joyce8/EMBER2024-capa huggingface dataset:
Function at 0x469ee0
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x48c8a8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push ebx
push esi
mov esi, ecx
lea ecx, [esp + 0x10]
call fcn.0046b421
mov eax, dword [esp + 0x3c]
lea ecx, [esp + 8]
push eax
mov dword [esp + 0x38], 0
call fcn.0047d574
lea ecx, [esp + 0x3c]
push 1
push ecx
lea ecx, [esp + 0x10]
mov byte [esp + 0x3c], 1
call fcn.0047aadd
mov eax, dword [eax]
push 0x4be1fc
push eax
call fcn.0046c8c4
add esp, 8
lea ecx, [esp + 0x3c]
test eax, eax
setne bl
call fcn.0047d506
test bl, bl
je 0x469f60
push 0x4be1fc
lea ecx, [esp + 0xc]
call fcn.0047d896
push 0x4be1f8
lea ecx, [esp + 0xc]
call fcn.0047d896
mov edx, dword [esp + 8]
push 0
push edx
lea ecx, [esp + 0x18]
call fcn.0046b4e4
test eax, eax
je 0x46a024
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push edi
mov bl, 2
lea ecx, [esp + 0x18]
call fcn.0046b704
mov edi, eax
mov eax, dword [esp + 0x18]
push 0x10
lea ecx, [esp + 0x1c]
call dword [eax + 0x38]
test eax, eax
je 0x469fe0
lea ecx, [esp + 0x18]
call fcn.0046b6cb
test eax, eax
jne 0x469fe0
lea ecx, [esp + 0x44]
push ecx
lea ecx, [esp + 0x1c]
call fcn.0046b7d3
mov eax, dword [eax]
mov ecx, esi
push eax
mov byte [esp + 0x40], bl
call fcn.00469ee0
mov byte [esp + 0x3c], 1
lea ecx, [esp + 0x44]
jmp 0x46a015
lea ecx, [esp + 0x18]
call fcn.0046b6cb
test eax, eax
jne 0x46a01a
mov edx, dword [esp + 0x18]
push 0x10
lea ecx, [esp + 0x1c]
call dword [edx + 0x38]
test eax, eax
jne 0x46a01a
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push eax
call fcn.0046b7d3
mov eax, dword [eax]
push eax
call ebp
lea ecx, [esp + 0x14]
call fcn.0047d506
test edi, edi
jne 0x469f90
pop edi
pop ebp
lea ecx, [esp + 0x10]
call fcn.0046b49a
lea ecx, [esp + 8]
mov byte [esp + 0x34], 0
call fcn.0047d506
lea ecx, [esp + 0x10]
mov dword [esp + 0x34], 0xffffffff
call fcn.0046b45e
mov ecx, dword [esp + 0x2c]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x30
ret 4
Function at 0x46a120
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x48c8d6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14c
mov eax, dword [0x4be284]
push ebx
push esi
mov ebx, ecx
mov dword [esp + 8], eax
mov dword [esp + 0x15c], 0
mov dword [esp + 0xc], eax
mov esi, dword [esp + 0x164]
lea ecx, [esp + 0xc]
push esi
mov byte [esp + 0x160], 1
call fcn.0047d643
push str..
lea ecx, [esp + 0x10]
call fcn.0047d896
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x14]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0x10], eax
jne 0x46a1c3
lea ecx, [esp + 0xc]
mov byte [esp + 0x15c], 0
call fcn.0047d506
lea ecx, [esp + 8]
mov dword [esp + 0x15c], 0xffffffff
call fcn.0047d506
xor eax, eax
jmp 0x46a308
push ebp
mov ebp, dword [esp + 0x16c]
push edi
mov edi, dword [esp + 0x174]
lea edx, [esp + 0x48]
push 0x4be21c
push edx
call fcn.0046c8c4
add esp, 8
test eax, eax
je 0x46a2b9
lea eax, [esp + 0x48]
push 0x4be218
push eax
call fcn.0046c8c4
add esp, 8
test eax, eax
je 0x46a2b9
test ebp, ebp
jne 0x46a225
lea ecx, [esp + 0x48]
push str.desktop.ini
push ecx
call fcn.0046c973
add esp, 8
test eax, eax
je 0x46a2b9
push esi
lea ecx, [esp + 0x14]
call fcn.0047d643
push 0x5c
lea ecx, [esp + 0x14]
call fcn.0047d8bd
lea edx, [esp + 0x48]
lea ecx, [esp + 0x10]
push edx
call fcn.0047d896
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 1
je 0x46a265
mov ecx, dword [esp + 0x10]
and al, 0xfe
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test byte [esp + 0x1c], 0x10
je 0x46a287
mov edx, dword [esp + 0x10]
push edi
push ebp
push edx
mov ecx, ebx
call fcn.0046a120
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
jmp 0x46a2b9
test edi, edi
je 0x46a2ae
lea ecx, [esp + 0x48]
push str.index.dat
push ecx
call fcn.0046c973
add esp, 8
test eax, eax
jne 0x46a2ae
lea edx, [esp + 0x48]
mov ecx, ebx
push edx
push esi
call fcn.0046a330
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x1c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x46a1d3
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [esp + 0x14]
mov byte [esp + 0x164], 0
call fcn.0047d506
lea ecx, [esp + 0x10]
mov dword [esp + 0x164], 0xffffffff
call fcn.0047d506
pop edi
mov eax, 1
pop ebp
mov ecx, dword [esp + 0x154]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x158
ret 0xc
Function at 0x46a330
Capabilities:
Get file size
Write file on windows

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x48c8eb
push eax
mov eax, 0x2718
mov dword fs:[0], esp
call fcn.0046d0e0
mov eax, dword [0x4be284]
push edi
mov dword [esp + 4], eax
mov ecx, 0x9c4
xor eax, eax
lea edi, [esp + 0xc]
mov dword [esp + 0x2724], 0
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x272c]
push ecx
lea ecx, [esp + 8]
call fcn.0047d643
push 0x5c
lea ecx, [esp + 8]
call fcn.0047d8bd
mov edx, dword [esp + 0x2730]
lea ecx, [esp + 4]
push edx
call fcn.0047d896
mov eax, dword [esp + 4]
push 0
push 0x80
push 3
push 0
push 3
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x46a3d6
lea ecx, [esp + 4]
mov dword [esp + 0x2724], eax
call fcn.0047d506
xor eax, eax
jmp 0x46a453
push ebx
push esi
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0
push 0
mov esi, eax
push 0x40
push edi
sub esi, 0x40
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
test esi, esi
jbe 0x46a431
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
cmp esi, 0x2710
push 0
jbe 0x46a423
lea ecx, [esp + 0x14]
lea edx, [esp + 0x18]
push ecx
push 0x2710
push edx
push edi
call ebx
sub esi, 0x2710
jne 0x46a3fd
jmp 0x46a431
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push eax
push esi
push ecx
push edi
call ebx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0xc]
mov dword [esp + 0x272c], 0xffffffff
call fcn.0047d506
pop esi
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x271c]
pop edi
mov dword fs:[0], ecx
add esp, 0x2724
ret 8

Function at 0x47f8d4
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x47f90c
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0047d961
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0047d939
jmp 0x47f918
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x480fc2
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x481004
call fcn.00486d87
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x481004
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x480ffb
xor eax, eax
jmp 0x48100c
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00481012
pop edi
pop esi
pop ebx
ret 4
Function at 0x4872b7
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4872e5
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x487303
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0048721d
jmp 0x487303
mov eax, dword [esi + 0x14]
test eax, eax
je 0x487303
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0048721d
test edi, edi
mov eax, edi
jne 0x4872ed
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x405510
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x90c
push ebx
push esi
mov edx, ecx
push edi
mov ecx, 0x200
xor eax, eax
lea edi, [esp + 0x114]
mov byte [esp + 0x10], 0
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov al, byte [edx + 0x941]
cmp al, 0x3a
je 0x405570
cmp byte [edx + 0x940], 0x5c
je 0x405570
cmp al, 0x5c
je 0x405570
mov edi, dword [esp + 0x91c]
or ecx, 0xffffffff
xor eax, eax
lea ebx, [esp + 0x10]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [edx + 0x940]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x10]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push eax
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push eax
push 3
mov ecx, ebx
push eax
push eax
and ecx, 3
lea eax, [esp + 0x24]
push 0x80000000
rep movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4055de
lea ecx, [esp + 0x10]
push ecx
push 0x21
push 0x428420
call fcn.004097e0
add esp, 0xc
or eax, esi
pop edi
pop esi
pop ebx
add esp, 0x90c
ret 4
lea edx, [esp + 0xc]
push 0
push edx
lea eax, [esp + 0x11c]
push 0x800
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
push esi
jne 0x405627
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x10]
push ecx
push 0x21
push 0x428420
call fcn.004097e0
add esp, 0xc
or eax, 0xffffffff
pop edi
pop esi
pop ebx
add esp, 0x90c
ret 4
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [esp + 0x114]
push edx
call fcn.00413b40
mov al, byte [esp + 0x118]
add esp, 4
test al, al
lea esi, [esp + 0x114]
je 0x405696
mov bl, 0x6d
cmp byte [esi], 0x69
jne 0x40566f
cmp byte [esi + 4], bl
jne 0x40566f
push 8
push str.inf_mode
push esi
call fcn.00413b00
add esp, 0xc
test eax, eax
je 0x405685
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x405651
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x90c
ret 4
mov eax, 1
pop edi
pop esi
pop ebx
add esp, 0x90c
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x90c
ret 4
Function at 0x405ea0
Capabilities:
Delete file
Get common file path

Disassembly:
sub esp, 0x208
lea eax, [esp]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [esp + 0x104]
lea edx, [esp]
push ecx
push 0
push str.vs98
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x405ee0
mov eax, 1
add esp, 0x208
ret
lea eax, [esp + 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor eax, eax
add esp, 0x208
ret
Function at 0x4067d0
Capabilities:
Get disk information

Disassembly:
sub esp, 0x28
push ebx
push esi
mov esi, dword [esp + 0x34]
xor al, al
mov byte [esp + 8], al
mov cl, byte [esi]
test cl, cl
je 0x406802
mov bl, byte [esi + 1]
mov dl, 0x3a
cmp bl, dl
jne 0x406802
mov al, cl
mov byte [esp + 9], dl
mov byte [esp + 8], al
mov byte [esp + 0xa], 0x5c
mov byte [esp + 0xb], 0
lea ecx, [esp + 0x10]
push 0x20
push ecx
lea edx, [esp + 0x14]
lea ecx, [esp + 0x3c]
push edx
neg al
push ecx
lea edx, [esp + 0x18]
sbb eax, eax
push 0
push 0
and eax, edx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
jne 0x406834
pop esi
pop ebx
add esp, 0x28
ret
lea eax, [esp + 0x10]
push 0x422414
push eax
call fcn.00413600
add esp, 8
test eax, eax
jne 0x406876
mov eax, dword [esp + 0x34]
cmp eax, 0xc
jne 0x406866
push 3
push 8
push esi
call fcn.00406940
add esp, 0xc
pop esi
pop ebx
add esp, 0x28
ret
push eax
push esi
call fcn.004068f0
add esp, 8
pop esi
pop ebx
add esp, 0x28
ret
lea ecx, [esp + 0x10]
push str.HPFS
push ecx
call fcn.00413600
add esp, 8
test eax, eax
je 0x4068d7
lea edx, [esp + 0x10]
push str.HPFS386
push edx
call fcn.00413600
add esp, 8
test eax, eax
je 0x4068d7
lea eax, [esp + 0x10]
push str.NTFS
push eax
call fcn.00413600
add esp, 8
test eax, eax
jne 0x4068cc
mov ecx, dword [esp + 0x34]
push ecx
push esi
call fcn.004068f0
add esp, 8
pop esi
pop ebx
add esp, 0x28
ret
mov eax, 1
pop esi
pop ebx
add esp, 0x28
ret
mov edx, dword [esp + 0x34]
push edx
push esi
call fcn.004068f0
add esp, 8
pop esi
pop ebx
add esp, 0x28
ret
Function at 0x406d60
Capabilities:
Get disk size

Disassembly:
sub esp, 0x34
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetErrorMode]
push edi
xor ebx, ebx
push 1
xor ebp, ebp
mov dword [esp + 0x2c], ebx
call esi
push str.Kernel32.dll
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
push str.GetDiskFreeSpaceExA
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x406ddb
lea ecx, [esp + 0x3c]
lea edx, [esp + 0x34]
push ecx
push edx
mov edx, dword [esp + 0x50]
lea ecx, [esp + 0x34]
push ecx
push edx
call eax
test eax, eax
je 0x406ddb
mov eax, dword [esp + 0x4c]
test eax, eax
je 0x406dca
mov eax, dword [esp + 0x30]
mov ebp, dword [esp + 0x2c]
mov dword [esp + 0x28], eax
jmp 0x406dd6
mov ecx, dword [esp + 0x38]
mov ebp, dword [esp + 0x34]
mov dword [esp + 0x28], ecx
mov ebx, 1
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edx, dword [esp + 0x14]
push edx
call esi
test ebx, ebx
je 0x406dfb
mov eax, ebp
mov edx, dword [esp + 0x28]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x34
ret
push 1
call esi
mov edi, eax
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x20]
push eax
lea edx, [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x50]
lea eax, [esp + 0x18]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
push edi
mov ebx, eax
call esi
test ebx, ebx
jne 0x406e35
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x34
ret
mov ebx, dword [esp + 0x18]
mov ecx, dword [esp + 0x4c]
mov eax, ebx
mov esi, dword [esp + 0x1c]
cdq
and edx, 0x7f
add eax, edx
sar eax, 7
test ecx, ecx
je 0x406e57
imul eax, dword [esp + 0x20]
jmp 0x406e5a
imul eax, esi
mov edi, dword [esp + 0x10]
imul eax, edi
cdq
test edx, edx
jl 0x406e6f
jg 0x406ea0
cmp eax, 0x7a11f8
ja 0x406ea0
push 0
push 0x80
push edx
push eax
call fcn.004141a0
test esi, esi
je 0x406ea0
test edi, edi
je 0x406ea0
test ebx, ebx
je 0x406ea0
test edx, edx
jl 0x406ea0
jg 0x406e93
test eax, eax
jb 0x406ea0
test edx, edx
jg 0x406ea0
jl 0x406ea7
cmp eax, 0x3d08fc00
jbe 0x406ea7
mov eax, 0x3d08fc00
xor edx, edx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x34
ret

Function at 0x406f20
Capabilities:
Get disk information

Disassembly:
sub esp, 8
push ebx
push esi
push edi
mov ecx, 0x4e
xor eax, eax
mov edi, 0x426ce8
rep stosd dword es:[edi], eax
mov edi, dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov byte [esp + 0xd], 0x3a
mov byte [esp + 0xe], 0x5c
mov byte [esp + 0xf], al
mov dword [esp + 0x10], eax
mov esi, 0x426cea
mov bl, byte [esp + 0x10]
lea eax, [esp + 0xc]
add bl, 0x61
push eax
mov byte [esp + 0x10], bl
call edi
cmp eax, 3
mov dword [esi + 2], eax
jne 0x406f79
lea ecx, [esi - 2]
push esi
push ecx
push ebx
call fcn.00406eb0
add esp, 0xc
mov edx, dword [esp + 0x10]
add esi, 0xc
inc edx
cmp esi, 0x426e22
mov dword [esp + 0x10], edx
jl 0x406f51
pop edi
pop esi
pop ebx
add esp, 8
ret
Function at 0x406fa0
Capabilities:
Get disk information

Disassembly:
sub esp, 0x10c
push ebx
push esi
mov esi, dword [esp + 0x118]
push edi
push esi
lea eax, [esp + 0x14]
push str.__s_
push eax
call fcn.00413140
mov cl, byte [esi]
mov dl, byte [esi + 1]
mov al, byte [esi + 2]
add esp, 0xc
mov byte [esp + 0xc], cl
lea ecx, [esp + 0xc]
push ecx
mov byte [esp + 0x11], dl
mov byte [esp + 0x12], al
mov byte [esp + 0x13], 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 3
je 0x406ffd
cmp eax, 2
je 0x406ffd
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x10c
ret
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edi, dword [sym.imp.USER32.dll_CharPrevA]
not ecx
dec ecx
add ecx, esi
push ecx
push esi
call edi
mov cl, byte [eax]
mov ebx, dword [sym.imp.USER32.dll_CharNextA]
cmp cl, 0x20
jne 0x407031
push eax
push esi
call edi
cmp byte [eax], 0x20
je 0x407022
push eax
call ebx
mov byte [eax], 0
mov cl, byte [esi]
mov eax, esi
test cl, cl
je 0x407071
mov edi, dword [esp + 0xc]
cmp cl, 0x5c
jne 0x407047
cmp byte [edi], 0x20
je 0x407065
push eax
mov edi, eax
call ebx
mov cl, byte [eax]
test cl, cl
jne 0x40703d
push esi
call fcn.004067d0
add esp, 4
pop edi
pop esi
pop ebx
add esp, 0x10c
ret
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x10c
ret
push esi
call fcn.004067d0
add esp, 4
pop edi
pop esi
pop ebx
add esp, 0x10c
ret
Function at 0x407240
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x330
lea eax, [esp + 0x12c]
push esi
mov esi, dword [esp + 0x338]
push edi
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x104
push eax
push 0x418
push esi
call edi
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea ecx, [esp + 0x134]
push ecx
call fcn.00406fa0
add esp, 4
test eax, eax
jne 0x4072ba
mov eax, dword [0x42845c]
lea edx, [esp + 0x34]
push 0xff
push edx
push 0x12
push eax
call dword [sym.imp.USER32.dll_LoadStringA]
lea eax, [esp + 0x34]
push eax
push 0x41b
push esi
call edi
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
pop edi
pop esi
add esp, 0x330
ret
movsx ecx, byte [esp + 0x134]
push ebx
push ecx
call fcn.00414290
mov ebx, eax
mov eax, dword [esp + 0x348]
add esp, 4
sub ebx, 0x61
test eax, eax
je 0x4072e3
call fcn.00406f20
jmp 0x407305
lea eax, [ebx + ebx*2]
mov cl, bl
shl eax, 2
add cl, 0x61
lea edx, [eax + 0x426cea]
lea eax, [eax + 0x426ce8]
push edx
push eax
push ecx
call fcn.00406eb0
add esp, 0xc
lea edx, [ebx + 0x41]
lea eax, [esp + 0xc]
push edx
push 0x42244c
push eax
call fcn.00413140
lea ecx, [esp + 0x18]
add esp, 0xc
mov dword [esp + 0x10], ecx
lea eax, [ebx + ebx*2]
xor ecx, ecx
lea edx, [esp + 0x18]
mov cx, word [eax*4 + 0x426ce8]
push 0xa
push edx
push ecx
call fcn.004150b0
mov eax, dword [0x42845c]
add esp, 0xc
lea ecx, [esp + 0x38]
lea edx, [esp + 0x18]
push 0xff
push ecx
push 0x17
push eax
mov dword [esp + 0x24], edx
call dword [sym.imp.USER32.dll_LoadStringA]
lea edx, [esp + 0x10]
lea eax, [esp + 0x23c]
push edx
push 0xff
push eax
push 0
lea ecx, [esp + 0x48]
push 0
push ecx
push 0x2400
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
lea edx, [esp + 0x23c]
push edx
push 0x41b
push esi
call edi
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
pop ebx
pop edi
pop esi
add esp, 0x330
ret
Function at 0x408820
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x21c
lea eax, [esp + 8]
push ebx
push ebp
push esi
push edi
xor edi, edi
push eax
push 0x20019
push edi
push str.SoftwareMicrosoftWindowsCurrentVersionSharedDlls
push 0x80000002
xor esi, esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x40885a
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x21c
ret
lea ecx, [esp + 0x10]
lea edx, [esp + 0x1c]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
push ecx
push edx
mov edx, dword [esp + 0x20]
push 0
lea eax, [esp + 0x20]
push 0
lea ecx, [esp + 0x34]
push eax
push ecx
mov ebp, 8
push 0
push edx
mov dword [esp + 0x34], 0x208
mov dword [esp + 0x30], ebp
call ebx
cmp eax, 0x103
je 0x4088df
test eax, eax
jne 0x4088f7
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
add ecx, eax
lea edx, [esp + 0x10]
lea eax, [esp + 0x1c]
push edx
lea esi, [esi + ecx + 0x10]
push eax
mov eax, dword [esp + 0x20]
push 0
lea ecx, [esp + 0x20]
push 0
lea edx, [esp + 0x34]
inc edi
push ecx
push edx
push edi
push eax
mov dword [esp + 0x34], 0x208
mov dword [esp + 0x30], ebp
call ebx
cmp eax, 0x103
jne 0x408899
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x21c
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x21c
ret

Function at 0x4099c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov ecx, dword [esp + 4]
mov eax, dword [0x42845c]
push ebx
push ebp
push esi
push edi
and ecx, 0xffff
push 0xc8
push ecx
push eax
xor ebp, ebp
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
jne 0x4099ed
pop edi
pop esi
pop ebp
pop ebx
ret 0x10
mov ecx, dword [0x42845c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x409a06
pop edi
pop esi
pop ebp
pop ebx
ret 0x10
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x409a1a
pop edi
pop esi
pop ebp
pop ebx
ret 0x10
mov eax, dword [esi]
mov edi, dword [esp + 0x18]
push eax
mov dword [edi], eax
call fcn.00413950
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x409a38
pop edi
pop esi
pop ebp
pop ebx
ret 0x10
push ebx
push esi
call fcn.00409870
mov eax, dword [esp + 0x28]
add esp, 8
test eax, eax
je 0x409a77
cmp word [ebx], 0x4d42
je 0x409a72
push ebx
call fcn.004138b0
mov edx, dword [esp + 0x20]
mov dword [edi], 0
add esp, 4
mov eax, dword [edx]
mov byte [eax], 0
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret 0x10
mov ebp, 0xe
mov ecx, dword [edi]
sub ecx, ebp
push ecx
call fcn.00413950
mov edx, dword [esp + 0x20]
add esp, 4
test eax, eax
mov dword [edx], eax
jne 0x409aa0
push ebx
call fcn.004138b0
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret 0x10
mov ecx, dword [edi]
mov edi, eax
sub ecx, ebp
lea esi, [ebp + ebx]
mov eax, ecx
push ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.004138b0
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
ret 0x10
Function at 0x409b70
Capabilities:
Create process on windows

Disassembly:
mov edx, dword [esp + 0xc]
sub esp, 0x180
mov ecx, 0x11
xor eax, eax
push esi
push edi
mov edi, edx
mov esi, dword [esp + 0x190]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x198]
mov ecx, dword [esp + 0x18c]
push eax
push edx
push 0
push 0
push 0x20
push 0
push 0
push 0
push esi
push ecx
mov dword [edx], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov edi, eax
test edi, edi
jne 0x409c05
mov eax, dword [0x42845c]
lea edx, [esp + 8]
push 0x80
push edx
push 0x20
push eax
call dword [sym.imp.USER32.dll_LoadStringA]
lea eax, [esp + 8]
push esi
lea ecx, [esp + 0x8c]
push eax
push ecx
call fcn.00413140
add esp, 0xc
lea edx, [esp + 0x88]
push 0x2000
push 0x428504
push edx
push edi
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, edi
pop edi
pop esi
add esp, 0x180
ret 0x10