joyce8/EMBER2024-capa huggingface dataset:
Function at 0x418cd0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x49fc07
mov eax, dword fs:[0]
push eax
sub esp, 0x268
mov eax, dword [0x4eed38]
xor eax, esp
mov dword [esp + 0x264], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4eed38]
xor eax, esp
push eax
lea eax, [esp + 0x27c]
mov dword fs:[0], eax
call fcn.0045b40e
mov ecx, dword [eax + 4]
call fcn.00458dad
xor ebx, ebx
push 0x206
lea ecx, [esp + 0x76]
xor eax, eax
push ebx
push ecx
mov dword [esp + 0x290], ebx
mov word [esp + 0x7c], ax
call fcn.00482280
add esp, 0xc
lea edx, [esp + 0x70]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x418ed7
call fcn.00459da6
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x418d6d
push 0x80004005
call fcn.00401150
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x18], eax
lea ecx, [esp + 0x70]
push ecx
lea edx, [esp + 0x1c]
push 0x4ae0e8
push edx
mov byte [esp + 0x290], 1
call fcn.00401ce0
push ebx
call fcn.00481ca3
add esp, 0x10
push ebx
lea ecx, [esp + 0x48]
mov esi, eax
mov edi, edx
call fcn.004036f0
lea ecx, [esp + 0x2c]
mov byte [esp + 0x284], 2
call fcn.0045bc62
mov ebp, dword [esp + 0x18]
push ebx
push ebp
lea ecx, [esp + 0x34]
mov byte [esp + 0x28c], 3
call fcn.0045bcfa
cmp eax, ebx
je 0x418e92
lea ecx, [esp + 0x2c]
call fcn.0045b92d
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x2c]
mov edx, dword [eax + 0x38]
push 0x10
lea ecx, [esp + 0x30]
call edx
test eax, eax
je 0x418e88
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x30]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
call fcn.0045bbcf
mov eax, esi
sub eax, dword [esp + 0x1c]
push ebx
mov ecx, edi
sbb ecx, dword [esp + 0x24]
push 0x15180
push ecx
push eax
call fcn.00484420
cmp edx, ebx
jl 0x418e88
jg 0x418e3e
cmp eax, 1
jb 0x418e88
lea ecx, [esp + 0x28]
push ecx
lea ecx, [esp + 0x30]
call fcn.0045bef9
mov eax, dword [eax]
push eax
lea ecx, [esp + 0x48]
mov byte [esp + 0x288], 4
call fcn.00403390
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
mov byte [esp + 0x284], 3
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x418e88
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp dword [esp + 0x24], ebx
jne 0x418de0
lea ecx, [esp + 0x2c]
mov byte [esp + 0x284], 2
call fcn.0045bc8b
lea ecx, [esp + 0x44]
mov byte [esp + 0x284], 1
call fcn.00402fe0
lea eax, [ebp - 0x10]
mov byte [esp + 0x284], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x418ed7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x17]
mov dword [esp + 0x284], 0xffffffff
call fcn.00403520
mov ecx, dword [esp + 0x27c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x264]
xor ecx, esp
call fcn.004820da
add esp, 0x274
ret
Function at 0x42c420
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x4a1418
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4eed38]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov dword [esp + 0x24], ecx
mov edi, dword [esp + 0x50]
xor esi, esi
cmp edi, esi
je 0x42c5a9
mov eax, 0xffff
cmp word [ecx + 0x2d8], ax
je 0x42c5a9
lea ecx, [esp + 0x28]
call fcn.0045bc62
push esi
push edi
lea ecx, [esp + 0x30]
mov dword [esp + 0x50], esi
call fcn.0045bcfa
test eax, eax
jne 0x42c494
mov dword [esp + 0x48], 0xffffffff
jmp 0x42c5a0
mov ecx, dword [esp + 0x54]
or ebx, 0xffffffff
push ebx
push esi
call fcn.0046c29e
push esi
push 0x80
push 3
push esi
push 1
push SysReAllocString
push edi
mov dword [esp + 0x34], esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebp, eax
cmp ebp, ebx
je 0x42c59c
mov eax, dword [esp + 0x58]
cmp eax, esi
je 0x42c4d9
push eax
push esi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileTime]
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, esi
je 0x42c59c
cmp edi, ebx
je 0x42c59c
push edi
call fcn.00451e0a
add esp, 4
push esi
lea ecx, [esp + 0x20]
push ecx
push edi
mov ebx, eax
push ebx
push ebp
mov dword [esp + 0x30], esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
lea edx, [esp + 0x24]
push edx
mov edx, dword [esp + 0x2c]
lea eax, [esp + 0x58]
push eax
movzx eax, word [edx + 0x2d8]
lea ecx, [esp + 0x20]
push ecx
push edi
push ebx
push eax
mov dword [esp + 0x30], esi
mov dword [esp + 0x6c], esi
mov dword [esp + 0x3c], 1
call fcn.00405930
add esp, 0x1c
test eax, eax
je 0x42c575
cmp dword [esp + 0x50], 0x70
jne 0x42c575
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x18], 1
lea edi, [ecx + ebx]
movzx edx, byte [esi + edi]
mov ecx, dword [esp + 0x54]
push edx
call fcn.00411f30
inc esi
cmp esi, 0x64
jl 0x42c561
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call fcn.00451dff
add esp, 4
lea ecx, [esp + 0x28]
mov dword [esp + 0x48], 0xffffffff
call fcn.0045bc8b
mov eax, dword [esp + 0x18]
jmp 0x42c5ab
mov dword [esp + 0x48], ebx
lea ecx, [esp + 0x28]
call fcn.0045bc8b
xor eax, eax
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x38
ret 0xc
Function at 0x4380f0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ecx
cmp dword [esp + 8], 0
push edi
mov edi, ecx
je 0x43821f
cmp dword [esp + 0x10], 1
jne 0x43821f
mov eax, dword [esp + 0x14]
test eax, eax
je 0x43821f
push ebx
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x43813f
pop ebx
xor eax, eax
pop edi
pop ecx
ret 0x10
push ebp
push esi
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
mov eax, dword [esp + 0x24]
push eax
lea ecx, [esp + 0x20]
push ecx
push esi
mov ecx, edi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x28], 0
call fcn.00437fa0
mov ebp, eax
test ebp, ebp
je 0x43820e
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x43820e
add esi, 0x1ff
shr esi, 9
shl esi, 9
add esi, eax
push esi
call fcn.00451e0a
mov edi, eax
add esp, 4
test edi, edi
jne 0x4381a0
push ebp
jmp 0x438206
push esi
push 0xff
push edi
call fcn.00482280
mov edx, dword [esp + 0x28]
push edx
push ebp
push edi
call fcn.00483200
push ebp
call fcn.00451dff
mov ecx, dword [esp + 0x38]
mov ebp, dword [esp + 0x2c]
add esp, 0x1c
push 0
lea eax, [esp + 0x24]
push eax
push ebp
lea edx, [edi + ecx]
push edx
push ebx
mov dword [esp + 0x34], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x438205
cmp dword [esp + 0x20], ebp
jne 0x438205
mov eax, dword [esp + 0x18]
push ebx
mov dword [eax], esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ebp
pop ebx
mov eax, edi
pop edi
pop ecx
ret 0x10
push edi
call fcn.00451dff
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ebp
pop ebx
xor eax, eax
pop edi
pop ecx
ret 0x10
xor eax, eax
pop edi
pop ecx
ret 0x10
Function at 0x43def0
Capabilities:
Read .ini file

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
test edi, edi
jne 0x43df13
mov ecx, dword [esp + 0x10]
push 0x19
push str.Configure_file_is_empty__n
call fcn.00401ae0
pop edi
xor eax, eax
pop esi
ret 8
mov eax, edi
push ebx
lea ecx, [esi + 0xc8]
lea ebx, [eax + 2]
nop
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x43df20
sub eax, ebx
sar eax, 1
push eax
push edi
call fcn.00401890
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push edi
push 1
push 0x4b231c
push 0x4ad29c
call ebx
push edi
push 0
push 0x4af240
push 0x4ad29c
mov dword [esi + 0xa4], eax
call ebx
push edi
push 0
push str.PowerOff
push 0x4ad29c
mov dword [esi + 0xa8], eax
call ebx
push edi
push 0
push str.FlashPageType
push 0x4ad29c
mov dword [esi + 0xac], eax
call ebx
push edi
push 0
push str.ReadMCPType
push 0x4ad29c
mov dword [esi + 0xbc], eax
call ebx
push edi
push 0
push str.KeepCharge
push 0x4ad29c
mov dword [esi + 0xc0], eax
call ebx
push edi
push 0
push str.SharkNandOption
push 0x4ad29c
mov dword [esi + 0xb0], eax
call ebx
push edi
push 0
push str.ReadChipUID
push 0x4ad29c
mov dword [esi + 0xc4], eax
call ebx
push edi
push 0
push 0x4b2304
push 0x4ad29c
mov dword [esi + 0xb4], eax
call ebx
mov ecx, dword [esi + 0xa4]
mov edx, dword [esi + 0xa8]
mov dword [esi + 0x88], ecx
mov ecx, dword [esi + 0xac]
mov dword [esi + 0x8c], edx
mov edx, dword [esi + 0xc0]
mov dword [esi + 0x98], ecx
mov ecx, dword [esi + 0xb0]
mov dword [esi + 0x90], edx
mov edx, dword [esi + 0xb4]
pop ebx
mov dword [esi + 0xb8], eax
mov dword [esi + 0xa0], eax
pop edi
mov dword [esi + 0x94], ecx
mov dword [esi + 0x9c], edx
mov eax, 1
pop esi
ret 8
Function at 0x4437c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x4eed38]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [eax - 0xc]
mov ebx, ecx
cmp dword [ebx + 4], 0
push edi
mov dword [ebp - 8], esi
je 0x443832
test esi, esi
je 0x443832
push eax
mov dword [ebp - 0xc], 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x443804
xor eax, eax
jmp 0x44381d
lea esi, [eax + eax]
mov eax, esi
call fcn.00482300
mov eax, esp
push 3
push esi
push edi
push eax
call fcn.00401110
mov esi, dword [ebp - 8]
mov edx, dword [ebx + 4]
push 0
lea ecx, [ebp - 0xc]
push ecx
push esi
push eax
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x44384e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea esp, [ebp - 0x18]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004820da
mov esp, ebp
pop ebp
ret 4

Function at 0x443920
Capabilities:
Create pipe

Disassembly:
push 0xffffffffffffffff
push 0x4a2388
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4eed38]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, ecx
xor ebp, ebp
mov ebx, 5
mov dword [esp + 0x18], ebp
call fcn.00459da6
xor ecx, ecx
cmp eax, ebp
setne cl
cmp ecx, ebp
jne 0x44396e
push 0x80004005
call fcn.00401150
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
mov ecx, dword [esi + 0x10]
mov edx, dword [esi + 0xc]
push ecx
push edx
lea eax, [esp + 0x1c]
push str._spipe_s
push eax
mov dword [esp + 0x34], ebp
call fcn.00401ce0
mov eax, dword [esp + 0x3c]
add esp, 0x10
cmp eax, ebp
je 0x4439bf
mov ecx, dword [esi + 0x10]
mov edx, dword [esi + 0xc]
push eax
push ecx
push edx
lea eax, [esp + 0x20]
push str._spipe_s__d
push eax
call fcn.00401ce0
add esp, 0x14
mov edi, dword [esp + 0x14]
mov eax, dword [esi + 4]
cmp eax, ebp
je 0x4439d4
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 4], ebp
push ebp
push ebp
push 0x400
push 0x400
push 1
push ebp
push 0x40000003
push edi
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov dword [esi + 4], eax
cmp eax, 0xffffffff
jne 0x443a1a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push str.Failed_to_CreateNamedPipe___s__ErrorCode0x_x
call fcn.00483fc0
dec ebx
add esp, 0xc
cmp ebx, ebp
mov dword [esi + 4], ebp
jg 0x4439c3
mov esi, dword [esp + 0x18]
jmp 0x443a1f
mov esi, 1
lea eax, [edi - 0x10]
mov dword [esp + 0x24], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x443a43
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 4
Function at 0x443da0
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x4a313c
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x4eed38]
xor eax, esp
mov dword [esp + 0x214], eax
push esi
push edi
mov eax, dword [0x4eed38]
xor eax, esp
push eax
lea eax, [esp + 0x224]
mov dword fs:[0], eax
mov esi, dword [esp + 0x238]
mov edi, dword [esp + 0x234]
push esi
lea ecx, [esp + 0x10]
mov dword [esp + 0x14], 0
call fcn.00402530
mov dword [esp + 0x22c], 0
test esi, esi
je 0x443f53
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x443e11
sub eax, edx
sar eax, 1
cmp eax, 2
jb 0x443f53
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x22]
push ecx
mov word [esp + 0x24], ax
call fcn.00482280
add esp, 0xc
push esi
lea ecx, [esp + 0x14]
call fcn.00402530
push 2
push 0
lea edx, [esp + 0x1c]
push edx
lea ecx, [esp + 0x1c]
mov byte [esp + 0x238], 1
call fcn.00417940
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x230], 2
call fcn.00401c20
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x22c], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x443ea1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, dword [esp + 0x10]
push 0x104
lea ecx, [esp + 0x1c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x443f14
push 2
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x14]
call fcn.00418570
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x230], 3
call fcn.00401c20
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x22c], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x443f04
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x18]
push ecx
push 0
lea ecx, [esp + 0x14]
call fcn.004033b0
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
push eax
call fcn.004015b0
add eax, 0x10
mov dword [edi], eax
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
add esp, 4
mov byte [esp + 0x22c], 0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x443f68
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x443f68
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
push eax
call fcn.004015b0
add esp, 4
add eax, 0x10
mov dword [edi], eax
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
mov dword [esp + 0x22c], edx
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x443f8f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, edi
mov ecx, dword [esp + 0x224]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.004820da
add esp, 0x224
ret 8
Function at 0x443fc0
Capabilities:
Enumerate processes

Disassembly:
push 0xffffffffffffffff
push 0x4a317b
mov eax, dword fs:[0]
push eax
sub esp, 0x238
mov eax, dword [0x4eed38]
xor eax, esp
mov dword [esp + 0x234], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4eed38]
xor eax, esp
push eax
lea eax, [esp + 0x24c]
mov dword fs:[0], eax
mov edx, dword [esp + 0x25c]
xor edi, edi
mov ebp, ecx
cmp edx, edi
je 0x4440e7
mov eax, edx
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x444013
sub eax, esi
sar eax, 1
cmp eax, 2
jb 0x4440e7
push edx
lea eax, [esp + 0x1c]
push eax
mov ecx, ebp
call fcn.00443da0
push edi
push 2
mov dword [esp + 0x25c], edi
mov dword [esp + 0x1c], edi
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
mov dword [esp + 0x1c], 0x22c
cmp edi, 0xffffffff
je 0x4440b6
lea ecx, [esp + 0x1c]
push ecx
push edi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x4440af
mov ebx, dword [sym.imp.KERNEL32.dll_OpenProcess]
nop
mov edx, dword [esp + 0x24]
push edx
push 0
push 0x1fffff
call ebx
mov esi, eax
test esi, esi
je 0x4440a0
mov eax, dword [esp + 0x18]
push eax
push esi
mov ecx, ebp
call fcn.00443cc0
test eax, eax
je 0x444099
inc dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x1c]
push ecx
push edi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x444070
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
mov dword [esp + 0x254], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4440e1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x14]
jmp 0x4440e9
xor eax, eax
mov ecx, dword [esp + 0x24c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x234]
xor ecx, esp
call fcn.004820da
add esp, 0x244
ret 4

Function at 0x444210
Capabilities:
Capture screenshot

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x70], 0
jne 0x444223
mov dword [edi + 0x70], 1
cmp dword [edi + 0x74], 0
jne 0x444230
mov dword [edi + 0x74], 1
mov esi, dword [esp + 0x1c]
mov eax, dword [esi + 8]
sub eax, dword [esi]
mov ecx, dword [edi + 0x70]
cdq
idiv ecx
mov ecx, eax
mov dword [esp + 0x1c], eax
test edx, edx
je 0x44424e
inc ecx
mov dword [esp + 0x1c], ecx
mov eax, dword [esi + 0xc]
sub eax, dword [esi + 4]
mov esi, dword [edi + 0x74]
cdq
idiv esi
mov ebp, eax
test edx, edx
je 0x444261
inc ebp
xor ebx, ebx
test ecx, ecx
jle 0x4442a7
xor esi, esi
test ebp, ebp
jle 0x4442a2
lea ecx, [ecx]
mov edx, dword [esp + 0x18]
mov eax, dword [edi + 0x74]
mov ecx, dword [edi + 0x70]
push 0xcc0020
push 0
push 0
push edx
push eax
imul eax, esi
push ecx
imul ecx, ebx
push eax
mov eax, dword [esp + 0x30]
push ecx
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
inc esi
cmp esi, ebp
jl 0x444270
mov ecx, dword [esp + 0x1c]
inc ebx
cmp ebx, ecx
jl 0x444267
pop edi
pop esi
pop ebp
pop ebx
ret 0xc
Function at 0x44cac0
Capabilities:
Get file version info

Disassembly:
mov eax, dword [esp + 4]
sub esp, 8
push ebx
push esi
push edi
mov esi, ecx
test eax, eax
je 0x44caef
lea edx, [esi + 0x84]
sub edx, eax
jmp 0x44cae0
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x44cae0
lea eax, [esp + 0x18]
push eax
lea ebx, [esi + 0x84]
push ebx
mov dword [esp + 0x20], 0
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
test edi, edi
je 0x44cb9f
mov eax, dword [esi]
test eax, eax
je 0x44cb21
push eax
call fcn.00451dff
add esp, 4
push edi
call fcn.00451e0a
add esp, 4
mov dword [esi], eax
test eax, eax
je 0x44cb9f
mov ecx, dword [esp + 0x18]
push eax
push edi
push ecx
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x44cb9f
mov ecx, dword [esi]
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x14]
push eax
push str.VarFileInfoTranslation
push ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
call sub.VERSION.dll_VerQueryValueW
test eax, eax
jle 0x44cb9f
cmp dword [esp + 0xc], 4
jb 0x44cb9f
mov eax, dword [esp + 0x10]
movzx edx, word [eax + 2]
movzx eax, word [eax]
push edx
push eax
push str.StringFileInfo_04x_04x_
add esi, 4
push esi
call fcn.00483065
add esp, 0x10
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 8
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 8
ret 4

Function at 0x44ec70
Capabilities:
Generate random numbers via winapi

Disassembly:
push ecx
mov ecx, dword [ecx + 4]
lea eax, [esp + 3]
push eax
push 1
push ecx
mov byte [esp + 0xf], 0
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
movzx eax, byte [esp + 3]
cdq
mov ecx, 0xa
idiv ecx
mov eax, edx
pop ecx
ret
Function at 0x44ed90
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4a3f7b
mov eax, dword fs:[0]
push eax
sub esp, 0x78
mov eax, dword [0x4eed38]
xor eax, esp
mov dword [esp + 0x74], eax
push ebx
push esi
push edi
mov eax, dword [0x4eed38]
xor eax, esp
push eax
lea eax, [esp + 0x88]
mov dword fs:[0], eax
mov esi, dword [esp + 0x98]
mov eax, dword [esp + 0x9c]
mov edi, ecx
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], vtable.CFont.0
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [esp + 0x18], ecx
mov ecx, dword [eax + 8]
mov dword [esp + 0x1c], edx
mov edx, dword [eax + 0xc]
mov eax, dword [edi + 0x20]
push eax
mov dword [esp + 0x94], 0
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], edx
call dword [sym.imp.USER32.dll_GetParent]
push eax
call fcn.004555a5
mov ecx, dword [eax + 0x20]
push 0
push 0
push 0x31
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
push eax
call fcn.00460a1e
mov eax, dword [eax + 4]
lea edx, [esp + 0x28]
push edx
push 0x5c
push eax
call dword [sym.imp.GDI32.dll_GetObjectW]
lea ecx, [esp + 0x28]
push ecx
mov dword [esp + 0x3c], 0x2bc
mov dword [esp + 0x2c], 0x14
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
push eax
lea ecx, [esp + 0x14]
call fcn.00460a32
mov edx, dword [esi]
mov edx, dword [edx + 0x28]
lea eax, [esp + 0x10]
push eax
mov ecx, esi
call edx
push 1
mov ecx, esi
mov ebx, eax
call fcn.0045ff6f
mov ecx, dword [edi + 0x54]
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
push ecx
mov ecx, esi
call edx
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x24]
mov edi, dword [edi + 0x60]
add dword [esp + 0x18], 0x14
sub eax, ecx
sub eax, 0x14
cdq
sub eax, edx
sar eax, 1
add ecx, eax
mov eax, dword [esi]
mov edx, dword [eax + 0x68]
mov dword [esp + 0x1c], ecx
push 4
lea ecx, [esp + 0x1c]
push ecx
push 0xffffffffffffffff
push edi
mov ecx, esi
call edx
test ebx, ebx
je 0x44eecd
mov eax, dword [esi]
mov edx, dword [eax + 0x28]
push ebx
mov ecx, esi
call edx
lea ecx, [esp + 0x10]
mov dword [esp + 0x90], 0xffffffff
mov dword [esp + 0x10], vtable.CFont.0
call fcn.00409310
mov ecx, dword [esp + 0x88]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x74]
xor ecx, esp
call fcn.004820da
add esp, 0x84
ret 8

Function at 0x44f100
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [esp + 4]
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0x6a09e667
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0x3c6ef372
mov dword [eax + 0x14], 0xa54ff53a
mov dword [eax + 0x18], 0x510e527f
mov dword [eax + 0x1c], 0x9b05688c
mov dword [eax + 0x20], 0x1f83d9ab
mov dword [eax + 0x24], 0x5be0cd19
ret
Function at 0x452b80
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x58], ebx
test ebx, 0xffff0000
jne 0x452ba4
cmp dword [edi + 0x54], 0
jne 0x452ba4
movzx eax, bx
mov dword [edi + 0x54], eax
call fcn.0045b40e
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.00452b41
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x4586e3
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x45872a
call fcn.0045b40e
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x45872a
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x458746
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.0045825b
mov esi, eax
test edi, edi
je 0x458744
test ebx, ebx
je 0x458744
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x45987b
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x4a4e4c
call fcn.00485c6b
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x4598a0
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x4598e6
lea ecx, [ebp - 0x10]
call fcn.00401650
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00451f68
add esp, 0x10
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00401220
mov eax, esi
call fcn.00485d43
ret 8