joyce8/EMBER2024-capa huggingface dataset:
Function at 0x435630
Capabilities:
Read file on windows
Read pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
nop
mov ebx, 1
jmp 0x435870
mov dword [ebp - 4], 0
mov eax, dword [0x46ae80]
cmp eax, 0x200
jge 0x4356e4
mov dword [ebp - 0xc], 0
mov dword [ebp - 0xc], 0
jmp 0x4356ab
push 0
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
push dword [ebp + 8]
call sub.KERNEL32.DLL_PeekNamedPipe
mov ebx, eax
test ebx, ebx
je 0x43568c
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x4356ab
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x10]
call sub.KERNEL32.DLL_GetExitCodeProcess
mov eax, dword [ebp - 8]
cmp eax, 0x103
je 0x4356a4
jmp 0x4356b2
push 0xa
call sub.KERNEL32.DLL_Sleep
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x43566b
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x4356e4
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [0x46ae80]
neg eax
add eax, 0x200
push eax
mov eax, dword [0x46ae80]
lea ecx, [0x492d80]
add eax, ecx
push eax
push dword [ebp + 8]
call sub.KERNEL32.DLL_ReadFile
mov ebx, eax
mov eax, dword [ebp - 4]
add dword [0x46ae80], eax
mov eax, dword [0x46ae80]
mov byte [eax + 0x492d80], 0
jmp 0x4357b3
inc esi
mov eax, esi
mov al, byte [eax]
mov byte [ebp - 0xd], al
mov eax, dword [0x492c74]
mov dword [ebp - 0xc], eax
mov eax, dword [0x492c70]
mov dword [ebp - 8], eax
mov byte [esi], 0
lea eax, [0x492d80]
push eax
call fcn.0043546f
pop ecx
mov eax, dword [ebp - 8]
cmp eax, dword [0x492c70]
je 0x435743
push 0xff
push dword [ebp + 0xc]
call fcn.0042a2da
add esp, 8
jmp 0x43575e
mov eax, dword [ebp - 0xc]
cmp eax, dword [0x492c74]
je 0x43575e
push 0xff0000
push dword [ebp + 0xc]
call fcn.0042a2da
add esp, 8
lea eax, [0x492d80]
push eax
push dword [ebp + 0xc]
call fcn.0042a328
add esp, 8
mov al, byte [ebp - 0xd]
mov byte [esi], al
mov eax, esi
lea ecx, [0x492d80]
sub eax, ecx
neg eax
add eax, 0x200
push eax
push esi
lea eax, [0x492d80]
push eax
call fcn.0045e150
add esp, 0xc
mov eax, esi
lea ecx, [0x492d80]
sub eax, ecx
sub dword [0x46ae80], eax
mov eax, dword [0x46ae80]
mov byte [eax + 0x492d80], 0
push 0xa
lea eax, [0x492d80]
push eax
call fcn.0045f327
add esp, 8
mov esi, eax
test eax, eax
jne 0x4356fe
mov eax, dword [0x46ae80]
cmp eax, 0x200
je 0x4357eb
test ebx, ebx
jne 0x435863
mov eax, dword [0x46ae80]
test eax, eax
je 0x435863
mov eax, dword [0x492c74]
mov dword [ebp - 8], eax
mov edi, dword [0x492c70]
mov eax, dword [0x46ae80]
mov byte [eax + 0x492d80], 0
lea eax, [0x492d80]
push eax
call fcn.0043546f
pop ecx
cmp edi, dword [0x492c70]
je 0x43582c
push 0xff
push dword [ebp + 0xc]
call fcn.0042a2da
add esp, 8
jmp 0x435847
mov eax, dword [ebp - 8]
cmp eax, dword [0x492c74]
je 0x435847
push 0xff0000
push dword [ebp + 0xc]
call fcn.0042a2da
add esp, 8
lea eax, [0x492d80]
push eax
push dword [ebp + 0xc]
call fcn.0042a328
add esp, 8
mov dword [0x46ae80], 0
mov eax, dword [ebp - 4]
test eax, eax
je 0x43586e
test ebx, ebx
jne 0x435870
jmp 0x435875
jmp 0x435644
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x436aa7
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
nop
lea eax, [ebp - 4]
push eax
push 0
push dword [ebp + 8]
push 0x436989
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
push eax
call sub.KERNEL32.DLL_CloseHandle
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x436f48
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
mov esi, 0x46aee8
nop
push dword [0x478664]
call sub.USER32.DLL_GetDC
mov dword [ebp - 4], eax
mov ebx, 0
jmp 0x436f90
lea eax, [ebx*4]
push dword [eax + 0x46aed0]
push dword [0x478670]
call sub.USER32.DLL_LoadBitmapA
lea ecx, [ebx*4]
mov dword [ecx + ebp - 0x1c], eax
inc ebx
cmp ebx, 6
jl 0x436f6c
mov ebx, 0
jmp 0x43706a
call sub.KERNEL32.DLL_GetVersion
mov edi, eax
mov eax, edi
movzx eax, al
cmp eax, 6
jb 0x437004
push 0xc0c0c0
push 0x10
push 0x10
push 0
mov eax, ebx
shl eax, 4
lea eax, [eax + esi]
mov eax, dword [eax + 8]
shl eax, 4
push eax
mov eax, ebx
shl eax, 4
lea eax, [eax + esi]
mov eax, dword [eax + 4]
lea eax, [eax*4]
push dword [eax + ebp - 0x1c]
push dword [0x478664]
call fcn.0041ecef
add esp, 0x18
push eax
call fcn.0041eb51
add esp, 8
mov ecx, ebx
shl ecx, 4
lea ecx, [ecx + esi]
mov dword [ecx + 0xc], eax
jmp 0x437069
push 0x10
push 0x10
push 0
mov eax, ebx
shl eax, 4
lea eax, [eax + esi]
mov eax, dword [eax + 8]
shl eax, 4
push eax
mov eax, ebx
shl eax, 4
lea eax, [eax + esi]
mov eax, dword [eax + 4]
lea eax, [eax*4]
push dword [eax + ebp - 0x1c]
push dword [0x478664]
call fcn.0041ecef
add esp, 0x18
mov ecx, ebx
shl ecx, 4
lea ecx, [ecx + esi]
mov dword [ecx + 0xc], eax
push 4
call fcn.0041e7cf
pop ecx
push eax
push 0xc0c0c0
mov eax, ebx
shl eax, 4
lea eax, [eax + esi]
push dword [eax + 0xc]
call fcn.0041e7fd
add esp, 0xc
inc ebx
cmp ebx, 0x38
jl 0x436f9f
mov ebx, 0
jmp 0x43708b
lea eax, [ebx*4]
push dword [eax + ebp - 0x1c]
call sub.GDI32.DLL_DeleteObject
inc ebx
cmp ebx, 6
jl 0x43707a
push dword [ebp - 4]
push dword [0x478664]
call sub.USER32.DLL_ReleaseDC
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x43a7a7
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov edi, 0x47825c
nop
push edi
push str._s_appdata
lea eax, [ebp - 0x104]
push eax
call fcn.0045eeda
add esp, 0xc
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.DLL_FindFirstFileA
mov esi, eax
cmp esi, 0xffffffff
je 0x43a802
push edi
push str._s_appdata_
push ebx
call fcn.0045eeda
add esp, 0xc
push esi
call sub.KERNEL32.DLL_FindClose
jmp 0x43a862
push ebx
push 0
push 0
push 0x1a
push 0
call sub.shell32.DLL_SHGetFolderPathA
test eax, eax
jne 0x43a84a
push ebx
call fcn.0046038e
pop ecx
dec eax
movsx eax, byte [eax + ebx]
cmp eax, 0x5c
je 0x43a833
push 0x473e09
push ebx
call fcn.0045f2e4
add esp, 8
push str.CC386_
push ebx
call fcn.0045f2e4
add esp, 8
push ebx
call fcn.00464e2c
pop ecx
jmp 0x43a862
push edi
push ebx
call fcn.0045f361
add esp, 8
push 0x473e09
push ebx
call fcn.0045f2e4
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43a869
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, 0x494480
nop
mov al, byte [ebx]
test al, al
jne 0x43a890
push ebx
call fcn.0043a7a7
pop ecx
push str.ccide.ini
push ebx
call fcn.0045f2e4
add esp, 8
push ebx
push pe_nt_image_headers32
lea eax, [0x494584]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push str.Defaults
call sub.KERNEL32.DLL_GetPrivateProfileStringA
lea eax, [0x494584]
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x43b004
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, 0x4949f8
mov esi, dword [ebp + 8]
nop
mov edi, 1
push 0x104
push 0x494afc
push 0x65
push esi
call sub.USER32.DLL_GetDlgItem
push eax
call sub.USER32.DLL_GetWindowTextA
push 0x104
push ebx
push 0x66
push esi
call sub.USER32.DLL_GetDlgItem
push eax
call sub.USER32.DLL_GetWindowTextA
push 0
push 0
push 0x1042
push 0x64
push esi
call sub.USER32.DLL_GetDlgItem
push eax
call sub.USER32.DLL_SendMessageA
mov dword [0x4949f4], eax
movsx eax, byte [0x494afc]
test eax, eax
je 0x43b072
movsx eax, byte [ebx]
test eax, eax
jne 0x43b08d
push str.Please_specify_a_new_project_name
push 0
push str.Add_New_Project
call fcn.00401735
add esp, 0xc
mov edi, 0
jmp 0x43b105
push ebx
call fcn.0046038e
pop ecx
dec eax
movsx eax, byte [eax + ebx]
cmp eax, 0x5c
je 0x43b0ac
push 0x474212
push ebx
call fcn.0045f2e4
add esp, 8
push 0x494afc
push ebx
call fcn.0045f2e4
add esp, 8
mov eax, dword [0x4949f4]
cmp eax, 0
je 0x43b0d5
cmp eax, 1
je 0x43b0d5
cmp eax, 2
je 0x43b0e5
cmp eax, 3
je 0x43b0f5
jmp 0x43b0d5
push str..exe
push ebx
call fcn.0045f2e4
add esp, 8
jmp 0x43b105
push str..dll
push ebx
call fcn.0045f2e4
add esp, 8
jmp 0x43b105
push str..lib
push ebx
call fcn.0045f2e4
add esp, 8
jmp 0x43b105
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x43c022
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
mov edi, 0x494d14
lea ebx, [ebp - 0x20]
nop
push dword [0x4949e8]
call fcn.0043ad7b
pop ecx
mov esi, eax
test esi, esi
je 0x43c125
mov eax, dword [esi + 0x18]
cmp eax, 1
je 0x43c066
mov eax, dword [esi + 0x18]
cmp eax, 2
je 0x43c066
mov eax, dword [esi + 0x18]
cmp eax, 3
jne 0x43c125
mov dword [0x494d18], esi
mov eax, dword [esi + 0x438]
mov dword [ebx], eax
push ebx
push 1
push 0x1104
push dword [0x4949c8]
call sub.USER32.DLL_SendMessageA
mov eax, dword [esi + 0x438]
lea ecx, [ebp - 0x10]
mov dword [ecx], eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x1104
push dword [0x4949c8]
call sub.USER32.DLL_SendMessageA
push 0
push 0xfffffffffffffffa
push dword [0x4948a0]
call sub.USER32.DLL_GetParent
push eax
call sub.USER32.DLL_GetWindowLongA
push eax
push 0x1c1
push dword [0x4948a0]
mov eax, dword [ebx + 0xc]
sub eax, dword [ebx + 4]
push eax
mov eax, dword [ebp - 8]
sub eax, dword [ebx]
push eax
push dword [ebx + 4]
push dword [ebx]
push 0x40800080
mov eax, esi
add eax, 0x1c
push eax
push dword [0x46d2f0]
push 0
call sub.USER32.DLL_CreateWindowExA
mov dword [edi], eax
push 0xffffffffffffffff
push 0
push 0xb1
push dword [edi]
call sub.USER32.DLL_SendMessageA
push 0
push 0x40
push 0xc5
push dword [edi]
call sub.USER32.DLL_SendMessageA
push 5
push dword [edi]
call sub.USER32.DLL_ShowWindow
push dword [edi]
call sub.USER32.DLL_SetFocus
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43ceaf
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x13e4
call fcn.004605f4
push ebx
push esi
push edi
nop
push dword [ebp + 8]
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x43ced1
mov eax, str.proj
jmp 0x43ced6
mov eax, 0x474014
push eax
push 0x47825c
push str.__s_binupgradedb.exe___s___s_
lea eax, [ebp - 0x1388]
push eax
call fcn.0045eeda
add esp, 0x14
push 0x44
push 0
lea eax, [ebp - 0x13e0]
push eax
call fcn.0045e1bd
add esp, 0xc
push 0x10
push 0
lea eax, [ebp - 0x139c]
push eax
call fcn.0045e1bd
add esp, 0xc
mov dword [ebp - 0x13e0], 0x44
lea eax, [ebp - 0x139c]
push eax
lea eax, [ebp - 0x13e0]
push eax
push 0x47825c
push 0
push 0
push 1
push 0
push 0
lea eax, [ebp - 0x1388]
push eax
push 0
call sub.KERNEL32.DLL_CreateProcessA
mov ebx, eax
test ebx, ebx
jne 0x43cf58
mov eax, 0
jmp 0x43cf86
push dword [ebp - 0x139c]
call fcn.0041cc08
pop ecx
lea eax, [ebp - 0x138c]
push eax
push dword [ebp - 0x139c]
call sub.KERNEL32.DLL_GetExitCodeProcess
mov eax, dword [ebp - 0x138c]
test eax, eax
sete cl
movzx ecx, cl
mov eax, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43ef64
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44c
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
nop
mov eax, dword [esi + 0x1c]
test eax, eax
je case.default.0x43ef94
mov eax, dword [esi + 0x14]
sub eax, 0x66
jl case.default.0x43ef94
cmp eax, 9
jge case.default.0x43ef94
jmp dword [eax*4 + 0x43ef9b]
lea eax, [ebp - 0x404]
push eax
push 0x400
push 0xd
push dword [esi + 0x1c]
call sub.USER32.DLL_SendMessageA
mov byte [eax + ebp - 0x404], 0
mov eax, dword [esi + 0x40]
mov dword [ebp - 4], eax
jmp 0x43f036
lea eax, [ebp - 0x404]
push eax
mov eax, dword [ebp - 4]
push dword [eax + 4]
call fcn.0045f343
add esp, 8
test eax, eax
jne 0x43f02e
mov eax, dword [ebp - 4]
push dword [eax + 8]
call fcn.0045f379
pop ecx
mov dword [ebp - 0x408], eax
mov eax, dword [ebp - 0x408]
test eax, eax
je 0x43f02c
push dword [esi + 0x38]
call fcn.0045d549
pop ecx
mov eax, dword [ebp - 0x408]
mov dword [esi + 0x38], eax
jmp 0x43f03d
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
test eax, eax
jne 0x43efe5
jmp case.default.0x43ef94
push 0
push 0
push 0xe
push dword [esi + 0x1c]
call sub.USER32.DLL_SendMessageA
mov ebx, eax
mov eax, ebx
inc eax
push eax
call fcn.0045dfee
pop ecx
mov dword [ebp - 0x408], eax
mov eax, dword [ebp - 0x408]
test eax, eax
je 0x43f09c
push dword [ebp - 0x408]
mov eax, ebx
inc eax
push eax
push 0xd
push dword [esi + 0x1c]
call sub.USER32.DLL_SendMessageA
mov eax, dword [ebp - 0x408]
mov byte [ebx + eax], 0
push dword [esi + 0x38]
call fcn.0045d549
pop ecx
mov eax, dword [ebp - 0x408]
mov dword [esi + 0x38], eax
jmp case.default.0x43ef94
push 0
push 0
push 0x31
push dword [esi + 0x1c]
call sub.USER32.DLL_SendMessageA
mov dword [ebp - 0x44c], eax
lea eax, [ebp - 0x448]
push eax
push 0x3c
push dword [ebp - 0x44c]
call sub.GDI32.DLL_GetObjectA
lea eax, [ebp - 0x448]
mov dword [ebp - 0x40c], eax
mov byte [ebp - 0x404], 0
mov ebx, 0
jmp 0x43f112
mov eax, dword [ebp - 0x40c]
movzx eax, byte [ebx + eax]
push eax
push 0x4743bd
lea eax, [ebp - 0x404]
push eax
call fcn.0046038e
pop ecx
lea ecx, [ebp - 0x404]
add eax, ecx
push eax
call fcn.0045eeda
add esp, 0xc
inc ebx
cmp ebx, 0x3c
jl 0x43f0e3
push dword [esi + 0x38]
call fcn.0045d549
pop ecx
lea eax, [ebp - 0x404]
push eax
call fcn.0045f379
pop ecx
mov dword [esi + 0x38], eax
jmp case.default.0x43ef94
push 0
push 0
push 0x2778
push dword [esi + 0x1c]
call sub.USER32.DLL_SendMessageA
mov edi, eax
push edi
push 0x4743ba
lea eax, [ebp - 0x404]
push eax
call fcn.0045eeda
add esp, 0xc
push dword [esi + 0x38]
call fcn.0045d549
pop ecx
lea eax, [ebp - 0x404]
push eax
call fcn.0045f379
pop ecx
mov dword [esi + 0x38], eax
jmp case.default.0x43ef94
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43efbf
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44c
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
nop
mov eax, dword [esi + 0x1c]
test eax, eax
je case.default.0x43ef94
mov eax, dword [esi + 0x14]
sub eax, 0x66
jl case.default.0x43ef94
cmp eax, 9
jge case.default.0x43ef94
jmp dword [eax*4 + 0x43ef9b]
lea eax, [ebp - 0x404]
push eax
push 0x400
push 0xd
push dword [esi + 0x1c]
call sub.USER32.DLL_SendMessageA
mov byte [eax + ebp - 0x404], 0
mov eax, dword [esi + 0x40]
mov dword [ebp - 4], eax
jmp 0x43f036
lea eax, [ebp - 0x404]
push eax
mov eax, dword [ebp - 4]
push dword [eax + 4]
call fcn.0045f343
add esp, 8
test eax, eax
jne 0x43f02e
mov eax, dword [ebp - 4]
push dword [eax + 8]
call fcn.0045f379
pop ecx
mov dword [ebp - 0x408], eax
mov eax, dword [ebp - 0x408]
test eax, eax
je 0x43f02c
push dword [esi + 0x38]
call fcn.0045d549
pop ecx
mov eax, dword [ebp - 0x408]
mov dword [esi + 0x38], eax
jmp 0x43f03d
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
test eax, eax
jne 0x43efe5
jmp case.default.0x43ef94
push 0
push 0
push 0xe
push dword [esi + 0x1c]
call sub.USER32.DLL_SendMessageA
mov ebx, eax
mov eax, ebx
inc eax
push eax
call fcn.0045dfee
pop ecx
mov dword [ebp - 0x408], eax
mov eax, dword [ebp - 0x408]
test eax, eax
je 0x43f09c
push dword [ebp - 0x408]
mov eax, ebx
inc eax
push eax
push 0xd
push dword [esi + 0x1c]
call sub.USER32.DLL_SendMessageA
mov eax, dword [ebp - 0x408]
mov byte [ebx + eax], 0
push dword [esi + 0x38]
call fcn.0045d549
pop ecx
mov eax, dword [ebp - 0x408]
mov dword [esi + 0x38], eax
jmp case.default.0x43ef94
push 0
push 0
push 0x31
push dword [esi + 0x1c]
call sub.USER32.DLL_SendMessageA
mov dword [ebp - 0x44c], eax
lea eax, [ebp - 0x448]
push eax
push 0x3c
push dword [ebp - 0x44c]
call sub.GDI32.DLL_GetObjectA
lea eax, [ebp - 0x448]
mov dword [ebp - 0x40c], eax
mov byte [ebp - 0x404], 0
mov ebx, 0
jmp 0x43f112
mov eax, dword [ebp - 0x40c]
movzx eax, byte [ebx + eax]
push eax
push 0x4743bd
lea eax, [ebp - 0x404]
push eax
call fcn.0046038e
pop ecx
lea ecx, [ebp - 0x404]
add eax, ecx
push eax
call fcn.0045eeda
add esp, 0xc
inc ebx
cmp ebx, 0x3c
jl 0x43f0e3
push dword [esi + 0x38]
call fcn.0045d549
pop ecx
lea eax, [ebp - 0x404]
push eax
call fcn.0045f379
pop ecx
mov dword [esi + 0x38], eax
jmp case.default.0x43ef94
push 0
push 0
push 0x2778
push dword [esi + 0x1c]
call sub.USER32.DLL_SendMessageA
mov edi, eax
push edi
push 0x4743ba
lea eax, [ebp - 0x404]
push eax
call fcn.0045eeda
add esp, 0xc
push dword [esi + 0x38]
call fcn.0045d549
pop ecx
lea eax, [ebp - 0x404]
push eax
call fcn.0045f379
pop ecx
mov dword [esi + 0x38], eax
jmp case.default.0x43ef94
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43f042
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44c
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
nop
mov eax, dword [esi + 0x1c]
test eax, eax
je case.default.0x43ef94
mov eax, dword [esi + 0x14]
sub eax, 0x66
jl case.default.0x43ef94
cmp eax, 9
jge case.default.0x43ef94
jmp dword [eax*4 + 0x43ef9b]
lea eax, [ebp - 0x404]
push eax
push 0x400
push 0xd
push dword [esi + 0x1c]
call sub.USER32.DLL_SendMessageA
mov byte [eax + ebp - 0x404], 0
mov eax, dword [esi + 0x40]
mov dword [ebp - 4], eax
jmp 0x43f036
lea eax, [ebp - 0x404]
push eax
mov eax, dword [ebp - 4]
push dword [eax + 4]
call fcn.0045f343
add esp, 8
test eax, eax
jne 0x43f02e
mov eax, dword [ebp - 4]
push dword [eax + 8]
call fcn.0045f379
pop ecx
mov dword [ebp - 0x408], eax
mov eax, dword [ebp - 0x408]
test eax, eax
je 0x43f02c
push dword [esi + 0x38]
call fcn.0045d549
pop ecx
mov eax, dword [ebp - 0x408]
mov dword [esi + 0x38], eax
jmp 0x43f03d
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
test eax, eax
jne 0x43efe5
jmp case.default.0x43ef94
push 0
push 0
push 0xe
push dword [esi + 0x1c]
call sub.USER32.DLL_SendMessageA
mov ebx, eax
mov eax, ebx
inc eax
push eax
call fcn.0045dfee
pop ecx
mov dword [ebp - 0x408], eax
mov eax, dword [ebp - 0x408]
test eax, eax
je 0x43f09c
push dword [ebp - 0x408]
mov eax, ebx
inc eax
push eax
push 0xd
push dword [esi + 0x1c]
call sub.USER32.DLL_SendMessageA
mov eax, dword [ebp - 0x408]
mov byte [ebx + eax], 0
push dword [esi + 0x38]
call fcn.0045d549
pop ecx
mov eax, dword [ebp - 0x408]
mov dword [esi + 0x38], eax
jmp case.default.0x43ef94
push 0
push 0
push 0x31
push dword [esi + 0x1c]
call sub.USER32.DLL_SendMessageA
mov dword [ebp - 0x44c], eax
lea eax, [ebp - 0x448]
push eax
push 0x3c
push dword [ebp - 0x44c]
call sub.GDI32.DLL_GetObjectA
lea eax, [ebp - 0x448]
mov dword [ebp - 0x40c], eax
mov byte [ebp - 0x404], 0
mov ebx, 0
jmp 0x43f112
mov eax, dword [ebp - 0x40c]
movzx eax, byte [ebx + eax]
push eax
push 0x4743bd
lea eax, [ebp - 0x404]
push eax
call fcn.0046038e
pop ecx
lea ecx, [ebp - 0x404]
add eax, ecx
push eax
call fcn.0045eeda
add esp, 0xc
inc ebx
cmp ebx, 0x3c
jl 0x43f0e3
push dword [esi + 0x38]
call fcn.0045d549
pop ecx
lea eax, [ebp - 0x404]
push eax
call fcn.0045f379
pop ecx
mov dword [esi + 0x38], eax
jmp case.default.0x43ef94
push 0
push 0
push 0x2778
push dword [esi + 0x1c]
call sub.USER32.DLL_SendMessageA
mov edi, eax
push edi
push 0x4743ba
lea eax, [ebp - 0x404]
push eax
call fcn.0045eeda
add esp, 0xc
push dword [esi + 0x38]
call fcn.0045d549
pop ecx
lea eax, [ebp - 0x404]
push eax
call fcn.0045f379
pop ecx
mov dword [esi + 0x38], eax
jmp case.default.0x43ef94
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4438d1
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
lea edi, [ebp - 0x104]
nop
mov dword [ebp - 4], esi
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x44390d
mov dword [ebp + 0xc], edi
push edi
push pe_nt_image_headers32
call sub.KERNEL32.DLL_GetCurrentDirectoryA
push 0x474d8d
push edi
call fcn.0045f2e4
add esp, 8
mov eax, dword [ebp + 0xc]
mov al, byte [eax]
test al, al
je 0x4439d0
movsx eax, byte [esi]
test eax, eax
je 0x4439d0
movsx eax, byte [esi + 1]
cmp eax, 0x3a
je 0x4439d0
push dword [ebp + 0xc]
push edi
call fcn.0045f361
add esp, 8
push 0x5c
push edi
call fcn.00460545
add esp, 8
mov ebx, eax
test ebx, ebx
je 0x4439d0
dec ebx
push 0x474d89
push esi
call fcn.00460586
add esp, 8
test eax, eax
jne 0x44398b
movsx eax, byte [esi]
cmp eax, 0x5c
je 0x443989
push esi
mov eax, ebx
add eax, 2
push eax
call fcn.0045f361
add esp, 8
push edi
push dword [ebp - 4]
call fcn.0045f361
add esp, 8
jmp 0x4439d0
jmp 0x44399f
cmp ebx, edi
jbe 0x44399c
mov eax, ebx
dec ebx
movsx eax, byte [eax]
cmp eax, 0x5c
jne 0x44398d
add esi, 3
push 3
push 0x474d89
push esi
call fcn.004603f1
add esp, 0xc
test eax, eax
je 0x44398d
inc ebx
mov eax, ebx
mov byte [eax], 0x5c
inc ebx
push esi
push ebx
call fcn.0045f361
add esp, 8
push edi
push dword [ebp - 4]
call fcn.0045f361
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4472b6
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
nop
mov dword [ebp - 0xc], 0
mov ebx, 0
push str.SPLASH
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.KERNEL32.DLL_FindResourceA
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x44736b
push dword [ebp - 0x10]
push dword [ebp + 8]
call sub.KERNEL32.DLL_SizeofResource
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x44736b
push dword [ebp - 0x10]
push dword [ebp + 8]
call sub.KERNEL32.DLL_LoadResource
mov edi, eax
test edi, edi
je 0x44736b
push edi
call sub.KERNEL32.DLL_LockResource
mov ebx, eax
push ebx
call fcn.0044e3cb
pop ecx
mov ebx, eax
test ebx, ebx
je 0x44736b
mov dword [ebp - 4], ebx
mov eax, ebx
add eax, 0xe
mov esi, eax
mov eax, dword [ebp - 4]
movzx eax, word [eax]
cmp eax, 0x4d42
jne 0x44736b
mov dword [ebp - 0xc], edi
mov eax, dword [esi + 4]
test eax, eax
js 0x44734b
mov eax, dword [esi + 4]
jmp 0x447350
mov eax, dword [esi + 4]
neg eax
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov eax, dword [esi + 8]
test eax, eax
js 0x447361
mov eax, dword [esi + 8]
jmp 0x447366
mov eax, dword [esi + 8]
neg eax
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x447976
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
nop
push 0x44
push 0x40
call sub.KERNEL32.DLL_GlobalAlloc
mov esi, eax
test esi, esi
je 0x4479ce
push 0x44
push edi
push esi
call fcn.0045e150
add esp, 0xc
lea eax, [ebp - 4]
push eax
push 0
push esi
push 0x44772b
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
mov ebx, eax
mov eax, dword [edi + 0x1c]
test eax, eax
je 0x4479c8
test ebx, ebx
je 0x4479c8
push 0xffffffffffffffff
push ebx
call sub.KERNEL32.DLL_WaitForSingleObject
push ebx
call sub.KERNEL32.DLL_CloseHandle
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4