 0x43c9a7
cmp edi, 4
jne 0x43c979
mov eax, dword [esi + 0xc]
mov ecx, dword [ebx]
mov dword [eax], ecx
add dword [esi + 0x14], edi
jmp 0x43c9a7
cmp edi, 8
jne 0x43c990
mov eax, dword [esi + 0xc]
mov ecx, dword [ebx]
mov edx, dword [ebx + 4]
mov dword [eax], ecx
mov dword [eax + 4], edx
add dword [esi + 0x14], edi
jmp 0x43c9a7
test edi, edi
jle 0x43c9a7
push edi
mov ecx, esi
call fcn.0043fce0
push edi
push ebx
push eax
call fcn.00455f90
add esp, 0xc
mov edi, 1
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x43ccf0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp esi, dword [0x4a1e58]
jg 0x43cd2b
push 0x4a1e5c
call fcn.00440560
mov ecx, dword [0x4a1e54]
add esp, 4
test ecx, ecx
je 0x43cd1d
mov eax, dword [ecx]
mov dword [0x4a1e54], eax
mov dword [0x4a1e5c], 1
test ecx, ecx
jne 0x43cd41
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x43cd48
mov eax, ecx
pop esi
pop ebp
ret 4
push 0xffffffffffffffff
call fcn.00457262
int3

Function at 0x43cdb0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp esi, dword [0x4a1e4c]
jb 0x43ce24
cmp esi, dword [0x4a1e50]
jae 0x43ce24
mov eax, dword [ebp + 0xc]
cmp eax, dword [0x4a1e58]
jle 0x43ce39
push edi
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x43ce3d
push dword [0x4a1e58]
push esi
push edi
call fcn.00455f90
push 0x4a1e5c
call fcn.00440560
mov eax, dword [0x4a1e54]
add esp, 0x10
mov dword [esi], eax
mov dword [0x4a1e54], esi
mov esi, edi
mov dword [0x4a1e5c], 1
pop edi
mov eax, esi
pop esi
pop ebp
ret 8
push dword [ebp + 0xc]
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov esi, eax
test esi, esi
jne 0x43ce1d
push 0xffffffffffffffff
call fcn.00457262
int3
Function at 0x43e240
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x476425
mov eax, dword fs:[0]
push eax
sub esp, 0x58
push esi
push edi
mov eax, dword [0x49d00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
test esi, esi
je 0x43e40a
cmp word [esi], 0
je 0x43e40a
lea ecx, [ebp - 0x38]
call fcn.004025e0
mov dword [ebp - 4], 0
movzx eax, word [esi]
mov edx, eax
test ax, ax
je 0x43e3e3
cmp word [esi + 2], 0
je 0x43e2f2
mov ecx, esi
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x43e2a4
sub ecx, edi
mov eax, edx
sar ecx, 1
cmp word [esi + ecx*2 - 2], 0x5c
jne 0x43e2f2
cmp word [esi + ecx*2 - 4], 0x3a
je 0x43e2f2
lea eax, [ecx - 1]
push eax
push esi
lea ecx, [ebp - 0x38]
call fcn.004421a0
mov esi, dword [ebp - 0x2c]
test esi, esi
jne 0x43e2ef
cmp dword [ebp - 0x14], esi
jne 0x43e2ec
movzx eax, word [0x47d154]
mov esi, 0x47d154
jmp 0x43e2f2
mov esi, dword [ebp - 0x1c]
movzx eax, word [esi]
movzx eax, ax
test ax, ax
je 0x43e3e3
cmp eax, 0x5c
jne 0x43e30e
cmp word [esi + 2], 0
je 0x43e3e3
cmp word [esi + 2], 0x3a
jne 0x43e332
movzx eax, word [esi + 4]
test ax, ax
je 0x43e3e3
cmp eax, 0x5c
jne 0x43e332
cmp word [esi + 6], 0
je 0x43e3e3
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0
push esi
call edi
test eax, eax
jne 0x43e3e3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x43e3e3
cmp eax, 3
jne 0x43e3df
push 0x5c
push esi
call fcn.00453b2e
mov edx, eax
add esp, 8
test edx, edx
je 0x43e3df
cmp word [edx + 2], 0
jne 0x43e391
sub edx, 2
cmp edx, esi
jb 0x43e3df
nop
cmp word [edx], 0x5c
je 0x43e391
sub edx, 2
cmp edx, esi
jae 0x43e380
xor esi, esi
jmp 0x43e3e8
lea ecx, [ebp - 0x64]
call fcn.004025e0
mov byte [ebp - 4], 1
sub edx, esi
sar edx, 1
lea ecx, [ebp - 0x64]
push edx
push esi
call fcn.004421a0
lea ecx, [ebp - 0x64]
call fcn.00441e80
mov ecx, eax
call fcn.0043e240
test eax, eax
je 0x43e3d3
push 0
push esi
call edi
mov esi, eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x64]
call fcn.00401ad0
jmp 0x43e3e8
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x64]
call fcn.00401ad0
xor esi, esi
jmp 0x43e3e8
mov esi, 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.00401ad0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x43e7c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46f62d
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push ebx
push esi
mov eax, dword [0x49d00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, ecx
test edx, edx
je 0x43e891
cmp word [edx], 0
je 0x43e891
lea ecx, [ebp - 0x38]
call fcn.004025e0
mov dword [ebp - 4], 0
cmp word [edx], 0
je 0x43e860
cmp word [edx + 2], 0
je 0x43e860
mov ecx, edx
lea esi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x43e820
sub ecx, esi
sar ecx, 1
cmp word [edx + ecx*2 - 2], 0x5c
jne 0x43e860
cmp word [edx + ecx*2 - 4], 0x3a
je 0x43e860
lea eax, [ecx - 1]
push eax
push edx
lea ecx, [ebp - 0x38]
call fcn.004421a0
mov edx, dword [ebp - 0x2c]
test edx, edx
jne 0x43e860
cmp dword [ebp - 0x14], 0
mov edx, 0x47d154
cmovne edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ebx, ebx
cmp eax, 0xffffffff
setne bl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.00401ad0
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43ed20
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4765b0
mov eax, dword fs:[0]
push eax
sub esp, 0x238
mov eax, dword [0x49d00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
test esi, esi
je 0x43ee8f
cmp word [esi], 0
je 0x43ee8f
lea ecx, [ebp - 0x244]
call fcn.004025e0
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x228]
mov dword [ebp - 0x238], 0
test eax, eax
je 0x43ed97
push eax
mov eax, dword [ebp - 0x234]
lea ecx, [ebp - 0x234]
call dword [eax + 0xc]
movzx eax, word [esi]
mov dword [ebp - 0x228], 0
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x224], 0
cmp eax, 0x5c
je 0x43edd0
test ax, ax
je 0x43ee02
cmp word [esi + 2], 0x3a
jne 0x43ee02
cmp word [esi + 4], 0x5c
jne 0x43ee02
push 0x5c
push esi
call fcn.00453b2e
add esp, 8
test eax, eax
je 0x43ee02
cmp eax, esi
jbe 0x43edee
cmp word [eax - 2], 0x3a
lea ecx, [eax - 2]
cmovne eax, ecx
sub eax, esi
lea ecx, [ebp - 0x244]
add eax, 2
sar eax, 1
push eax
push esi
call fcn.004421a0
mov edi, dword [ebp - 0x238]
test edi, edi
jne 0x43ee25
cmp dword [ebp - 0x220], edi
jne 0x43ee1b
mov edi, 0x47d154
jmp 0x43ee25
mov edi, dword [ebp - 0x228]
test edi, edi
je 0x43ee70
cmp word [edi], 0
je 0x43ee70
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x43ee70
cmp word [edi], 0
je 0x43ee4e
push edi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp word [ebp - 0x218], 0
mov esi, eax
je 0x43ee79
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
jmp 0x43ee79
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x244]
call fcn.00401ad0
mov eax, esi
jmp 0x43ee91
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00452408
mov esp, ebp
pop ebp
ret
Function at 0x43ff70
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
test eax, eax
je 0x440047
cmp word [eax], 0
je 0x440047
push ebx
push edi
push 0x4887a8
push eax
or ebx, 0xffffffff
call fcn.0045fc2c
mov edi, eax
add esp, 8
test edi, edi
je 0x44001a
mov ebx, dword [ebp + 0xc]
cmp ebx, 0xffffffff
jne 0x43ffcb
push 2
push 0
push edi
call fcn.0045f44f
push edi
call fcn.00460652
push 0
push 0
push edi
mov ebx, eax
call fcn.0045f44f
add esp, 0x1c
test ebx, ebx
jle 0x44000a
push edi
push ebx
push 1
push ebx
mov ecx, esi
call fcn.0043fc80
push eax
call fcn.0045ff97
push edi
mov ebx, eax
call fcn.004606f6
add esp, 0x14
test eax, eax
jne 0x44000e
push ebx
mov ecx, esi
call fcn.0043fce0
push edi
call fcn.0045f10f
add esp, 4
mov eax, ebx
pop edi
pop ebx
pop esi
pop ebp
ret 8
xor ebx, ebx
jmp 0x440011
or ebx, 0xffffffff
push edi
call fcn.0045f10f
add esp, 4
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x440029
mov edx, dword [esi]
push ecx
mov ecx, esi
call dword [edx + 0xc]
pop edi
mov eax, ebx
mov dword [esi + 0xc], 0
pop ebx
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
pop esi
pop ebp
ret 8
or eax, 0xffffffff
pop esi
pop ebp
ret 8

Function at 0x4409e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4757fd
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x49d00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
lea esi, [ebx + 0x14]
push esi
mov dword [ebp - 0x10], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 4], 0
push dword [ebx + 8]
mov edi, dword [sym.imp.KERNEL32.dll_ResetEvent]
mov dword [ebx + 0x2c], 0
mov dword [ebx + 0x30], 0
call edi
push dword [ebx + 0xc]
call edi
push dword [ebx + 0x10]
call edi
mov dword [ebp - 4], 0xffffffff
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x440a60
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push edi
lea edi, [esi + 0x14]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esi + 0x38], 2
jne 0x440b11
mov eax, dword [ebp + 0x14]
push ebx
push dword [esi + 8]
mov ebx, dword [sym.imp.KERNEL32.dll_ResetEvent]
mov dword [esi + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x3c], 0x438790
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call ebx
push dword [esi + 0x10]
call ebx
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_SetEvent]
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [esi + 0x38], 2
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
jne 0x440adb
push 0xa
call edi
cmp dword [esi + 0x38], 2
je 0x440ad1
push dword [esi + 8]
call ebx
push dword [esi + 0xc]
call ebx
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_SetEvent]
cmp dword [esi + 0x38], 3
jne 0x440afe
push 0xa
call edi
cmp dword [esi + 0x38], 3
je 0x440af4
push dword [esi + 0x10]
call ebx
pop ebx
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 0x10
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [esi + 0x38], 1
je 0x440b62
mov ecx, esi
call fcn.004409e0
mov eax, dword [ebp + 0xc]
mov edi, dword [esi + 4]
mov dword [esi + 0x40], eax
mov eax, dword [ebp + 0x14]
mov dword [esi + 4], eax
lea eax, [ebp - 4]
push eax
push 0
push esi
push 0x440ba0
push 0
push 0
mov dword [esi + 0x3c], 0x438790
mov dword [esi + 0x44], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x440b6c
mov dword [esi + 0x3c], eax
mov dword [esi + 4], edi
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x10
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esi + 0x38], 0
jne 0x440b8a
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
nop
push 0xa
call edi
cmp dword [esi + 0x38], 0
je 0x440b80
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x441b50
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ecx + 8]
test eax, eax
jne 0x441b5e
pop ebp
ret 8
push eax
push dword [ebp + 0xc]
push 1
push dword [ebp + 8]
call fcn.0045ff97
add esp, 0x10
pop ebp
ret 8

Function at 0x441b80
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ecx + 8]
test eax, eax
jne 0x441b8e
pop ebp
ret 8
push eax
push dword [ebp + 0xc]
push 1
push dword [ebp + 8]
call fcn.0045fb13
xor ecx, ecx
add esp, 0x10
cmp eax, dword [ebp + 0xc]
sete cl
mov eax, ecx
pop ebp
ret 8
Function at 0x443960
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x476b70
mov eax, dword fs:[0]
push eax
sub esp, 0x228
mov eax, dword [0x49d00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x22c], eax
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x228], ecx
mov dword [ebp - 0x21c], 0
mov dword [ebp - 0x218], 0
mov dword [ebp - 0x214], 0
mov dword [ebp - 4], 0
lea edx, [ebp - 0x224]
mov edi, dword [eax + 4]
push edx
or edi, 0x2001f
mov dword [ebp - 0x224], 0
push edi
push 0
push ecx
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, eax
test esi, esi
jne 0x443aeb
mov eax, dword [ebp - 0x21c]
xor esi, esi
test eax, eax
je 0x443a15
push eax
call ebx
mov esi, eax
mov dword [ebp - 0x21c], 0
mov eax, dword [ebp - 0x224]
and edi, 0x300
mov dword [ebp - 0x218], 0
mov dword [ebp - 0x21c], eax
mov dword [ebp - 0x218], edi
test esi, esi
jne 0x443aeb
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea ecx, [ebp - 0x234]
push ecx
push esi
push esi
push esi
lea ecx, [ebp - 0x220]
mov dword [ebp - 0x220], 0x100
push ecx
lea ecx, [ebp - 0x210]
push ecx
push esi
push eax
call edi
test eax, eax
jne 0x443ab7
nop
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x21c]
call fcn.00443960
mov esi, eax
test esi, esi
jne 0x443aeb
lea eax, [ebp - 0x234]
mov dword [ebp - 0x220], 0x100
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x210]
push eax
push esi
push dword [ebp - 0x21c]
call edi
test eax, eax
je 0x443a70
mov eax, dword [ebp - 0x21c]
test eax, eax
je 0x443ace
push eax
call ebx
mov dword [ebp - 0x21c], 0
push dword [ebp - 0x228]
mov ecx, dword [ebp - 0x22c]
mov dword [ebp - 0x218], 0
call fcn.00443880
mov esi, eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x21c]
test eax, eax
je 0x443b09
push eax
call ebx
mov dword [ebp - 0x21c], 0
mov eax, esi
mov dword [ebp - 0x218], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00452408
mov esp, ebp
pop ebp
ret 4
Function at 0x444160
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x476cdb
mov eax, dword fs:[0]
push eax
sub esp, 0x42c
mov eax, dword [0x49d00c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x430], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], 0
mov dword [ebp - 0x418], 0
mov byte [ebp - 4], 1
push 0x60
push 0
push edi
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
call ebx
mov esi, eax
mov dword [ebp - 0x424], esi
test esi, esi
jne 0x44420c
push 2
push eax
push edi
call ebx
mov esi, eax
mov dword [ebp - 0x424], eax
test esi, esi
jne 0x44420c
call fcn.00443600
mov edi, eax
jmp 0x444341
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x44422f
call fcn.00443600
jmp 0x444334
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [ebp - 0x420], ebx
test ebx, ebx
jne 0x44424d
call fcn.00443600
jmp 0x444334
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov dword [ebp - 0x41c], edi
lea eax, [edi + 1]
cmp eax, edi
jae 0x44426e
mov edi, 0x8007000e
jmp 0x444336
mov byte [ebp - 4], 2
mov ecx, 2
mul ecx
mov dword [ebp - 0x438], eax
mov dword [ebp - 0x434], edx
test edx, edx
ja 0x444385
jb 0x444298
cmp eax, 0xffffffff
ja 0x444385
cmp eax, 0x400
jbe 0x4442b4
push eax
lea ecx, [ebp - 0x418]
call fcn.00446810
mov dword [ebp - 4], 1
jmp 0x4442e8
lea eax, [ebp - 0x414]
mov dword [ebp - 0x418], eax
mov dword [ebp - 4], 1
jmp 0x4442e8
mov eax, dword [ebp - 0x418]
test eax, eax
jne 0x4442f9
mov edi, 0x8007000e
jmp 0x444336
push edi
push eax
push edi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
jne 0x444314
call fcn.00443600
jmp 0x444334
xor edx, edx
mov eax, dword [ebp - 0x418]
mov word [eax + ecx*2], dx
push dword [ebp + 0x14]
push dword [ebp - 0x418]
lea ecx, [ebp - 0x42c]
call fcn.00444f90
mov edi, eax
test esi, esi
je 0x444341
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov byte [ebp - 4], 0
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x44435e
lea ecx, [ebp - 0x418]
call fcn.00446800
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00452408
mov esp, ebp
pop ebp
ret 0x10
push 0x80070216
call fcn.0041b960
int3
Function at 0x447c10
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, ecx
push edi
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea edi, [eax + 1]
test edi, edi
js 0x447c8d
mov esi, dword [ebp + 8]
mov ecx, 1
mov edx, dword [esi]
mov eax, dword [edx - 8]
sub ecx, dword [edx - 4]
sub eax, edi
or ecx, eax
jge 0x447c47
push edi
mov ecx, esi
call fcn.0041b620
mov edx, dword [esi]
push edi
push edx
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov edi, eax
mov ecx, edi
cmp edi, 0xffffffff
jne 0x447c6e
mov ecx, dword [esi]
test ecx, ecx
je 0x447c72
push dword [ecx - 8]
push ecx
call fcn.0045739a
add esp, 8
mov ecx, eax
test ecx, ecx
js 0x447c8d
mov eax, dword [esi]
cmp ecx, dword [eax - 8]
jg 0x447c8d
mov dword [eax - 0xc], ecx
xor edx, edx
mov eax, dword [esi]
mov word [eax + ecx*2], dx
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 4
push 0x80070057
call fcn.0041b960
int3

Function at 0x4489c0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x477499
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x49d00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
lea eax, [ecx + 8]
mov dword [ecx + 4], 0
mov dword [ebp - 0x14], eax
mov dword [eax + 0xc], 0
mov dword [ebp - 4], 1
mov dword [ecx + 0x18], 0
mov dword [ecx + 0x1c], 0
mov dword [ebp - 4], 2
mov eax, dword [sym.imp.USER32.dll_DefWindowProcW]
mov dword [ecx + 0x20], eax
mov dword [ebp - 4], 4
mov dword [ecx], vtable.CVWnd_Container.0
mov dword [ecx + 0x24], 0
mov dword [ecx + 0x28], 0xffffffff
mov dword [ecx + 0x2c], vtable.CVolWindowProcFilters.0
mov dword [ecx + 0x30], 0
mov byte [ebp - 4], 5
mov dword [ecx + 0x48], 0
mov byte [ebp - 4], 6
mov dword [ecx + 0x38], 0xff000000
mov dword [ecx + 0x3c], 0
mov dword [ecx + 0x40], 1
mov dword [ecx + 0x4c], 0
mov dword [ecx + 0x44], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret