joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c698
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov ebx, ecx
call fcn.0040c62e
mov ecx, dword [ebp + 0xc]
xor edi, edi
test ecx, ecx
je 0x40c776
mov edx, ecx
push esi
lea esi, [edx + 2]
mov ax, word [edx]
add edx, 2
cmp ax, di
jne 0x40c6b8
sub edx, esi
sar edx, 1
je 0x40c775
push 0x83e
push ecx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
mov dword [ebp - 4], esi
test esi, esi
je 0x40c736
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp + 0xc], eax
test eax, eax
je 0x40c736
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
push edi
push 0x22
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
mov dword [ebx + 0xc], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push dword [ebp + 0xc]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push edi
push eax
push esi
call fcn.00513dd0
add esp, 0xc
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
xor edi, edi
cmp dword [ebx + 0xc], 0
je 0x40c775
lea eax, [ebp + 8]
mov dword [ebp + 8], edi
push eax
push 1
push dword [ebx + 0xc]
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jne 0x40c775
cmp dword [ebp + 8], eax
je 0x40c775
push 0x10
call dword [sym.imp.gdiplus.dll_GdipAlloc]
test eax, eax
je 0x40c770
push ecx
push dword [ebp + 8]
mov ecx, eax
call fcn.0040cbbd
jmp 0x40c772
mov eax, edi
mov dword [ebx + 0x14], eax
pop esi
mov ecx, dword [ebx + 0x14]
test ecx, ecx
je 0x40c79a
call fcn.0040cb96
mov ecx, dword [ebx + 0x14]
mov dword [ebx + 4], eax
call fcn.0040cb6f
mov dword [ebx + 8], eax
xor eax, eax
cmp dword [ebx + 4], edi
setg al
jmp 0x40c79c
xor eax, eax
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x40d334
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
xor eax, eax
mov dword [ebp - 4], edx
push eax
push 0x80
push 2
push eax
push eax
push 0xc0000000
push ecx
mov esi, 0xfa000
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40d366
xor eax, eax
jmp 0x40d3b3
mov eax, dword [ebp - 4]
push edi
mov edi, dword [ebp + 8]
push 0
cmp edi, 0xfa000
lea ecx, [ebp - 8]
push ecx
cmovb esi, edi
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40d3a9
cmp esi, edi
je 0x40d39d
mov eax, dword [ebp - 4]
sub edi, 0xfa000
add eax, esi
mov dword [ebp - 4], eax
jmp 0x40d36d
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
jmp 0x40d3b2
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40dd6c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push esi
push edi
cmp dword [ebp + 0xc], ebx
jne 0x40dd81
push 0x83e
jmp 0x40dd84
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [0x5cbd80]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x40de72
push esi
push dword [0x5cbd80]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp + 0xc], eax
test eax, eax
je 0x40de72
push esi
push dword [0x5cbd80]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
push edi
push 0x22
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push dword [ebp + 0xc]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push edi
push eax
push esi
call fcn.00513dd0
add esp, 0xc
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov esi, dword [ebp - 4]
test esi, esi
je 0x40de72
lea eax, [ebp + 0xc]
xor edi, edi
push eax
push 1
push esi
mov dword [ebp + 0xc], edi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jne 0x40de31
cmp dword [ebp + 0xc], ebx
je 0x40de31
push 0x10
call dword [sym.imp.gdiplus.dll_GdipAlloc]
test eax, eax
je 0x40de31
push ecx
push dword [ebp + 0xc]
mov ecx, eax
call fcn.0040e4ae
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
test ebx, ebx
je 0x40de72
mov dword [ebp + 8], edi
mov eax, dword [ebx + 8]
mov dword [ebx + 8], edi
test eax, eax
jne 0x40de65
push edi
lea eax, [ebp + 8]
push eax
push dword [ebx + 4]
call dword [sym.imp.gdiplus.dll_GdipCreateHBITMAPFromBitmap]
test eax, eax
je 0x40de65
mov dword [ebx + 8], eax
mov eax, dword [ebx]
mov ecx, ebx
push 1
call dword [eax]
mov eax, dword [ebp + 8]
jmp 0x40de74
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x40e612
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x5b3074]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, ecx
push 0
push 0x100
push 0
lea ebx, [esi + 4]
mov ecx, ebx
call fcn.0040e9fb
lea edi, [esi + 0x28]
push 1
mov ecx, edi
call fcn.0041c4d9
push dword [ebx]
call fcn.0041b99f
push 0xd
push str.IDB_PNG2
push ecx
mov ecx, edi
call fcn.0041b9f2
cmp dword [0x5cbf9c], 0
mov eax, dword [0x5dd2c4]
je 0x40e6aa
cmp dword [eax - 0xc], 0
jne 0x40e692
mov ecx, dword [esi + 0xdc]
xor eax, eax
test ecx, ecx
mov edx, 0x5b7000
setne al
add eax, 0xc
push eax
mov eax, 0x5ba5a0
test ecx, ecx
cmovne eax, edx
jmp 0x40e6ec
mov ecx, dword [0x5cbd84]
test ecx, ecx
push 0xb
pop eax
push 2
pop edx
cmovne eax, edx
mov edx, 0x5b42a0
jmp 0x40e6e3
cmp dword [eax - 0xc], 0
jne 0x40e6cd
mov ecx, dword [esi + 0xdc]
xor eax, eax
test ecx, ecx
mov edx, 0x5c0480
setne al
add eax, 0xc
push eax
mov eax, 0x5c3a20
jmp 0x40e68b
mov ecx, dword [0x5cbd84]
test ecx, ecx
push 0xb
pop eax
push 2
pop edx
cmovne eax, edx
mov edx, 0x5bd720
push eax
mov eax, 0x5b3a60
cmove eax, edx
push eax
mov ecx, edi
call fcn.0041b769
push 0x1b
pop ecx
push 6
push ecx
xor edx, edx
mov dword [esi + 0xc4], eax
push eax
push edx
push edx
push edx
push dword [ebx]
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], ecx
call dword [sym.imp.USER32.dll_SetWindowPos]
lea eax, [ebp - 0x14]
mov ecx, edi
push eax
call fcn.0041c036
push 1
mov ecx, edi
call fcn.0041c4cc
push 0
push dword [ebx]
call dword [sym.imp.USER32.dll_ShowWindow]
and dword [esi + 0xd8], 0
xor eax, eax
mov ecx, dword [ebp - 4]
inc eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00510209
mov esp, ebp
pop ebp
ret 4
Function at 0x40f995
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x5b3074]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x228], eax
je 0x40fb53
xor ecx, ecx
mov dword [ebx + 0x228], eax
inc ecx
xor edi, edi
cmp eax, ecx
je 0x40fa98
cmp eax, 3
je 0x40fa98
cmp eax, 2
jne 0x40fb48
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 5
push dword [ebx + 0x22c]
call esi
push 5
push dword [ebx + 0x230]
call esi
push edi
lea ecx, [ebx + 0x3c]
call fcn.0041c4cc
mov esi, dword [sym.imp.USER32.dll_SetWindowPos]
mov edi, 0xc8
push 4
push edi
push 0x3c
push 7
push 0x1e
push 0
push dword [ebx + 0x230]
call esi
push 4
push edi
push 0x2b
push 7
push 0x64
xor edi, edi
push edi
push dword [ebx + 0x22c]
call esi
movaps xmm0, xmmword [0x593720]
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebx + 0x174]
movups xmmword [ebp - 0x18], xmm0
call fcn.0041c036
movaps xmm0, xmmword [0x593680]
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebx + 0xd8]
movups xmmword [ebp - 0x28], xmm0
call fcn.0041c036
push 0x22
push 0xb2
push 5
push 0x96
lea eax, [ebx + 0x214]
push eax
call dword [sym.imp.USER32.dll_SetRect]
push 6
push 0x27
push 0x144
push edi
push edi
push edi
push dword [ebx + 4]
call esi
jmp 0x40fb45
push ecx
lea ecx, [ebx + 0x3c]
call fcn.0041c4cc
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [ebx + 0x22c]
call esi
push 0
push dword [ebx + 0x230]
call esi
movaps xmm0, xmmword [0x593710]
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebx + 0x174]
movups xmmword [ebp - 0x28], xmm0
call fcn.0041c036
movaps xmm0, xmmword [0x593670]
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebx + 0xd8]
movups xmmword [ebp - 0x18], xmm0
call fcn.0041c036
push 0x22
push 0x76
push 5
push 0x5a
lea eax, [ebx + 0x214]
push eax
call dword [sym.imp.USER32.dll_SetRect]
xor eax, eax
cmp dword [ebp + 8], 1
push ecx
setne al
lea ecx, [ebx + 0x3c]
add eax, 0x500
push eax
call fcn.0041c29c
push 0xa
pop eax
xor ecx, ecx
push 6
inc ecx
cmp dword [ebp + 8], ecx
push 0x27
push 0x108
cmove eax, ecx
xor edi, edi
push edi
push edi
push edi
push dword [ebx + 4]
mov dword [ebx + 0x224], eax
call dword [sym.imp.USER32.dll_SetWindowPos]
xor ecx, ecx
inc ecx
push ecx
push edi
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_InvalidateRect]
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00510209
mov esp, ebp
pop ebp
ret 4
Function at 0x410ba0
Capabilities:
Hide graphical window

Disassembly:
push 0x1c
mov eax, 0x569dc2
call fcn.005110f0
mov esi, edx
mov ebx, ecx
mov ecx, dword [0x5cc37c]
xor edi, edi
test ecx, ecx
je 0x410bc9
mov eax, dword [ecx]
push 1
call dword [eax + 0xc]
mov dword [0x5cc37c], edi
push 0x130
call fcn.00510252
pop ecx
mov dword [ebp - 0x28], eax
mov ecx, eax
mov dword [ebp - 4], edi
call fcn.0041099e
or dword [ebp - 4], 0xffffffff
push ecx
mov ecx, eax
mov dword [0x5cc37c], eax
call fcn.00435370
mov eax, dword [0x5cc37c]
mov dword [eax + 0x128], esi
push dword [eax + 0x38]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x410c56
push ecx
push ecx
mov ecx, dword [0x5cc37c]
lea edx, [ebp - 0x24]
mov eax, esp
push 0
push SysReAllocString
lea esi, [ecx + 0x7c]
mov dword [eax], edi
lea edi, [ebp - 0x24]
movsd dword es:[edi], dword [esi]
push ecx
push ecx
mov eax, esp
movsd dword es:[edi], dword [esi]
push ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [eax], edx
call fcn.00433d30
mov ecx, dword [0x5cc37c]
push 0xb4
mov eax, dword [ecx]
call dword [eax + 0x40]
mov eax, dword [0x5cc37c]
push 1
push dword [eax + 0x38]
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
call fcn.0051109a
ret

Function at 0x410d63
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x5cc37c]
test eax, eax
je 0x410d77
push 0
push dword [eax + 0x38]
call dword [sym.imp.USER32.dll_ShowWindow]
ret
Function at 0x4121b6
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
mov eax, dword [0x5b3074]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
mov ebx, ecx
push 0x20a
push eax
mov dword [ebp - 0x23c], eax
lea eax, [ebp - 0x218]
push eax
call fcn.00517390
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push dword [ebx + 4]
xorps xmm0, xmm0
movups xmmword [ebp - 0x228], xmm0
call dword [sym.imp.USER32.dll_GetDC]
push dword [ebx + 0x58]
mov edi, dword [sym.imp.GDI32.dll_SelectObject]
mov esi, eax
push esi
mov dword [ebp - 0x244], esi
call edi
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x240], eax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x23c]
jne 0x412236
push 0x400
sub ecx, edx
lea eax, [ebp - 0x228]
push eax
sar ecx, 1
lea eax, [ebp - 0x218]
push ecx
push eax
push esi
call dword [sym.imp.USER32.dll_DrawTextW]
push dword [ebp - 0x240]
push esi
call edi
lea esi, [ebx + 0x38]
lea edi, [ebp - 0x238]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x238]
mov esi, dword [ebp - 0x220]
sub esi, dword [ebp - 0x228]
lea ecx, [eax + 0x1e]
add ecx, esi
cmp ecx, dword [ebx + 0x50]
cmovg ecx, dword [ebx + 0x50]
xor edx, edx
mov dword [ebp - 0x230], ecx
inc edx
sub ecx, eax
lea eax, [ecx - 0x1e]
test eax, eax
jg 0x4122b1
mov eax, ecx
test eax, eax
cmovle eax, edx
cmp esi, eax
jle 0x4122be
mov ecx, eax
add ecx, eax
inc edx
cmp esi, ecx
jg 0x4122b7
mov ecx, dword [ebp - 0x21c]
sub ecx, dword [ebp - 0x224]
mov eax, dword [ebp - 0x234]
push dword [ebp - 0x244]
imul ecx, edx
add eax, 0x1e
push dword [ebx + 4]
add eax, ecx
cmp eax, dword [ebx + 0x54]
cmovg eax, dword [ebx + 0x54]
mov dword [ebp - 0x22c], eax
call dword [sym.imp.USER32.dll_ReleaseDC]
lea eax, [ebp - 0x238]
mov ecx, ebx
push eax
call fcn.00412170
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00510209
mov esp, ebp
pop ebp
ret

Function at 0x4126ff
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp dword [eax + 4], 0x100
jne 0x412728
cmp dword [eax + 8], 0x1b
jne 0x412728
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
xor eax, eax
inc eax
jmp 0x412737
push eax
add ecx, 0xffffffcc
call fcn.0041739e
neg eax
sbb eax, eax
neg eax
pop ebp
ret 4
Function at 0x414582
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x5b3074]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ebx, ecx
push 3
pop eax
mov edx, eax
mov ecx, dword [ebx + 4]
call fcn.00410ba0
lea ecx, [ebp - 0x28]
call fcn.00410d8b
call fcn.00410d63
call fcn.0041a251
mov ecx, dword [ebx + 0x18c]
lea esi, [ebp - 0x28]
lea edi, [ebp - 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
cmp ecx, 0x50f
jne 0x4145d7
mov dword [ebp - 8], 1
jmp 0x4145fa
cmp ecx, 0x510
jne 0x4145e8
mov dword [ebp - 8], 2
jmp 0x4145fa
mov eax, dword [ebp - 8]
cmp ecx, 0x50e
push 3
pop ecx
cmove eax, ecx
mov dword [ebp - 8], eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x34], 0x14
mov dword [ebp - 0x30], eax
xor esi, esi
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x38], 0x3ec
push eax
push 0xbb8
push esi
lea eax, [ebp - 0x38]
mov dword [ebp - 0x2c], esi
push eax
push dword [ebx + 4]
push 0x4a
call fcn.0041290c
push eax
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
test eax, eax
jne 0x414644
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00510209
mov esp, ebp
pop ebp
ret
Function at 0x414665
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x5b3074]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
push esi
xor esi, esi
push edi
cmp dword [ebx + 0x17c], esi
je 0x4146ae
lea eax, [ebx + 0x50]
push eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.USER32.dll_CopyRect]
lea eax, [ebp - 0x24]
mov dword [ebp - 0xc], 0x10
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], 0x3ec
mov dword [ebp - 0x4c], esi
jmp 0x4147a9
mov eax, dword [ebx + 0x180]
test eax, eax
jne 0x4146ce
mov eax, dword [ebx + 0xc8]
push 5
push dword [eax + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x4147da
cmp eax, 3
je 0x41472c
cmp eax, 2
je 0x41472c
cmp eax, 4
je 0x41472c
lea eax, [ebx + 0x50]
push eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_CopyRect]
mov eax, dword [ebx + 0x180]
sub esp, 0x28
mov ecx, ebx
push esp
cmp eax, 1
jne 0x414705
call fcn.00413d88
push 1
jmp 0x414719
cmp eax, 6
jne 0x414713
call fcn.00413d88
push 2
jmp 0x414719
call fcn.00413d88
push esi
mov ecx, dword [ebx + 4]
lea edx, [ebp - 0x14]
call fcn.0041a268
add esp, 0x2c
jmp 0x4147da
lea eax, [ebx + 0x50]
push eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.USER32.dll_CopyRect]
lea ecx, [ebp - 0x48]
call fcn.00410d8b
mov esi, eax
mov ecx, dword [ebx + 0x180]
lea edi, [ebp - 0x24]
push 3
pop eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea esi, [ebp - 0x24]
lea edi, [ebp - 0x38]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
cmp ecx, eax
jne 0x41476b
mov dword [ebp - 0x28], 2
jmp 0x41477f
cmp ecx, 4
je 0x41477c
mov eax, dword [ebp - 0x28]
xor edx, edx
inc edx
cmp ecx, 2
cmove eax, edx
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x38]
mov dword [ebp - 0xc], 0x14
xor esi, esi
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], 0x3ec
mov dword [ebp - 0x4c], esi
call fcn.00410d63
push 0x510
mov ecx, ebx
call fcn.00413a6b
lea eax, [ebp - 0x4c]
push eax
push 0xbb8
push esi
lea eax, [ebp - 0x10]
push eax
push dword [ebx + 4]
push 0x4a
call fcn.0041290c
push eax
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
test eax, eax
jne 0x4147da
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00510209
mov esp, ebp
pop ebp
ret
Function at 0x414c2b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24c
mov eax, dword [0x5b3074]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x24c], 0
push ebx
push edi
mov ebx, ecx
mov dword [ebp - 0x248], edx
mov dword [ebp - 0x240], ebx
lea edi, [ebp - 0x24]
mov eax, dword [0x58c3e8]
mov dword [ebp - 0x2c], eax
mov eax, dword [0x58c3ec]
push 8
pop ecx
mov dword [ebp - 0x28], eax
xor eax, eax
push 0x20a
push eax
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x238]
mov dword [ebp - 0x23c], 2
push eax
call fcn.00517390
push str.Option
push str.SoftwareCatchScreen
push 0x58c42c
lea eax, [ebp - 0x238]
push 0x104
push eax
call fcn.00408e72
add esp, 0x20
lea eax, [ebp - 0x244]
mov edi, SysReAllocString
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x240]
push eax
push str.SaveDefExtend
lea eax, [ebp - 0x238]
push eax
push edi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x23c]
push eax
lea eax, [ebp - 0x240]
push eax
push str.SaveAsIndexEx
lea eax, [ebp - 0x238]
push eax
push edi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov eax, dword [ebp - 0x248]
test eax, eax
je 0x414d12
mov ecx, dword [ebp - 0x23c]
mov dword [eax], ecx
lea eax, [ebp - 0x2c]
mov ecx, ebx
push eax
call fcn.0040941c
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
xor ecx, ebp
pop ebx
call fcn.00510209
mov esp, ebp
pop ebp
ret
Function at 0x414d2f
Capabilities:
Get common file path

Disassembly:
push 0x2e4
mov eax, 0x569f6c
call fcn.005110f0
mov ebx, ecx
mov dword [ebp - 0x2ec], ebx
mov dword [ebp - 0x2d4], ebx
xor esi, esi
lea eax, [ebp - 0x21c]
push 0x208
mov dword [ebp - 4], esi
push esi
push eax
mov dword [ebp - 0x2f0], ebx
mov dword [ebp - 0x2e8], esi
call fcn.00517390
add esp, 0xc
lea eax, [ebp - 0x21c]
push esi
push esi
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
xor edx, edx
lea ecx, [ebp - 0x2d4]
call fcn.00414c2b
xor edi, edi
inc edi
push esi
mov dword [ebp - 4], edi
call fcn.00540b2c
pop ecx
mov dword [ebp - 0x2dc], eax
mov dword [ebp - 0x2d8], edx
call fcn.00409c54
push eax
mov ecx, ebx
call fcn.0040999a
lea eax, [ebp - 0x240]
mov dword [ebp - 0x2e8], edi
push eax
lea ecx, [ebp - 0x2dc]
call fcn.0041999f
or edi, 0xffffffff
test eax, eax
je 0x414deb
mov ebx, dword [eax]
mov dword [ebp - 0x2e0], ebx
jmp 0x414df1
mov dword [ebp - 0x2e0], edi
lea eax, [ebp - 0x264]
push eax
lea ecx, [ebp - 0x2dc]
call fcn.0041999f
test eax, eax
je 0x414e12
mov ebx, dword [eax + 4]
mov dword [ebp - 0x2e4], ebx
jmp 0x414e18
mov dword [ebp - 0x2e4], edi
lea eax, [ebp - 0x288]
push eax
lea ecx, [ebp - 0x2dc]
call fcn.0041999f
test eax, eax
je 0x414e31
mov edi, dword [eax + 8]
lea eax, [ebp - 0x2ac]
push eax
lea ecx, [ebp - 0x2dc]
call fcn.0041999f
test eax, eax
je 0x414e4c
mov ebx, dword [eax + 0xc]
jmp 0x414e4e
mov ebx, esi
lea eax, [ebp - 0x2d0]
push eax
lea ecx, [ebp - 0x2dc]
call fcn.0041999f
test eax, eax
je 0x414e68
mov esi, dword [eax + 0x10]
inc esi
push dword [ebp - 0x2d4]
lea ecx, [ebp - 0x2dc]
push dword [ebp - 0x2e0]
push dword [ebp - 0x2e4]
push edi
push ebx
push esi
call fcn.0041989d
mov esi, dword [ebp - 0x2ec]
push eax
lea eax, [ebp - 0x21c]
push eax
push 0x58c470
push esi
call fcn.00418437
mov ecx, dword [ebp - 0x2d4]
add esp, 0x28
add ecx, 0xfffffff0
call fcn.00409cc2
mov eax, esi
call fcn.0051109a
ret
Function at 0x4165e2
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
mov eax, dword [0x5b3074]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov ebx, ecx
push edi
push dword [ebx + 0xd0]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x416705
xor esi, esi
push esi
push dword [ebx + 0xd0]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x20a
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.00517390
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push dword [ebx + 0xd0]
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x416653
sub ecx, edx
sar ecx, 1
mov ecx, dword [ebx + 0xbc]
je 0x4166f5
test ecx, ecx
je 0x416705
mov eax, dword [ecx]
lea edx, [ebp - 0x218]
push edx
call dword [eax + 0x20]
lea esi, [ebx + 0x104]
lea edi, [ebp - 0x228]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push dword [ebp - 0x21c]
lea edi, [ebx + 0xbc]
mov ecx, dword [edi]
push dword [ebp - 0x220]
mov eax, dword [ecx]
call dword [eax + 0x24]
mov edx, dword [ebx + 0xc4]
test edx, edx
je 0x4166d7
mov ecx, dword [edi]
push dword [edx + 0x210]
mov eax, dword [ecx]
call dword [eax + 0x10]
mov eax, dword [edi]
mov ecx, dword [ebx + 0xc4]
mov esi, dword [eax]
call fcn.0040fb66
mov ecx, dword [edi]
push eax
call dword [esi + 0x2c]
push edi
lea ecx, [ebx + 0xb0]
call fcn.0041711a
and dword [edi], 0
push 1
push 0
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x416705
test ecx, ecx
je 0x4166ff
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [ebx + 0xbc], esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00510209
mov esp, ebp
pop ebp
ret