joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42c348
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x4aa98c
call fcn.004a8fb4
sub esp, 0x18
mov eax, dword [0x4dd02c]
push ebx
push esi
push edi
mov ebx, ecx
xor edi, edi
mov esi, 0x4dd02c
mov ecx, esi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x10], edi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], edi
mov eax, dword [0x4dd02c]
mov ecx, esi
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x1c], esi
push edi
push edi
push 2
push edi
push 1
push 0x40000000
mov byte [ebp - 4], 1
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x14], eax
je 0x42c460
mov eax, dword [ebx]
lea ecx, [ebp - 0x18]
push ecx
mov ecx, ebx
call dword [eax + 4]
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
lea eax, [ebp - 0x10]
push eax
push 3
lea eax, [ebp + 8]
push eax
push dword [ebp - 0x14]
mov byte [ebp + 8], 0xef
mov byte [ebp + 9], 0xbb
mov byte [ebp + 0xa], 0xbf
call ebx
test eax, eax
je 0x42c457
cmp dword [ebp - 0x10], 3
jne 0x42c457
call dword [0x4d80ac]
mov eax, dword [ebp - 0x18]
cmp eax, edi
mov dword [ebp - 0x24], eax
je 0x42c405
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x42c409
xor eax, eax
jmp 0x42c425
lea esi, [eax + eax]
mov eax, esi
call fcn.00488eb0
mov eax, esp
push 0xfde9
push esi
push dword [ebp - 0x24]
mov esi, eax
call fcn.0042d1fc
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00408fcf
mov esi, dword [ebp - 0x1c]
mov eax, dword [esi - 0xc]
push edi
lea ecx, [ebp - 0x10]
push ecx
push eax
push esi
push dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
call ebx
test eax, eax
je 0x42c457
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x10], eax
jne 0x42c457
mov dword [ebp - 0x20], 1
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esi - 0x10]
call fcn.004079f6
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.004079f6
mov eax, dword [ebp - 0x20]
lea esp, [ebp - 0x30]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x42c5c6
Capabilities:
Create directory

Disassembly:
mov eax, 0x4ab374
call fcn.004a8fb4
sub esp, 0x38
push ebx
push esi
push edi
push dword [ebp + 8]
lea eax, [ebp - 0x28]
call fcn.0040ad9e
lea eax, [ebp + 8]
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x28]
mov dword [ebp + 8], 0x5c
call fcn.0042cea5
cmp eax, 0xffffffff
je 0x42c6bd
push eax
lea eax, [ebp - 0x28]
push eax
lea esi, [ebp - 0x44]
call fcn.0040af0e
cmp dword [eax + 0x18], 8
jb 0x42c61a
mov eax, dword [eax + 4]
jmp 0x42c61d
add eax, 4
push ebx
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
push ebx
push 1
lea esi, [ebp - 0x44]
mov edi, eax
call fcn.004097f9
cmp edi, ebx
je 0x42c672
cmp edi, 0x50
je 0x42c672
cmp edi, 0xb7
je 0x42c672
cmp edi, ebx
jle 0x42c654
and edi, 0xffff
or edi, 0x80070000
push ebx
push 1
lea esi, [ebp - 0x28]
call fcn.004097f9
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
cmp dword [ebp - 0x10], 8
mov eax, dword [ebp - 0x24]
jae 0x42c67e
lea eax, [ebp - 0x24]
push ebx
push 0x80
push 1
push ebx
push 3
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x42c6b2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x42c6ae
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
jmp 0x42c654
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
jmp 0x42c654
mov edi, 0x80070057
jmp 0x42c654
Function at 0x432850
Capabilities:
Encode data using xor
Encrypt data using aes

Disassembly:
push ecx
push esi
push edi
mov edi, ecx
test edi, edi
mov esi, eax
je 0x4329fe
test esi, esi
je 0x4329fe
push ebx
push ebp
mov dword [esi + 0xf0], 0xa
push 8
push dword [edi]
call fcn.0047d790
push 8
push dword [edi]
mov dword [esp + 0x20], eax
mov ebp, 0xff00ff00
and dword [esp + 0x20], ebp
call fcn.0047d79e
mov ebx, 0xff00ff
and eax, ebx
or eax, dword [esp + 0x20]
push 8
mov dword [esi], eax
push dword [edi + 4]
call fcn.0047d790
push 8
push dword [edi + 4]
mov dword [esp + 0x30], eax
and dword [esp + 0x30], ebp
call fcn.0047d79e
and eax, ebx
or eax, dword [esp + 0x30]
push 8
mov dword [esi + 4], eax
push dword [edi + 8]
call fcn.0047d790
push 8
push dword [edi + 8]
mov dword [esp + 0x40], eax
and dword [esp + 0x40], ebp
call fcn.0047d79e
and eax, ebx
or eax, dword [esp + 0x40]
push 8
mov dword [esi + 8], eax
push dword [edi + 0xc]
call fcn.0047d790
push 8
push dword [edi + 0xc]
mov dword [esp + 0x50], eax
and dword [esp + 0x50], ebp
call fcn.0047d79e
and eax, ebx
or eax, dword [esp + 0x50]
mov edi, 0xff
mov dword [esi + 0xc], eax
mov ecx, eax
shr eax, 0x10
and eax, edi
mov eax, dword [eax*4 + 0x4b7230]
xor eax, 0x1000000
and eax, 0xff000000
movzx edx, ch
mov edx, dword [edx*4 + 0x4b7630]
and edx, 0xff0000
xor eax, edx
mov edx, ecx
shr edx, 0x18
movzx edx, byte [edx*4 + 0x4b6e30]
xor eax, edx
mov edx, ecx
and edx, edi
mov edx, dword [edx*4 + 0x4b6a30]
mov ebp, 0xff00
and edx, ebp
xor eax, edx
xor eax, dword [esi]
lea ebx, [esi + 4]
mov edx, dword [ebx]
xor edx, eax
mov dword [esi + 0x10], eax
mov eax, dword [esi + 8]
xor eax, edx
add esp, 0x40
mov dword [esi + 0x18], eax
mov dword [esi + 0x14], edx
xor eax, ecx
mov dword [esi + 0x1c], eax
mov eax, ebx
mov esi, 0x4b8b34
mov edx, dword [eax + 0x18]
add eax, 0x10
mov ebx, edx
movzx ecx, dh
mov ecx, dword [ecx*4 + 0x4b7630]
shr ebx, 0x10
and ebx, edi
mov ebx, dword [ebx*4 + 0x4b7230]
and ecx, 0xff0000
and ebx, 0xff000000
xor ecx, ebx
mov ebx, edx
and edx, edi
mov edx, dword [edx*4 + 0x4b6a30]
shr ebx, 0x18
movzx ebx, byte [ebx*4 + 0x4b6e30]
xor ecx, ebx
and edx, ebp
xor ecx, edx
xor ecx, dword [eax - 4]
xor ecx, dword [esi]
add esi, 4
mov dword [eax + 0xc], ecx
mov edx, dword [eax]
xor edx, ecx
mov dword [eax + 0x10], edx
mov ecx, dword [eax + 4]
xor ecx, edx
mov dword [eax + 0x14], ecx
mov edx, dword [eax + 8]
xor edx, ecx
cmp esi, 0x4b8b58
mov dword [eax + 0x18], edx
jne 0x432986
pop ebp
xor eax, eax
pop ebx
jmp 0x432a01
or eax, 0xffffffff
pop edi
pop esi
pop ecx
ret
Function at 0x43314f
Capabilities:
Access firewall settings via inetfwmgr

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
xor esi, esi
push esi
push esi
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
xor ebx, ebx
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
jge 0x433171
xor eax, eax
inc eax
jmp 0x4331db
cmp dword [edi], esi
je 0x43317a
xor ebx, ebx
inc ebx
jmp 0x4331bf
lea eax, [ebp - 8]
push eax
push 0x4bcc50
push 1
push esi
push 0x4bcc40
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jge 0x433199
push 2
jmp 0x4331be
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
lea edx, [ebp - 4]
push edx
push eax
call dword [ecx + 0x1c]
test eax, eax
jge 0x4331ae
push 3
jmp 0x4331be
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push edi
push eax
call dword [ecx + 0x1c]
test eax, eax
jge 0x4331bf
push 4
pop ebx
mov eax, dword [ebp - 4]
cmp eax, esi
je 0x4331cc
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 8]
cmp eax, esi
je 0x4331d9
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, ebx
pop esi
pop ebx
leave
ret

Function at 0x43419f
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, eax
cmp dword [edi + 0xc], 0xffffffff
jne 0x434203
push esi
lea esi, [ebp - 4]
call fcn.004347ba
push dword [eax]
push 0
push 0x4bcd9c
push str.basesetting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov esi, eax
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.004079f6
test esi, esi
pop esi
je 0x4341f4
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
mov eax, edi
call fcn.004342f0
test eax, eax
je 0x4341f4
cmp dword [ebp - 4], 0
jne 0x4341fd
call fcn.0043486f
test eax, eax
je 0x434200
xor eax, eax
inc eax
mov dword [edi + 0xc], eax
mov eax, dword [edi + 0xc]
pop edi
leave
ret
Function at 0x43438e
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x4abc80
call fcn.004a8fb4
sub esp, 0x20
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x20]
add edi, 0x1c
xor ebx, ebx
cmp eax, ebx
je 0x4343ba
mov ecx, dword [edi + 8]
sub ecx, eax
sar ecx, 3
jne 0x4344e2
mov eax, dword [0x4dd02c]
mov ecx, 0x4dd02c
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
lea esi, [ebp - 0x1c]
mov dword [ebp - 4], ebx
call fcn.004347ba
mov byte [ebp - 4], 1
push dword [eax]
mov eax, 0x104
push eax
push eax
lea esi, [ebp - 0x14]
call fcn.00407b32
push eax
push str.1.01.21.51.72.02.22.52.73.0
push str.supportrate
push str.basesetting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
call fcn.004079f6
cmp dword [ebp - 0x14], ebx
jne 0x43441a
xor eax, eax
jmp 0x434423
push dword [ebp - 0x14]
call fcn.0047acce
pop ecx
lea edx, [ebp - 0x14]
call fcn.00407aee
mov esi, 0x4bcd98
push esi
lea eax, [ebp - 0x18]
mov dword [ebp - 0x1c], ebx
push eax
lea ecx, [ebp - 0x1c]
lea ebx, [ebp - 0x14]
call fcn.00445022
jmp 0x4344be
push eax
call fcn.0047d836
fstp qword [ebp - 0x24]
mov edx, dword [edi + 4]
test edx, edx
pop ecx
jne 0x43445a
xor ecx, ecx
jmp 0x434462
mov ecx, dword [edi + 8]
sub ecx, edx
sar ecx, 3
test edx, edx
je 0x434482
mov eax, dword [edi + 0xc]
sub eax, edx
sar eax, 3
cmp ecx, eax
jae 0x434482
mov eax, dword [edi + 8]
fld qword [ebp - 0x24]
fstp qword [eax]
add eax, 8
mov dword [edi + 8], eax
jmp 0x43449f
mov ebx, dword [edi + 8]
cmp edx, ebx
jbe 0x43448e
call fcn.00479d35
push ebx
push edi
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x2c]
push eax
mov eax, edi
call fcn.00445cbd
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.004079f6
push esi
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x1c]
lea ebx, [ebp - 0x14]
call fcn.00445022
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x18]
cmp dword [eax - 0xc], 0
jne 0x434445
add eax, 0xfffffff0
call fcn.004079f6
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.004079f6
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret

Function at 0x4346bf
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [edi + 0x18], 0
jne 0x4346f5
push esi
lea esi, [ebp - 4]
call fcn.004347ba
push dword [eax]
push 2
push 0x4bcdac
push str.basesetting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [edi + 0x18], eax
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.004079f6
pop esi
mov eax, dword [edi + 0x18]
leave
ret

Function at 0x434824
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, edi
call fcn.00434646
test eax, eax
jne 0x434838
push 0x60
pop eax
leave
ret
cmp dword [edi + 8], 0xffffffff
jne 0x43486a
push esi
lea esi, [ebp - 4]
call fcn.004347ba
push dword [eax]
push 0x60
push str.debugdpi
push str.basesetting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [edi + 8], eax
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.004079f6
pop esi
mov eax, dword [edi + 8]
leave
ret
Function at 0x43486f
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [edi + 4], 0xffffffff
jne 0x4348a5
push esi
lea esi, [ebp - 4]
call fcn.004347ba
push dword [eax]
push 0
push str.debug
push str.basesetting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [edi + 4], eax
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.004079f6
pop esi
mov eax, dword [edi + 4]
leave
ret

Function at 0x4348aa
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x4aa726
call fcn.004a8fb4
push ecx
and dword [ebp - 0x10], 0
push edi
mov edi, ecx
add edi, 0x14
mov eax, dword [edi]
cmp dword [eax - 0xc], 0
jne 0x43491e
push esi
lea esi, [ebp - 0x10]
call fcn.004347ba
and dword [ebp - 4], 0
push dword [eax]
mov eax, 0x104
push eax
push eax
mov esi, edi
call fcn.00407b32
push eax
push str.kxetray
push str.supportprocess
push str.basesetting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.004079f6
mov eax, dword [edi]
test eax, eax
pop esi
je 0x434917
push eax
call fcn.0047acce
pop ecx
mov edx, edi
call fcn.00407aee
mov eax, dword [edi]
sub eax, 0x10
call fcn.00407a0e
mov ecx, dword [ebp - 0xc]
add eax, 0x10
mov dword [ebx], eax
mov eax, ebx
pop edi
mov dword fs:[0], ecx
leave
ret

Function at 0x434aa8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
movzx eax, word [ebp + 0xc]
push esi
push dword [ebp + 0x14]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x434b2b
push ebx
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
test ebx, ebx
je 0x434af4
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [ebp - 4], eax
je 0x434af4
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
mov dword [ebp + 0xc], eax
jne 0x434af8
xor eax, eax
jmp 0x434b2a
mov esi, dword [ebp + 0x10]
push edi
lea edi, [ebx + 1]
push edi
call fcn.00409034
test eax, eax
je 0x434b16
push ebx
push dword [ebp + 0xc]
push eax
call fcn.0047b420
add esp, 0xc
mov eax, edi
call fcn.0040905a
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
xor eax, eax
inc eax
pop edi
pop ebx
pop esi
leave
ret
Function at 0x434c5b
Capabilities:
Get file size
Read file on windows

Disassembly:
mov eax, 0x4aa93b
call fcn.004a8fb4
push ecx
push ecx
mov eax, dword [0x4dd02c]
push ebx
push esi
push edi
mov edi, ecx
mov esi, 0x4dd02c
xor ebx, ebx
mov ecx, esi
mov dword [ebp - 0x14], ebx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
cmp dword [ebp + 0x14], ebx
lea eax, [edi + 0xc]
jne 0x434c93
mov eax, edi
lea edi, [ebp - 0x10]
call fcn.00406f98
mov edi, dword [ebp - 0x10]
cmp dword [edi - 0xc], ebx
je 0x434d89
mov eax, dword [0x4dd02c]
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp + 0x14], eax
push dword [ebp + 0x10]
mov byte [ebp - 4], 1
push dword [ebp + 8]
lea eax, [ebp + 0x14]
push edi
push str._s_d._s
call fcn.004084e0
add esp, 0x10
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocString
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp + 0x10], eax
je 0x434d7e
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, ebx
je 0x434d75
mov esi, dword [ebp + 0xc]
push ebx
lea eax, [ebp + 8]
push eax
push edi
lea eax, [edi + 0xa]
push eax
mov dword [ebp + 8], ebx
call fcn.00409034
push eax
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, ebx
mov dword [ebp - 0x14], eax
je 0x434d6c
cmp dword [ebp + 8], edi
jne 0x434d6c
mov eax, edi
call fcn.0040905a
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 0x14]
add eax, 0xfffffff0
call fcn.004079f6
xor esi, esi
inc esi
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.004079f6
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x10
xor eax, eax
mov edx, esi
call fcn.00409118
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 0x14]
add eax, 0xfffffff0
call fcn.004079f6
mov esi, dword [ebp - 0x14]
jmp 0x434d4e
Function at 0x4350c1
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x4ab2d0
call fcn.004a8fb4
sub esp, 0x20
push ebx
push esi
push edi
mov esi, ecx
call fcn.00435093
push dword [esi]
lea eax, [ebp - 0x10]
push eax
push esi
call fcn.004351fb
xor edi, edi
mov dword [ebp - 4], edi
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], edi
je 0x4351e4
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4351e1
lea eax, [ebp - 0x24]
mov ebx, vtable.Gdiplus::PrivateFontCollection.0
push eax
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], edi
call sub.gdiplus.dll_GdipNewPrivateFontCollection
mov dword [ebp - 0x20], eax
mov byte [ebp - 4], 1
push dword [ebp - 0x10]
push dword [ebp - 0x24]
call sub.gdiplus.dll_GdipPrivateAddFontFile
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x24]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], edi
call sub.gdiplus.dll_GdipGetFontCollectionFamilyCount
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x14]
cmp eax, edi
jle 0x4351ce
xor ecx, ecx
push 8
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
xor eax, eax
add ecx, 4
setb al
neg eax
or eax, ecx
push eax
call sub.gdiplus.dll_GdipAlloc
mov dword [ebp - 0x1c], eax
test eax, eax
mov byte [ebp - 4], 2
je 0x435197
mov ecx, dword [ebp - 0x14]
push 0x433eb9
push 0x433eaf
push ecx
lea edi, [eax + 4]
push 8
push edi
mov dword [eax], ecx
call fcn.0047d035
mov eax, edi
jmp 0x435199
xor eax, eax
test eax, eax
mov byte [ebp - 4], 1
mov dword [esi + 4], eax
je 0x4351ce
push eax
push dword [ebp - 0x14]
lea edi, [ebp - 0x18]
lea eax, [ebp - 0x28]
call fcn.00433ddf
test eax, eax
jne 0x4351c9
mov eax, dword [ebp - 0x18]
test eax, eax
jle 0x4351c9
mov ecx, dword [ebp - 0x14]
mov dword [esi + 8], ecx
mov dword [esi + 0xc], eax
jmp 0x4351ce
call fcn.00435093
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 0x28], ebx
call sub.gdiplus.dll_GdipDeletePrivateFontCollection
mov dword [ebp - 0x28], vtable.Gdiplus::FontCollection.0
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.004079f6
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret

Function at 0x435309
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
xor eax, eax
push 0x20e
push eax
mov dword [ebp - 4], eax
mov word [ebp - 0x214], ax
lea eax, [ebp - 0x212]
push eax
call fcn.0047a340
add esp, 0xc
push 0x104
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea eax, [ebp - 0x214]
push eax
push dword [ebp + 8]
call fcn.00407c71
mov eax, dword [ebp + 8]
leave
ret 4
Function at 0x436a6b
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x4aa8fa
call fcn.004a8fb4
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 4], ebx
lea esi, [edi + 8]
mov dword [edi], vtable.BkWin::BkLayoutParam.0
mov dword [edi + 4], eax
call fcn.00408f56
mov byte [ebp - 4], 1
or dword [edi + 0x1c], 0xffffffff
or dword [edi + 0x20], 0xffffffff
mov eax, SysReAllocString
push str.layout_
push esi
mov dword [edi + 0x34], ebx
mov dword [edi + 0x38], ebx
mov dword [edi + 0x18], ebx
mov dword [edi + 0x14], ebx
mov dword [edi + 0x10], ebx
mov dword [edi + 0xc], ebx
mov dword [edi + 0x24], ebx
mov dword [edi + 0x2c], ebx
mov dword [edi + 0x28], eax
mov dword [edi + 0x30], eax
call fcn.00408fcf
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8

Function at 0x436f67
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x4aa0cb
call fcn.004a8fb4
fld dword [0x4c2118]
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x24]
or dword [edi + 0x18], 0xffffffff
fstp dword [edi + 0xc]
fld dword [0x4c211c]
xor ebx, ebx
fstp dword [edi + 0x10]
push 0xa
fld dword [0x4c2120]
pop ebp
mov esi, edi
fstp dword [edi + 0x14]
mov dword [edi], ebx
mov dword [edi + 4], ebx
mov dword [edi + 8], 0x11
mov dword [edi + 0x1c], ebx
mov dword [edi + 0x20], ebx
mov dword [edi + 0x24], ebp
mov dword [edi + 0x28], ebx
mov dword [edi + 0x2c], ebx
call fcn.00449a82
mov dword [esp + 0x18], ebx
fld dword [0x4c2118]
lea esi, [edi + 0x30]
or dword [esi + 0x18], 0xffffffff
fstp dword [esi + 0xc]
fld dword [0x4c211c]
mov dword [esi], ebx
fstp dword [esi + 0x10]
mov dword [esi + 4], ebx
fld dword [0x4c2120]
mov dword [esi + 8], 0x11
fstp dword [esi + 0x14]
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebp
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
call fcn.00449a82
mov byte [esp + 0x18], 1
push 0x4de000
mov dword [edi + 0x60], ebx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov ecx, dword [esp + 0x10]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x437209
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
mov eax, 0x4ab271
call fcn.004a8fb4
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
mov dword [ebp - 4], esi
mov dword [edi + 4], vtable.BkWin::IBkWindow.0
mov dword [edi], vtable.CBkWindow.0
mov dword [edi + 4], vtable.CBkWindow.1.0
call fcn.004371c7
push 0x4de000
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call fcn.004371c7
add eax, 0x60
inc dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
call fcn.004371c7
mov ebx, eax
mov eax, dword [ebp - 0x10]
call fcn.00467468
push 0x4de000
mov dword [eax], edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp - 0x10]
mov dword [edi + 0xc], esi
mov dword [edi + 0x10], esi
mov dword [edi + 0x14], esi
mov dword [edi + 8], eax
mov dword [edi + 0x18], esi
mov dword [edi + 0x1c], esi
mov dword [edi + 0x20], esi
mov dword [edi + 0x24], esi
mov dword [edi + 0x28], esi
lea esi, [edi + 0x2c]
mov ecx, 0x4dd02c
call fcn.00407cb4
mov byte [ebp - 4], 1
xor ebx, ebx
lea esi, [edi + 0x44]
mov ecx, 0x4dd02c
mov dword [edi + 0x30], ebx
mov dword [edi + 0x34], ebx
mov dword [edi + 0x38], ebx
mov dword [edi + 0x3c], ebx
mov dword [edi + 0x40], ebx
call fcn.00407cb4
mov byte [ebp - 4], 2
lea esi, [edi + 0x4c]
mov ecx, 0x4dd02c
mov dword [edi + 0x48], ebx
call fcn.00407cb4
lea esi, [edi + 0x50]
call fcn.00408f56
mov byte [ebp - 4], 4
or dword [edi + 0x54], 0xffffffff
or dword [edi + 0x58], 0xffffffff
or dword [edi + 0x68], 0xffffffff
lea eax, [edi + 4]
push eax
lea eax, [edi + 0xc4]
push eax
mov dword [edi + 0x5c], ebx
mov word [edi + 0x60], bx
mov dword [edi + 0x64], ebx
mov dword [edi + 0x6c], ebx
mov dword [edi + 0xa4], ebx
mov dword [edi + 0xa8], ebx
mov dword [edi + 0xac], ebx
mov dword [edi + 0xb0], 1
mov dword [edi + 0xb4], ebx
mov dword [edi + 0xb8], ebx
mov dword [edi + 0xbc], ebx
mov dword [edi + 0xc0], ebx
call fcn.00436a6b
mov dword [edi + 0x100], ebx
lea eax, [edi + 0x18]
push eax
mov dword [edi + 0x104], ebx
call dword [sym.imp.USER32.dll_SetRectEmpty]
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4