joyce8/EMBER2024-capa huggingface dataset:
Function at 0x50c84e
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55be05
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x15c
push ebx
push esi
push edi
push 1
push 0x104
mov eax, dword [ebp + 8]
push eax
call fcn.004eff56
test eax, eax
jne 0x50c897
push 0x21e
push str.filecore.cpp
call fcn.00542d30
test eax, eax
je 0x50c897
int3
xor ecx, ecx
test ecx, ecx
jne 0x50c86f
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ebp + 8]
push eax
push 0x104
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
test eax, eax
jne 0x50c8ed
mov edx, dword [ebp + 0xc]
movsx eax, byte [edx]
test eax, eax
je 0x50c8d3
mov ecx, dword [ebp + 0xc]
push ecx
push str.Warning:_could_not_parse_the_path__s._n
call fcn.004effc5
add esp, 8
push 0x104
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
xor eax, eax
jmp 0x50c9e0
lea ecx, [ebp - 0x1c]
call fcn.0050d7fa
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0050c9f3
push 0
push 0
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x10]
push ecx
push 0
push 0
push 0
lea ecx, [ebp - 0x1c]
call fcn.0053f6e2
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
jne 0x50c965
lea ecx, [ebp - 0x1c]
call fcn.0053f6e2
push eax
push str.Warning:_could_not_get_volume_information__s._n
call fcn.004effc5
add esp, 8
mov dword [ebp - 0x164], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.0050dbc2
mov eax, dword [ebp - 0x164]
jmp 0x50c9e0
mov edx, dword [ebp - 0x18]
and edx, 2
test edx, edx
jne 0x50c979
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_CharUpperA]
mov ecx, dword [ebp - 0x18]
and ecx, 4
test ecx, ecx
jne 0x50c9c1
lea edx, [ebp - 0x15c]
push edx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 0xffffffff
je 0x50c9c1
mov ecx, dword [ebp - 0x160]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
lea edx, [ebp - 0x130]
push edx
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp - 0x168], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.0050dbc2
mov eax, dword [ebp - 0x168]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x511279
Capabilities:
Check if file exists
Get file attributes
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 0x2c], ecx
push 0x5e
push str.filest.cpp
mov eax, dword [ebp - 0x2c]
push eax
call fcn.0050b1e0
push 0x118
push 0
mov ecx, dword [ebp + 8]
push ecx
call fcn.004d13f0
add esp, 0xc
push 0x104
mov ecx, dword [ebp - 0x2c]
add ecx, 0xc
call fcn.0053f6e2
push eax
mov edx, dword [ebp + 8]
add edx, 0x12
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 4], 0xffffffff
je 0x511401
lea ecx, [ebp - 0x18]
push ecx
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
jne 0x5112f4
xor eax, eax
jmp 0x511406
push 0
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, dword [ebp + 8]
mov dword [edx + 0xc], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 0xc], 0xffffffff
jne 0x511319
xor eax, eax
jmp 0x511406
mov ecx, dword [ebp - 0x2c]
add ecx, 0xc
call fcn.0053f6c4
test eax, eax
je 0x511331
mov ecx, dword [ebp + 8]
mov byte [ecx + 0x10], 0
jmp 0x51137a
mov ecx, dword [ebp - 0x2c]
add ecx, 0xc
call fcn.0053f6e2
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xffffffff
jne 0x511355
mov edx, dword [ebp + 8]
mov byte [edx + 0x10], 0
jmp 0x51137a
mov eax, dword [ebp + 8]
mov cl, byte [ebp - 0x1c]
mov byte [eax + 0x10], cl
mov edx, dword [ebp - 0x1c]
and dl, 0
test edx, edx
je 0x51137a
push str.Warning:_CFile::GetStatus___returns_m_attribute_without_high_order_flags._n
push 0x5969dc
call fcn.004effc5
add esp, 8
push 0xffffffffffffffff
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x20]
call fcn.004f02bf
push eax
mov ecx, dword [ebp + 8]
call fcn.0053fcf5
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x24]
call fcn.004f02bf
push eax
mov ecx, dword [ebp + 8]
add ecx, 8
call fcn.0053fcf5
push 0xffffffffffffffff
lea edx, [ebp - 0x18]
push edx
lea ecx, [ebp - 0x28]
call fcn.004f02bf
push eax
mov ecx, dword [ebp + 8]
add ecx, 4
call fcn.0053fcf5
mov ecx, dword [ebp + 8]
call fcn.0053fd27
test eax, eax
jne 0x5113e0
mov eax, dword [ebp + 8]
add eax, 4
push eax
mov ecx, dword [ebp + 8]
call fcn.0053fcf5
mov ecx, dword [ebp + 8]
add ecx, 8
call fcn.0053fd27
test eax, eax
jne 0x511401
mov ecx, dword [ebp + 8]
add ecx, 4
push ecx
mov ecx, dword [ebp + 8]
add ecx, 8
call fcn.0053fcf5
mov eax, 1
mov esp, ebp
pop ebp
ret 4
Function at 0x518a46
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
add ecx, 0x20
call fcn.0053f6e2
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
and eax, 1
test eax, eax
je 0x518a9c
push 1
push 0
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov ecx, dword [ebp - 8]
call dword [edx + 0xa0]
test eax, eax
jne 0x518a9a
push str.Warning:_File_save_with_new_name_failed._n
push 0x593ab0
call fcn.004effc5
add esp, 8
xor eax, eax
jmp 0x518ad7
jmp 0x518ad2
push 1
mov ecx, dword [ebp - 8]
add ecx, 0x20
call fcn.0053f6e2
push eax
mov eax, dword [ebp - 8]
mov edx, dword [eax]
mov ecx, dword [ebp - 8]
call dword [edx + 0xa0]
test eax, eax
jne 0x518ad2
push str.Warning:_File_save_failed._n
push 0x593ad0
call fcn.004effc5
add esp, 8
xor eax, eax
jmp 0x518ad7
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x51b7c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
cmp dword [ebp + 8], 0
jne 0x51b7e2
cmp dword [0x60f484], 0
je 0x51b7e2
mov eax, dword [0x60f488]
jmp 0x51b995
mov dword [0x60f484], 1
xor eax, eax
mov ax, word [0x60f490]
test eax, eax
jne 0x51b825
push str.MSH_SCROLL_LINES_MSG
call dword [sym.imp.USER32.dll_RegisterWindowMessageA]
mov dword [0x60f48c], eax
cmp dword [0x60f48c], 0
jne 0x51b81c
mov word [0x60f490], 1
jmp 0x51b825
mov word [0x60f490], 2
xor ecx, ecx
mov cx, word [0x60f490]
cmp ecx, 2
jne 0x51b88c
mov dword [ebp - 0x98], 0
push str.Magellan_MSWHEEL
push str.MouseZ
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0
je 0x51b88c
cmp dword [0x60f48c], 0
je 0x51b88c
push 0
push 0
mov edx, dword [0x60f48c]
push edx
mov eax, dword [ebp - 0x98]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [0x60f488], eax
mov eax, dword [0x60f488]
jmp 0x51b995
push 0x94
push 0
lea ecx, [ebp - 0x94]
push ecx
call fcn.004d13f0
add esp, 0xc
mov dword [ebp - 0x94], 0x94
mov dword [0x60f488], 3
lea edx, [ebp - 0x94]
push edx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x51b8d1
mov eax, dword [0x60f488]
jmp 0x51b995
cmp dword [ebp - 0x84], 1
je 0x51b8e7
cmp dword [ebp - 0x84], 2
jne 0x51b96d
cmp dword [ebp - 0x90], 4
jae 0x51b96d
lea eax, [ebp - 0x9c]
push eax
push 1
push 0
push str.Control_PanelDesktop
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x51b96b
mov dword [ebp - 0x124], pe_nt_image_headers32
lea ecx, [ebp - 0x124]
push ecx
lea edx, [ebp - 0x11c]
push edx
lea eax, [ebp - 0x120]
push eax
push 0
push str.WheelScrollLines
mov ecx, dword [ebp - 0x9c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x51b95e
push 0xa
push 0
lea edx, [ebp - 0x11c]
push edx
call fcn.004d6230
add esp, 0xc
mov dword [0x60f488], eax
mov eax, dword [ebp - 0x9c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x51b990
cmp dword [ebp - 0x84], 2
jne 0x51b990
cmp dword [ebp - 0x90], 4
jb 0x51b990
push 0
push 0x60f488
push 0
push 0x68
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
mov eax, dword [0x60f488]
mov esp, ebp
pop ebp
ret
Function at 0x51f775
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
lea eax, [ebp + 0x18]
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp + 8]
call fcn.0051f560
mov dword [ebp - 0x28], eax
mov edx, dword [ebp + 8]
cmp dword [edx], 0
je 0x51f7d4
push 0x20
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x24]
push ecx
call fcn.0051f7fe
test eax, eax
jne 0x51f7d2
push 0xffffffffffffffff
push 0
mov edx, dword [ebp + 0x14]
push edx
call fcn.00520b24
mov ecx, dword [ebp + 8]
call fcn.0051f67f
jmp 0x51f7f3
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
lea edx, [ebp - 0x24]
push edx
call dword [sym.imp.USER32.dll_wvsprintfA]
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
call fcn.0051b4e3
mov dword [ebp - 4], 0
mov esp, ebp
pop ebp
ret

Function at 0x51fbcc
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
call fcn.0051f560
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
cmp dword [ecx], 0
je 0x51fc20
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
add eax, 1
push eax
mov ecx, dword [ebp - 8]
push ecx
mov ecx, dword [ebp + 0x10]
call fcn.0050e4f4
push eax
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0xffffffffffffffff
mov ecx, dword [ebp + 0x10]
call fcn.0050e480
jmp 0x51fc32
mov ecx, dword [ebp + 0x10]
call fcn.0053f6e2
push eax
mov eax, dword [ebp - 4]
push eax
call fcn.0051b4e3
mov esp, ebp
pop ebp
ret 0xc

Function at 0x51ff91
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
call fcn.0051f5ae
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
cmp dword [ecx], 0
je 0x52000a
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x51ffe1
mov eax, dword [ebp - 8]
add eax, 1
push eax
mov ecx, dword [ebp - 8]
push ecx
mov ecx, dword [ebp + 0x10]
call fcn.0050e4f4
push eax
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x51fffe
push 0x100
push 0xff
mov ecx, dword [ebp + 0x10]
call fcn.0050e378
push eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0xffffffffffffffff
mov ecx, dword [ebp + 0x10]
call fcn.0050e480
jmp 0x52003b
mov ecx, dword [ebp + 0x10]
call fcn.0053f6e2
push eax
push 0xffffffffffffffff
push 0x14d
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 0xffffffff
jne 0x52003b
mov ecx, dword [ebp + 0x10]
call fcn.0053f6e2
push eax
mov edx, dword [ebp - 4]
push edx
call fcn.0051b4e3
mov esp, ebp
pop ebp
ret 0xc
Function at 0x5211a0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov dword [ebp - 0x1c], ecx
cmp dword [ebp + 8], 0
jne 0x5211c6
push 0x10a
push str.appui3.cpp
call fcn.00542d30
test eax, eax
je 0x5211c6
int3
xor eax, eax
test eax, eax
jne 0x5211ac
cmp dword [ebp + 0xc], 0
jne 0x5211e6
push 0x10b
push str.appui3.cpp
call fcn.00542d30
test eax, eax
je 0x5211e6
int3
xor ecx, ecx
test ecx, ecx
jne 0x5211cc
mov edx, dword [ebp - 0x1c]
cmp dword [edx + 0x80], 0
je 0x521244
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x1c]
call fcn.00552272
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x521214
xor eax, eax
jmp 0x52129c
push 4
lea ecx, [ebp + 0x10]
push ecx
push 4
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp dword [ebp - 8], 0
sete al
jmp 0x52129c
mov edx, dword [ebp - 0x1c]
cmp dword [edx + 0x94], 0
jne 0x521264
push 0x11a
push str.appui3.cpp
call fcn.00542d30
test eax, eax
je 0x521264
int3
xor eax, eax
test eax, eax
jne 0x521244
mov ecx, dword [ebp + 0x10]
push ecx
push 0x593e5c
lea edx, [ebp - 0x18]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax + 0x94]
push ecx
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x5212a5
Capabilities:
Delete registry key
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 0x14], ecx
cmp dword [ebp + 8], 0
jne 0x5212cb
push 0x126
push str.appui3.cpp
call fcn.00542d30
test eax, eax
je 0x5212cb
int3
xor eax, eax
test eax, eax
jne 0x5212b1
mov ecx, dword [ebp - 0x14]
cmp dword [ecx + 0x80], 0
je 0x5213b6
cmp dword [ebp + 0xc], 0
jne 0x52131f
mov ecx, dword [ebp - 0x14]
call fcn.0055216c
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x5212ff
xor eax, eax
jmp 0x521429
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x5213ab
cmp dword [ebp + 0x10], 0
jne 0x52135e
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x14]
call fcn.00552272
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x521341
xor eax, eax
jmp 0x521429
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x5213ab
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x14]
call fcn.00552272
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x52137a
xor eax, eax
jmp 0x521429
mov ecx, dword [ebp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
push eax
mov edx, dword [ebp + 0x10]
push edx
push 1
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp dword [ebp - 4], 0
sete al
jmp 0x521429
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x94], 0
jne 0x5213d6
push 0x14a
push str.appui3.cpp
call fcn.00542d30
test eax, eax
je 0x5213d6
int3
xor ecx, ecx
test ecx, ecx
jne 0x5213b6
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x94]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 0xfff
jl 0x521407
push 0x14b
push str.appui3.cpp
call fcn.00542d30
test eax, eax
je 0x521407
int3
xor ecx, ecx
test ecx, ecx
jne 0x5213dc
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x94]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x521590
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
cmp dword [ebp + 0x10], 0
jne 0x5215b0
push 0x32
push str.dlgfloat.cpp
call fcn.00542d30
test eax, eax
je 0x5215b0
int3
xor eax, eax
test eax, eax
jne 0x521599
mov ecx, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp + 8]
call fcn.0051f560
mov dword [ebp - 0x24], eax
mov edx, dword [ebp + 8]
cmp dword [edx], 0
je 0x521624
push 0x20
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea edx, [ebp - 0x2c]
push edx
lea eax, [ebp - 0x20]
push eax
call fcn.00521657
test eax, eax
jne 0x521604
push 0xffffffffffffffff
push 0
push 0xf111
call fcn.00520b24
mov ecx, dword [ebp + 8]
call fcn.0051f67f
cmp dword [ebp + 0x1c], 6
jne 0x521614
fld qword [ebp - 0x2c]
mov ecx, dword [ebp + 0x10]
fstp dword [ecx]
jmp 0x521622
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp - 0x2c]
mov dword [edx], eax
mov ecx, dword [ebp - 0x28]
mov dword [edx + 4], ecx
jmp 0x52164e
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x1c]
push ecx
push 0x593e80
lea edx, [ebp - 0x20]
push edx
call fcn.004cf7e0
add esp, 0x14
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call fcn.0051b4e3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x533bad
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
push 5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindow]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x533c9c
mov eax, dword [ebp - 4]
push eax
call fcn.005013f0
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x533c88
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x1c]
cmp edx, dword [ebp - 4]
je 0x533c88
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x1c]
push edx
call fcn.005337cb
test eax, eax
je 0x533c88
push 0xfffffffffffffff0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov dword [ebp - 0xc], eax
cmp dword [ebp + 8], 0
jne 0x533c4e
mov ecx, dword [ebp - 0xc]
and ecx, 0x18000000
cmp ecx, 0x10000000
jne 0x533c4e
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x24]
or ecx, 2
mov edx, dword [ebp - 8]
mov dword [edx + 0x24], ecx
jmp 0x533c88
cmp dword [ebp + 8], 0
je 0x533c88
mov eax, dword [ebp - 0xc]
and eax, 0x18000000
test eax, eax
jne 0x533c88
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x24]
and edx, 2
test edx, edx
je 0x533c88
push 4
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x24]
and edx, 0xfffffffd
mov eax, dword [ebp - 8]
mov dword [eax + 0x24], edx
push 2
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_GetWindow]
mov dword [ebp - 4], eax
jmp 0x533bc8
mov esp, ebp
pop ebp
ret 4
Function at 0x5393d4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
and ecx, 1
test ecx, ecx
je 0x5393f8
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xc]
mov dword [ebp - 4], eax
jmp 0x539432
push 5
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x53944c
push 0xe1
push str.dlgprop.cpp
call fcn.00542d30
test eax, eax
je 0x53944c
int3
xor eax, eax
test eax, eax
jne 0x539432
mov ecx, dword [ebp - 4]
xor edx, edx
mov dx, word [ecx + 2]
cmp edx, 0xffff
je 0x539527
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
and eax, 0x80000000
test eax, eax
je 0x5394f7
push 0x595e68
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x5394a4
push 0xfc
push str.dlgprop.cpp
call fcn.00542d30
test eax, eax
je 0x5394a4
int3
xor ecx, ecx
test ecx, ecx
jne 0x53948a
cmp dword [ebp - 0x18], 0
je 0x5394f5
push str.DllGetVersion
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x5394eb
mov eax, 1
test eax, eax
je 0x5394e5
push 0x101
push str.dlgprop.cpp
call fcn.00542d30
test eax, eax
je 0x5394e5
int3
xor ecx, ecx
test ecx, ecx
jne 0x5394c8
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x539527
mov eax, dword [ebp - 0x14]
and eax, 0xff
cmp eax, 3
jne 0x539527
mov ecx, 1
test ecx, ecx
je 0x539521
push 0x108
push str.dlgprop.cpp
call fcn.00542d30
test eax, eax
je 0x539521
int3
xor edx, edx
test edx, edx
jne 0x539504
call fcn.0055308a
cmp dword [eax + 0x1038], 0
je 0x539544
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0x20]
call fcn.00539389
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.005395ad
add esp, 8
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x20]
cmp dword [eax + 0x44], 0
je 0x539577
mov ecx, dword [ebp - 0x20]
mov edx, dword [ecx + 0x44]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x44], 0
cmp dword [ebp - 8], 0
je 0x53958c
mov ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 8]
mov dword [edx + 0x44], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 4]
mov dword [ecx + 0xc], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
or ecx, 1
mov edx, dword [ebp + 8]
mov dword [edx + 4], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x549956
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x28], 0
jne 0x54997d
push 0x3de
push str.afxwin2.inl
call fcn.00542d30
test eax, eax
je 0x54997d
int3
xor ecx, ecx
test ecx, ecx
jne 0x549960
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x551909
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55bf9e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x118
mov dword [ebp - 0x124], ecx
mov dword [ebp - 0x118], 0
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp + 0xc]
call fcn.0053f6e2
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x551a0e
push 0xff
lea edx, [ebp - 0x114]
push edx
push 0
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x5519e6
lea ecx, [ebp - 0x114]
push ecx
lea ecx, [ebp - 0x120]
call fcn.0050dc58
mov dword [ebp - 4], 0
lea edx, [ebp - 0x120]
push edx
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x124]
call fcn.00551909
mov dword [ebp - 0x14], eax
xor ecx, ecx
cmp dword [ebp - 0x14], 0
setne cl
mov byte [ebp - 0x11c], cl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x120]
call fcn.0050dbc2
mov edx, dword [ebp - 0x11c]
and edx, 0xff
test edx, edx
je 0x5519e1
jmp 0x5519e6
jmp 0x55195b
cmp dword [ebp - 0x14], 0x103
je 0x5519f8
cmp dword [ebp - 0x14], 0x3f2
jne 0x551a0e
mov ecx, dword [ebp + 0xc]
call fcn.0053f6e2
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8