joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4088f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push str.SOFTWAREConexantMicTrayHotkey
push reloc.OLEAUT32.dll_SysReAllocString
mov esi, ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
cmp dword [0x5f0410], 0
je 0x4089cb
cmp dword [0x5f04b4], 0
je 0x4089cb
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0
push str.RenderRunning
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4089cb
push dword [ebp - 4]
push str.Key_change_to__d
push 0x1d
call fcn.00401fa0
mov eax, dword [ebp - 4]
add esp, 0xc
sub eax, 1
je 0x4089c1
sub eax, 1
jne 0x4089cb
mov eax, dword [esi + 0x654]
cmp dword [eax + 0x14], 0
jne 0x4089b5
push str.PlayWave_Active
push 0x1d
call fcn.00401fa0
mov ecx, dword [esi + 0x654]
add esp, 8
call fcn.0040d1d0
push 0x4e20
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [esi + 0x654]
call fcn.0040d370
mov dword [0x5f041c], 2
jmp 0x4089cb
mov dword [0x5f041c], 1
push dword [esi + 0x230]
mov ecx, esi
push dword [0x5f0410]
call fcn.0040af60
mov eax, dword [ebp - 8]
pop esi
test eax, eax
je 0x4089ed
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret
Function at 0x40a710
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5782bd
mov eax, dword fs:[0]
push eax
sub esp, 0x220
mov eax, dword [0x5eb10c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x5f0420]
test eax, eax
je 0x40a75c
cmp eax, 0xffffffff
je 0x40a75c
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x5f0420], 0
mov dword [ebp - 0x228], 0
mov dword [ebp - 0x21c], 0
mov dword [ebp - 0x220], 0
mov eax, dword [0x5f0048]
lea edx, [ebp - 0x220]
push edx
push 0xf
push 0
mov ecx, dword [eax]
push eax
mov dword [ebp - 4], 0
call dword [ecx + 0xc]
mov eax, dword [ebp - 0x220]
lea edx, [ebp - 0x224]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0xc]
mov ecx, dword [ebp - 0x21c]
test ecx, ecx
je 0x40a7c0
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [ebp - 0x21c]
xor edi, edi
cmp dword [ebp - 0x224], edi
jbe 0x40a83f
nop word [eax + eax]
mov eax, dword [ebp - 0x220]
lea edx, [ebp - 0x21c]
push edx
push edi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x10]
push 0x104
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x21c]
call fcn.00413320
push 0x208
mov esi, eax
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.00553d40
add esp, 0x18
cmp esi, 0x10
je 0x40a823
inc edi
cmp edi, dword [ebp - 0x224]
jb 0x40a7d0
jmp 0x40a839
push dword [ebp - 0x224]
push edi
push str.Find_HP_EndPoint__d_total__d_EndPoint
push 0x1d
call fcn.00401fa0
add esp, 0x10
mov ecx, dword [ebp - 0x21c]
mov eax, dword [ecx]
lea edx, [ebp - 0x228]
push edx
push ecx
call dword [eax + 0x14]
test eax, eax
je 0x40a85f
push str.Render_EndPoint_getId_fail
push 0x1d
call fcn.00401fa0
add esp, 8
push dword [ebp - 0x228]
push str.Render_EndPoint__s
push 0x1d
call fcn.00401fa0
add esp, 0xc
cmp dword [0x5f0438], 0
jne 0x40a8f5
push 0x3c
call fcn.00417a94
add esp, 4
mov dword [ebp - 0x22c], eax
mov byte [ebp - 4], 1
test eax, eax
je 0x40a8ac
push dword [ebp - 0x228]
mov ecx, eax
push dword [0x5f0048]
call fcn.0040cf50
mov esi, eax
jmp 0x40a8ae
xor esi, esi
mov byte [ebp - 4], 0
test esi, esi
je 0x40a8f5
cmp dword [esi + 0x14], 0
jne 0x40a8dc
push str.PlayWave_Active
push 0x1d
call fcn.00401fa0
add esp, 8
mov ecx, esi
call fcn.0040d1d0
mov dword [0x5f0438], 1
push 0
push 0
push esi
push 0x40a930
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x5f0420], eax
mov eax, dword [ebp - 0x220]
mov dword [ebp - 4], 0xffffffff
test eax, eax
je 0x40a90c
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0054eec4
mov esp, ebp
pop ebp
ret
Function at 0x40afc0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push edi
push str.CnxtNotificationClient
push 0
mov edi, ecx
call dword [sym.imp.USER32.dll_FindWindowW]
mov esi, eax
mov dword [ebp - 0x10], 0x58e560
lea eax, [ebp - 4]
mov dword [ebp - 0x14], 8
push eax
push str.SOFTWAREConexantMicTraySmartAudio
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push str.CopyDataMsg
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x18]
push eax
push dword [edi + 0x20]
push 0x4a
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp - 4]
pop edi
pop esi
test eax, eax
je 0x40b04a
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret 8

Function at 0x40b940
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push str.SOFTWAREConexantSA3Mixer
push reloc.OLEAUT32.dll_SysReAllocString
mov esi, ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov eax, dword [ebp - 8]
test eax, eax
je 0x40b9b8
lea ecx, [ebp - 0xc]
push ecx
lea ecx, [ebp - 4]
push ecx
push 0
push 0
push str.GlobalMicMuteStatus
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40b9a9
push dword [ebp - 4]
push str.Query_GlobalMicMuteStatus__d_n
push 0x1d
call fcn.00401fa0
add esp, 0xc
jmp 0x40b9b8
push str.Query_GlobalMicMuteStatus_Fail_n
push 0x1d
call fcn.00401fa0
add esp, 8
mov ecx, dword [0x5ea028]
cmp ecx, 0xffffffff
je 0x40ba0d
cmp dword [esi + 0x1a8], 0
jne 0x40b9ea
cmp dword [ebp - 4], 0
je 0x40b9ea
imul eax, dword [0x5ea150], 0x1020
push dword [eax + 0x5f1304]
lea eax, [eax + 0x5f0f04]
jmp 0x40ba00
imul eax, dword [0x5ea150], 0x1020
push dword [eax + 0x5f1708]
lea eax, [eax + 0x5f1308]
push eax
push ecx
lea ecx, [esi + 0x784]
call fcn.00404e60
mov eax, dword [ebp - 8]
pop esi
test eax, eax
je 0x40ba1c
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret
Function at 0x40ba40
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 4]
push esi
push edi
push eax
push str.SOFTWAREConexantMicTray
push reloc.OLEAUT32.dll_SysReAllocString
mov byte [ebp - 0xc], bl
mov dword [ebp - 4], 0
mov dword [ebp + 8], 0
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 8]
push eax
lea eax, [ebp + 8]
push eax
push 0
push 0
push str.GPIO
push dword [ebp - 4]
call edi
mov ecx, dword [0x5f06dc]
mov esi, 1
test ebx, ebx
je 0x40baa9
mov ecx, dword [0x5ea14c]
shl esi, cl
and esi, dword [ebp + 8]
test eax, eax
js 0x40bb23
lea eax, [ebp - 8]
push eax
lea eax, [ebp + 8]
push eax
push 0
push 0
test ebx, ebx
jne 0x40bac9
push str.SpkMuteLED
jmp 0x40bace
push str.MicMuteLED
push dword [ebp - 4]
call edi
mov ecx, dword [ebp + 8]
test esi, esi
je 0x40bae5
test ecx, ecx
setne al
dec al
and al, 2
jmp 0x40baf2
cmp ecx, 1
sete al
lea eax, [eax*2 + 1]
mov byte [ebp - 0xb], al
movzx eax, al
push eax
push ecx
push esi
test ebx, ebx
jne 0x40bb06
push str.EPType_Spk_0x_x__read_0x_x__invert_to_reg_0x_x
jmp 0x40bb0b
push str.EPType_Mic_0x_x__read_0x_x__invert_to_reg_0x_x
push 0x1d
call fcn.00401fa0
mov ecx, dword [0x5f0000]
add esp, 0x14
push dword [ebp - 0xc]
call fcn.00403e60
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
test eax, eax
je 0x40bb34
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret
Function at 0x40d1d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5783b8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x5eb10c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xor edi, edi
call fcn.004227a4
mov ecx, eax
test ecx, ecx
je 0x40d362
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
push dword [esi + 0x38]
lea eax, [ebp - 0x10]
mov dword [ebp - 4], edi
push str.CPlaywave__s__Active_n
push eax
call fcn.00406050
add esp, 0xc
cmp dword [esi + 0x14], edi
je 0x40d23c
mov edi, 0x800700b7
jmp 0x40d32c
mov ecx, dword [esi + 8]
test ecx, ecx
jne 0x40d267
push str.m_pEnumerator
push 0x79
push str.c:usersweisdocuments1_cnxtprojectcodemictraymictray_audkjplaywave.cpp
push str._n_s__d__:__NULL_POINTER___s_n
push ecx
mov edi, 0x80004003
call fcn.00401fa0
add esp, 0x14
jmp 0x40d32c
cmp dword [esi + 0xc], 0
lea ebx, [esi + 0xc]
je 0x40d27a
mov edi, 0x800700b7
jmp 0x40d32c
mov eax, dword [ecx]
push ebx
push dword [esi + 0x34]
push ecx
call dword [eax + 0x14]
cmp dword [ebx], 0
jne 0x40d293
mov edi, 0x8004080b
jmp 0x40d32c
cmp dword [esi + 0x1c], 0
mov ebx, dword [sym.imp.KERNEL32.dll_CreateEventW]
jne 0x40d2ac
push 0
push 0
push 0
push 0
call ebx
mov dword [esi + 0x1c], eax
cmp dword [esi + 0x20], 0
jne 0x40d2bf
push 0
push 0
push 0
push 0
call ebx
mov dword [esi + 0x20], eax
cmp dword [esi + 4], 0
je 0x40d2cc
mov edi, 0x8000ffff
jmp 0x40d32c
lea eax, [ebp - 0x14]
push eax
push 0
push esi
push 0x40df40
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 4], eax
test eax, eax
jne 0x40d307
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [esi + 0x38]
mov edi, eax
lea eax, [ebp - 0x10]
push str.CPlaywave__s__CreateThread___failed._n
push eax
call fcn.00406050
add esp, 0xc
jmp 0x40d31e
push dword [ebp - 0x14]
lea eax, [ebp - 0x10]
push dword [esi + 0x38]
push str.CPlaywave__s__CreateThread__x__._n
push eax
call fcn.00406050
add esp, 0x10
mov ecx, esi
mov dword [esi + 0x14], 1
call fcn.0040d8d0
mov edx, dword [ebp - 0x10]
or eax, 0xffffffff
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40d34e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.004023b0
int3
Function at 0x413720
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57898b
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x5eb10c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x21c], esi
push 0
mov dword [ebp - 0x220], esi
call fcn.00428ea1
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
push 0
push eax
mov dword [esi], vtable.CTrayApp.0
mov dword [esi + 0xcc], 0
call fcn.00553d40
push str.c:usersPublicMicTray.log
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.0055695e
add esp, 0x18
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
call fcn.004093c0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0054eec4
mov esp, ebp
pop ebp
ret
Function at 0x414930
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x578a6a
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x5eb10c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
call fcn.00426e4a
push 0x1f
push 0x591000
mov eax, dword [eax + 8]
push eax
call fcn.00401fb0
call fcn.0040a9b0
mov ecx, ebx
call fcn.00414b40
test eax, eax
je 0x414996
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [0x5ea12c]
mov ecx, dword [0x5ea130]
mov dword [0x5f57c4], 0
cmp esi, ecx
jae 0x4149ca
mov eax, dword [esi]
test eax, eax
je 0x4149c3
mov eax, dword [eax + 0x1c]
push 1
call eax
mov ecx, dword [0x5ea130]
add esi, 4
cmp esi, ecx
jb 0x4149b0
mov ecx, ebx
call fcn.00414270
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_GetPriorityClass]
push eax
push 0x592574
push 0x1d
call fcn.00401fa0
push 0x8b8
call fcn.00417a94
add esp, 0x10
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x414a11
mov ecx, eax
call fcn.00405270
mov esi, eax
jmp 0x414a13
xor esi, esi
mov dword [ebx + 0x20], esi
cmp dword [0x5f04d0], 0
mov dword [ebp - 4], 0xffffffff
je 0x414a32
push dword [0x5ea030]
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esi]
mov ecx, esi
push 0
push 0
push 0
push 0
push 0x5ea518
push 0xcf0000
push 0x58bbc4
push 0
call dword [eax + 0x164]
test eax, eax
je 0x414982
cmp dword [0x5f04d0], 0
mov ecx, dword [ebx + 0x20]
je 0x414b0f
push 5
call fcn.004216a7
mov eax, dword [ebx + 0x20]
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_UpdateWindow]
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0
mov edi, eax
push esi
mov dword [ebp - 0x14], edi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push 1
push edi
mov edi, dword [sym.imp.USER32.dll_AttachThreadInput]
mov ebx, eax
push ebx
call edi
mov eax, dword [ebp - 0x10]
mov esi, dword [sym.imp.USER32.dll_SetWindowPos]
push 3
push 0
mov eax, dword [eax + 0x20]
push 0
push 0
push 0
push 0xffffffffffffffff
push dword [eax + 0x20]
call esi
mov eax, dword [ebp - 0x10]
push 3
push 0
push 0
mov eax, dword [eax + 0x20]
push 0
push 0
push 0xfffffffffffffffe
push dword [eax + 0x20]
call esi
mov esi, dword [ebp - 0x10]
mov eax, dword [esi + 0x20]
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 0
push dword [ebp - 0x14]
push ebx
call edi
mov eax, dword [esi + 0x20]
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [esi + 0x20]
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_SetActiveWindow]
jmp 0x414b22
push 0
call fcn.004216a7
mov eax, dword [ebx + 0x20]
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x414b40
Capabilities:
Get session user name
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x5eb10c]
xor eax, ebp
mov dword [ebp - 4], eax
movups xmm0, xmmword [str.DTMLLUAdminUser]
push esi
push edi
movups xmmword [ebp - 0x24], xmm0
push 0xfffe
movups xmm0, xmmword [0x5925c8]
xor esi, esi
mov dword [ebp - 0x2c], 0x7fff
movups xmmword [ebp - 0x14], xmm0
call fcn.00417ad1
mov edi, eax
add esp, 4
test edi, edi
je 0x414c1f
lea eax, [ebp - 0x2c]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x414bb0
push 0xf
lea eax, [ebp - 0x24]
push eax
push edi
call fcn.0055a609
add esp, 0xc
mov ecx, 1
test eax, eax
cmove esi, ecx
push edi
call fcn.00417acc
add esp, 4
test esi, esi
je 0x414c1f
cmp dword [0x5f049c], 0
je 0x414c1f
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], 0
push eax
push str.SOFTWAREConexantAFA
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x414c1a
push 4
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x30], 1
push ecx
push 4
push 0
push str.DTMRunning
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x414c1a
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x28], 0
call fcn.00412d20
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.0054eec4
mov esp, ebp
pop ebp
ret
Function at 0x4155a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x578b06
mov eax, dword fs:[0]
push eax
sub esp, 0x428
mov eax, dword [0x5eb10c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x430], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], 0
mov dword [ebp - 0x418], 0
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push 0x60
push 0
push edi
mov byte [ebp - 4], 1
call ebx
mov esi, eax
mov dword [ebp - 0x424], esi
test esi, esi
jne 0x41564c
push 2
push eax
push edi
call ebx
mov esi, eax
mov dword [ebp - 0x424], eax
test esi, esi
jne 0x41564c
call fcn.004141f0
mov edi, eax
jmp 0x415776
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x41566f
call fcn.004141f0
jmp 0x415769
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [ebp - 0x420], ebx
test ebx, ebx
jne 0x41568d
call fcn.004141f0
jmp 0x415769
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov dword [ebp - 0x41c], edi
lea eax, [edi + 1]
cmp eax, edi
jae 0x4156ae
mov edi, 0x8007000e
jmp 0x41576b
mov ecx, 2
mov byte [ebp - 4], 2
mul ecx
test edx, edx
ja 0x4157b0
jb 0x4156cc
cmp eax, 0xffffffff
ja 0x4157b0
cmp eax, 0x400
jbe 0x4156e1
push eax
lea ecx, [ebp - 0x418]
call fcn.00414110
jmp 0x415712
lea eax, [ebp - 0x414]
mov dword [ebp - 0x418], eax
jmp 0x415712
cmp dword [ebp - 0x418], 0
mov dword [ebp - 4], 1
jne 0x415729
mov edi, 0x8007000e
jmp 0x41576b
push edi
push dword [ebp - 0x418]
push edi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
jne 0x415749
call fcn.004141f0
jmp 0x415769
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x42c]
push dword [ebp - 0x418]
call fcn.00415400
mov edi, eax
test esi, esi
je 0x415776
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x415790
lea ecx, [ebp - 0x418]
call fcn.00414850
nop
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0054eec4
mov esp, ebp
pop ebp
ret 0x10
push 0x80070216
call fcn.004023b0
int3
Function at 0x416cd0
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1008
call fcn.0054ef10
mov eax, dword [0x5eb10c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x5f06d8]
push ebx
mov ebx, dword [ebp + 8]
test eax, eax
je 0x416d20
push ebx
push eax
call fcn.00416dc0
add esp, 8
test eax, eax
je 0x416d16
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0054eec4
mov esp, ebp
pop ebp
ret
mov dword [0x5f06d8], 0
cmp word [ebx], 0
push esi
push edi
je 0x416d71
lea eax, [ebp - 0x1008]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
call sub.KERNEL32.dll_K32EnumProcesses
test eax, eax
je 0x416d71
mov edi, dword [ebp - 0x1008]
xor esi, esi
shr edi, 2
test edi, edi
je 0x416d71
mov eax, dword [ebp + esi*4 - 0x1004]
test eax, eax
je 0x416d6c
push ebx
push eax
call fcn.00416dc0
add esp, 8
test eax, eax
jne 0x416d93
inc esi
cmp esi, edi
jb 0x416d53
push str.Not_FindMatchProcess_n
push 0x1d
call fcn.00401fa0
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0054eec4
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + esi*4 - 0x1004]
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov dword [0x5f06d8], eax
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.0054eec4
mov esp, ebp
pop ebp
ret

Function at 0x416dc0
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x5eb10c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x592bd0]
movups xmm0, xmmword [str._unknown_]
push esi
push edi
mov edi, dword [ebp + 8]
push 0x1f4
mov dword [ebp - 0x1fc], eax
lea eax, [ebp - 0x1f8]
push 0
push eax
movups xmmword [ebp - 0x20c], xmm0
call fcn.00553d40
add esp, 0xc
push edi
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x416ebc
lea eax, [ebp - 0x214]
push eax
push 4
lea eax, [ebp - 0x210]
push eax
push esi
call sub.KERNEL32.dll_K32EnumProcessModules
test eax, eax
je 0x416e51
push 0x104
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x210]
push esi
call sub.KERNEL32.dll_K32GetModuleBaseNameW
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x20c]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x416e87
test dx, dx
je 0x416e83
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x416e87
add eax, 4
add ecx, 4
test dx, dx
jne 0x416e61
xor eax, eax
jmp 0x416e8c
sbb eax, eax
or eax, 1
test eax, eax
jne 0x416ec2
push edi
lea eax, [ebp - 0x20c]
push eax
push str._s___PID:__u__n
push 0x1d
call fcn.00401fa0
add esp, 0x10
mov eax, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0054eec4
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.0054eec4
mov esp, ebp
pop ebp
ret
Function at 0x41bdb5
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 4], ecx
mov esi, edi
cmp dword [ebp + 8], esi
je 0x41bdfa
call fcn.00426e4a
push 0xf0
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x41bdfa
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x41be16
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.0042d7c5
mov ebx, eax
test edi, edi
je 0x41be14
test esi, esi
je 0x41be14
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x41c850
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
je 0x41c90e
cmp dword [esi + 0x20], 0
je 0x41c90e
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x41c90e
cmp dword [ebp + 8], 0
je 0x41c90e
xor eax, eax
mov ebx, eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], ebx
mov edi, eax
call fcn.00426e4a
push 0x593ec0
push dword [ebp + 8]
mov eax, dword [eax + 0xc]
push eax
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x41c8df
mov edi, dword [ebp - 0xc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp - 0x10]
mov dword [ebp - 4], eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x41c90e
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov dword [ebp - 8], eax
push dword [ebp - 4]
push ebx
push esi
call fcn.0042e359
add esp, 0xc
mov ebx, eax
cmp dword [ebp - 8], 0
je 0x41c8ff
test edi, edi
je 0x41c8ff
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
test ebx, ebx
je 0x41c90a
mov ecx, esi
call fcn.0041c5f2
mov eax, ebx
jmp 0x41c910
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x421327
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x579088
call fcn.0054f639
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x74], ebx
jne 0x42134d
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x4213ad
call fcn.004227a4
push eax
lea ecx, [ebp - 0x10]
call fcn.00417aef
mov edi, dword [edi + 0x74]
lea ecx, [ebp - 0x10]
push ecx
mov dword [ebp - 4], ebx
mov eax, dword [edi]
mov esi, dword [eax + 0x8c]
mov ecx, esi
call dword [0x587a38]
mov ecx, edi
call esi
mov esi, dword [ebp + 8]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push esi
call fcn.0055a2e9
push eax
call fcn.00414080
add esp, 0x14
test esi, esi
je 0x4213a0
push esi
call fcn.0055a924
pop ecx
mov ebx, eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00418b85
mov eax, ebx
call fcn.0054f602
ret 8