joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403450
Capabilities:
Get process heap flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov dword [esp], 1
call sym.__configure_wide_argv
call sym.__initialize_wide_environment
call sym.___p___argc
mov esi, dword [eax]
call sym.___p___wargv
mov edi, dword [eax]
call sym.__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
inc eax
mov dword [esp], eax
call sym.__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call sym._wmain
mov dword [esp], eax
call sym._exit
nop
nop
nop
nop
nop

Function at 0x43b63f
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0x43b3c1
add ebx, 0x9b9eeae0
call fcn.0043b680
add ebx, 0x8d38f455
or ebx, ebx
and edi, ebx
xor dword [eax], esi
or edi, ebx
sub ebx, 0x1802e738
inc eax
add ebx, 0x1f74846f
sub edi, 0xe6d7a474
cmp eax, edx
jne fcn.0043b63f
dec ebx
add edi, 0xc86cd09d
ret
Function at 0x4151e0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0x20c
mov eax, dword [0x547008]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov eax, dword [0x54c9d4]
test eax, eax
je 0x415269
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.FDICreate
push eax
call esi
mov dword [0x54c9c8], eax
push str.FDIDestroy
push dword [0x54c9d4]
call esi
mov dword [0x54c9cc], eax
push str.FDICopy
push dword [0x54c9d4]
call esi
mov dword [0x54c9d0], eax
xor ebx, ebx
cmp dword [0x54c9c8], 0
je 0x415253
cmp dword [0x54c9cc], 0
je 0x415253
cmp dword [0x54c9d0], 0
setne bl
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.004e8be6
mov eax, ebx
add esp, 0x20c
pop esi
pop ebx
pop ebp
ret
lea esi, [ebp - 0x214]
push 0x208
push 0
push esi
call fcn.004ec220
add esp, 0xc
push 0x104
push esi
push 0x529890
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
add eax, 0xfffffefb
cmp eax, 0xfffffefc
jb 0x4152ae
push 8
push 0
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [0x54c9d4], eax
jmp 0x4152b3
mov eax, dword [0x54c9d4]
test eax, eax
jne 0x4151fe
mov word [ebp - 0x214], 0
push 0x104
push esi
push str._SYSTEMROOT__system32cabinet.dll
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
add eax, 0xfffffefb
cmp eax, 0xfffffefc
jb 0x4152f3
push 8
push 0
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [0x54c9d4], eax
jmp 0x4152f8
mov eax, dword [0x54c9d4]
test eax, eax
jne 0x4151fe
mov word [ebp - 0x214], 0
push 0x104
push esi
push str.C:Windows_system32cabinet.dll
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
add eax, 0xfffffefb
cmp eax, 0xfffffefc
jae 0x415338
mov eax, dword [0x54c9d4]
test eax, eax
jne 0x4151fe
jmp 0x415235
push 8
push 0
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [0x54c9d4], eax
jmp 0x41532b
Function at 0x416890
Capabilities:
Check if file exists
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x70
mov edi, ecx
mov eax, dword [0x547008]
xor eax, ebp
mov dword [esp + 0x68], eax
xor eax, eax
push eax
push eax
push ecx
push 0x416f80
push eax
push eax
call fcn.004f7e1e
add esp, 0x18
mov esi, eax
cmp dword [edi + 0x3c], eax
je 0x416906
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, dword [edi + 0x3c]
inc eax
cmp eax, 2
jb 0x4168ec
call fcn.0049a530
push dword [edi + 0x3c]
call fcn.004844e0
add esp, 4
mov dword [edi + 0x3c], 0
lea eax, [esi + 1]
cmp eax, 2
jb 0x4168fc
mov dword [edi + 0x3c], esi
call fcn.0049a530
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov esi, dword [edi + 0x3c]
inc esi
cmp esi, 1
ja 0x416964
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ebx, [esp + 4]
push eax
push ebx
call fcn.00516ab0
add esp, 8
lea edi, [esp + 0x10]
mov ecx, edi
push ebx
push 0xa1
push str.InitializeThread
push 1
call fcn.0045bec0
lea ecx, [esp + 0x4c]
push 0x529ada
push str.Failed_to_create_thread_for_async_install_tasks
call fcn.004148f0
mov ecx, edi
call fcn.0045bf00
cmp byte [ebx + 0xb], 0
jns 0x416964
push dword [esp + 4]
call fcn.004e82d5
add esp, 4
test esi, 0xfffffffe
setne bl
mov ecx, dword [esp + 0x68]
xor ecx, ebp
call fcn.004e8be6
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x41efa0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [0x547008]
xor eax, ebp
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
test eax, eax
je 0x41f08a
lea esi, [ebp - 0x1c]
mov ecx, esi
push eax
call fcn.0041f0b0
movzx eax, byte [esi + 0xb]
mov edx, dword [esi]
test al, al
js 0x41f021
mov ecx, eax
and ecx, 0x7f
jmp 0x41f026
test edi, edi
je 0x41f054
cmp word [edi + 2], 0x2d
jne 0x41f012
cmp word [edi + 4], 0x73
jne 0x41f012
cmp word [edi + 6], 0x69
jne 0x41f012
cmp word [edi + 8], 0x6c
jne 0x41f012
cmp word [edi + 0xa], 0x65
jne 0x41f012
cmp word [edi + 0xc], 0x6e
jne 0x41f012
cmp word [edi + 0xe], 0x74
je 0x41f058
add edi, 2
mov ecx, dword [ebp - 0x20]
sub ecx, edx
cmp ecx, 0xf
jg 0x41f03e
jmp 0x41f054
mov ecx, dword [ebp - 0x18]
mov esi, edx
mov dword [ebp - 0x24], edx
lea ebx, [esi + ecx*2]
cmp ecx, 8
jl 0x41f054
lea edx, [esi + ecx*2]
add edx, 0xfffffffe
mov dword [ebp - 0x20], edx
add ecx, ecx
mov edi, esi
shr ecx, 1
add ecx, 0xfffffff9
mov edx, edi
cmp word [edi], 0x2d
je 0x41efdd
add edi, 2
add edx, 2
dec ecx
jne 0x41f045
mov edx, ebx
mov edi, ebx
cmp edi, ebx
setne bl
sub edx, esi
cmp edx, 0xfffffffe
setne bh
test al, al
jns 0x41f074
push dword [ebp - 0x24]
call fcn.004e82d5
add esp, 4
and bl, bh
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e8be6
mov eax, ebx
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
mov bl, 1
jmp 0x41f076
Function at 0x421020
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x70
mov esi, ecx
mov eax, dword [0x547008]
xor eax, ebp
mov dword [esp + 0x68], eax
mov dword [ecx], fcn.0042a950
cmp dword [ecx + 0xc0], 0
je 0x4210d6
push dword [esi + 0xc4]
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0xea60
push dword [esi + 0xc0]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x4210d6
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ebx, [esp + 4]
push eax
push ebx
call fcn.00516ab0
add esp, 8
lea edi, [esp + 0x10]
mov ecx, edi
push ebx
push 0x1ee
push str.Installer
push 1
call fcn.0045bec0
lea ecx, [esp + 0x4c]
push 0x52acbb
push str.Failed_to_wait_for_install_async_exit._Terminate_install_thread_
call fcn.004148f0
mov ecx, edi
call fcn.0045bf00
cmp byte [ebx + 0xb], 0
jns 0x4210c8
push dword [esp + 4]
call fcn.004e82d5
add esp, 4
push 0
push dword [esi + 0xc0]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
cmp byte [esi + 0x12f], 0
jns 0x4210ed
push dword [esi + 0x124]
call fcn.004e82d5
add esp, 4
cmp byte [esi + 0x123], 0
jns 0x421104
push dword [esi + 0x118]
call fcn.004e82d5
add esp, 4
mov ecx, dword [esi + 0x110]
mov dword [esi + 0x110], 0
test ecx, ecx
je 0x42111f
push 1
call fcn.0042a980
cmp byte [esi + 0x10b], 0
jns 0x421136
push dword [esi + 0x100]
call fcn.004e82d5
add esp, 4
cmp byte [esi + 0xbb], 0
jns 0x42114d
push dword [esi + 0xb0]
call fcn.004e82d5
add esp, 4
cmp byte [esi + 0xaf], 0
jns 0x421164
push dword [esi + 0xa4]
call fcn.004e82d5
add esp, 4
cmp byte [esi + 0xa3], 0
jns 0x42117b
push dword [esi + 0x98]
call fcn.004e82d5
add esp, 4
cmp byte [esi + 0x97], 0
jns 0x421192
push dword [esi + 0x8c]
call fcn.004e82d5
add esp, 4
cmp byte [esi + 0x8b], 0
jns 0x4211a9
push dword [esi + 0x80]
call fcn.004e82d5
add esp, 4
cmp byte [esi + 0x7f], 0
jns 0x4211ba
push dword [esi + 0x74]
call fcn.004e82d5
add esp, 4
mov eax, dword [esi + 0x6c]
mov ecx, eax
shr ecx, 0xe
mov edx, eax
shr edx, 0x13
mov edx, dword [edx*4 + 0x54ea50]
bt edx, ecx
jae 0x4211dc
push eax
call fcn.0044f5d0
add esp, 4
mov dword [esi + 0x6c], 0
mov eax, dword [esi + 0x68]
mov ecx, eax
shr ecx, 0xe
mov edx, eax
shr edx, 0x13
mov edx, dword [edx*4 + 0x54ea50]
bt edx, ecx
jae 0x421205
push eax
call fcn.0044f5d0
add esp, 4
mov dword [esi + 0x68], 0
mov eax, dword [esi + 0x64]
mov ecx, eax
shr ecx, 0xe
mov edx, eax
shr edx, 0x13
mov edx, dword [edx*4 + 0x54ea50]
bt edx, ecx
jae 0x42122e
push eax
call fcn.0044f5d0
add esp, 4
mov dword [esi + 0x64], 0
lea ecx, [esi + 0x60]
call fcn.004a4e30
cmp byte [esi + 0x5c], 0
je 0x42124d
add esi, 8
mov ecx, esi
call fcn.00416990
mov ecx, dword [esp + 0x68]
xor ecx, ebp
call fcn.004e8be6
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4212a0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, ecx
mov edi, dword [sym.imp.KERNEL32.dll_ResetEvent]
push dword [ecx + 0xc4]
call edi
push dword [esi + 0xc8]
call edi
xor eax, eax
push eax
push eax
push esi
push 0x4212e0
push eax
push eax
call fcn.004f7e1e
add esp, 0x18
mov dword [esi + 0xc0], eax
pop esi
pop edi
pop ebp
ret
Function at 0x4292b0
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x78
mov eax, dword [0x547008]
xor eax, ebp
mov dword [esp + 0x70], eax
call fcn.004114c0
test al, al
jne 0x4292e9
xor ebx, ebx
mov ecx, dword [esp + 0x70]
xor ecx, ebp
call fcn.004e8be6
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
push 0x52c030
push str.BROWSER_SETUP_RESOURCE
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x4292d0
mov ebx, eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
xor ebx, ebx
test edi, edi
je 0x4292d2
mov esi, eax
test eax, eax
je 0x4292d2
lea ebx, [esp + 0x6c]
mov dword [ebx], 0xffffffff
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
push 0
push ebx
push esi
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [ebx], esi
jne 0x42934f
mov bl, 1
jmp 0x4292d2
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edi, [esp + 4]
push eax
push edi
call fcn.00516ab0
add esp, 8
lea esi, [esp + 0x10]
mov ecx, esi
push edi
push 0x543
push str.ExtractBrowserSetupResource
push 1
call fcn.0045bec0
lea ecx, [esp + 0x4c]
push 0x52b383
push str.Write_failed._Roll_back_write_operation.
call fcn.004148f0
mov ecx, esi
call fcn.0045bf00
cmp byte [edi + 0xb], 0
jns 0x4293a7
push dword [esp + 4]
call fcn.004e82d5
add esp, 4
xor ebx, ebx
push ebx
push ebx
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x4292d2

Function at 0x429e40
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x70
mov esi, ecx
mov eax, dword [0x547008]
xor eax, ebp
mov dword [esp + 0x68], eax
push 0x7530
push dword [ecx + 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x429ed5
mov byte [esi + 0x15], 1
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ebx, [esp + 4]
push eax
push ebx
call fcn.00516ab0
add esp, 8
lea edi, [esp + 0x10]
mov ecx, edi
push ebx
push 0x738
push str.EnsureProcessFinished
push 1
call fcn.0045bec0
lea ecx, [esp + 0x4c]
push 0x52b6f8
push str.The_elevated_installer_hangs_and_must_be_forcibly_terminated.
call fcn.004148f0
mov ecx, edi
call fcn.0045bf00
cmp byte [ebx + 0xb], 0
jns 0x429eca
push dword [esp + 4]
call fcn.004e82d5
add esp, 4
push 0
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, esi
call fcn.00429da0
mov ecx, dword [esp + 0x68]
xor ecx, ebp
call fcn.004e8be6
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x42c000
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x70
mov esi, ecx
mov eax, dword [0x547008]
xor eax, ebp
mov dword [esp + 0x68], eax
mov eax, dword [ecx]
mov edi, dword [eax + 0x58]
mov ecx, edi
call dword [section..00cfg]
mov ecx, esi
call edi
mov ecx, esi
call fcn.00414c20
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esi + 0xe0]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x42c058
push 0
push dword [esi + 0xe0]
call dword [sym.imp.USER32.dll_ShowWindow]
lea edi, [esp + 0x10]
mov ecx, edi
push 0x24d
push str.OnCloseWindow
push 0
call fcn.0045baa0
lea ecx, [esp + 0x4c]
push 0x52bb4b
push str.____Installer___MainWindow::OnCloseWindow
call fcn.004148f0
mov ecx, edi
call fcn.0045bd40
mov ecx, dword [esi + 0x4c]
test ecx, ecx
je 0x42c0f1
call fcn.00421260
test al, al
jne 0x42c0f1
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ebx, [esp + 4]
push eax
push ebx
call fcn.00516ab0
add esp, 8
lea edi, [esp + 0x10]
mov ecx, edi
push ebx
push 0x251
push str.OnCloseWindow
push 1
call fcn.0045bec0
lea ecx, [esp + 0x4c]
push 0x52bb92
push str.____Installer___MainWindow::OnCloseWindow:_WaitForInstallAsync_timeout
call fcn.004148f0
mov ecx, edi
call fcn.0045bf00
cmp byte [ebx + 0xb], 0
jns 0x42c0f1
push dword [esp + 4]
call fcn.004e82d5
add esp, 4
mov ecx, dword [esi + 0xe4]
call fcn.00414c20
xor ebx, ebx
inc ebx
mov edi, dword [sym.imp.USER32.dll_EndDialog]
push ebx
push eax
call edi
mov ecx, esi
call fcn.00414c20
push ebx
push eax
call edi
mov ecx, esi
call fcn.00414c20
push 0x64
push eax
call dword [sym.imp.USER32.dll_KillTimer]
mov ecx, dword [esp + 0x68]
xor ecx, ebp
call fcn.004e8be6
xor eax, eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x42c140
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov esi, ecx
mov eax, dword [0x547008]
xor eax, ebp
mov dword [ebp - 0x10], eax
call fcn.00414c20
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esi + 0xe0]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x42c181
push 0
push dword [esi + 0xe0]
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, [ebp - 0x14]
mov dword [eax], 0xffffffff
lea edi, [ebp - 0x18]
push edi
call fcn.00446a30
add esp, 4
mov edi, dword [edi]
mov eax, dword [esi + 0x20]
mov dword [ebp - 0x20], eax
mov eax, dword [esi + 0x24]
mov dword [ebp - 0x1c], eax
mov eax, dword [edi]
mov ebx, dword [eax + 4]
mov ecx, ebx
call dword [section..00cfg]
xor eax, eax
mov ecx, edi
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push eax
lea eax, [ebp - 0x14]
push eax
call ebx
lea eax, [ebp - 0x18]
mov edi, dword [eax]
xor ecx, ecx
mov dword [eax], ecx
test edi, edi
je 0x42c1e1
mov eax, dword [edi]
mov ebx, dword [eax]
mov ecx, ebx
call dword [section..00cfg]
mov ecx, edi
push 1
call ebx
mov ecx, dword [ebp - 0x14]
xor edi, edi
push edi
call fcn.00436370
mov ecx, esi
call fcn.00414c20
push 1
push eax
call dword [sym.imp.USER32.dll_EndDialog]
mov esi, dword [ebp - 0x14]
mov dword [ebp - 0x14], edi
test esi, esi
je 0x42c218
mov eax, dword [esi]
mov edi, dword [eax]
mov ecx, edi
call dword [section..00cfg]
mov ecx, esi
push 1
call edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e8be6
xor eax, eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 0x10

Function at 0x42c2d0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov esi, ecx
mov eax, dword [0x547008]
xor eax, ebp
mov dword [ebp - 0x10], eax
call fcn.00414c20
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esi + 0xe0]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x42c311
push 0
push dword [esi + 0xe0]
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, [ebp - 0x14]
mov dword [eax], 0xffffffff
lea edi, [ebp - 0x18]
push edi
call fcn.00446a30
add esp, 4
mov edi, dword [edi]
mov eax, dword [esi + 0x20]
mov dword [ebp - 0x20], eax
mov eax, dword [esi + 0x24]
mov dword [ebp - 0x1c], eax
mov eax, dword [edi]
mov ebx, dword [eax + 4]
mov ecx, ebx
call dword [section..00cfg]
mov ecx, edi
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push 3
lea eax, [ebp - 0x14]
push eax
call ebx
lea eax, [ebp - 0x18]
mov edi, dword [eax]
mov dword [eax], 0
test edi, edi
je 0x42c372
mov eax, dword [edi]
mov ebx, dword [eax]
mov ecx, ebx
call dword [section..00cfg]
mov ecx, edi
push 1
call ebx
mov ecx, dword [ebp - 0x14]
xor edi, edi
push edi
call fcn.00436370
mov ecx, esi
call fcn.00414c20
push 1
push eax
call dword [sym.imp.USER32.dll_EndDialog]
mov esi, dword [ebp - 0x14]
mov dword [ebp - 0x14], edi
test esi, esi
je 0x42c3a9
mov eax, dword [esi]
mov edi, dword [eax]
mov ecx, edi
call dword [section..00cfg]
mov ecx, esi
push 1
call edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e8be6
xor eax, eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x42fcf0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x6c
mov esi, ecx
mov ebx, dword [ebp + 8]
mov eax, dword [0x547008]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
dec eax
lea edi, [ebp - 0x78]
mov dword [edi + 0x64], eax
mov dword [edi + 0x60], eax
pcmpeqd xmm0, xmm0
movdqu xmmword [edi + 0x50], xmm0
movdqu xmmword [edi + 0x40], xmm0
movdqu xmmword [edi + 0x30], xmm0
movdqu xmmword [edi + 0x20], xmm0
movdqu xmmword [edi + 0x10], xmm0
movdqu xmmword [edi], xmm0
mov ecx, edi
call fcn.004a5f70
cmp byte [ebx + 0xb], 0
jns 0x42fd44
mov ebx, dword [ebx]
mov ecx, edi
push dword [ebp + 0xc]
push ebx
call fcn.004a64f0
test al, al
je 0x42fd86
mov ebx, dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
jmp 0x42fd6a
test eax, eax
je 0x42fda6
cmp byte [esi + 0x30], 0
je 0x42fd86
lea ecx, [ebp - 0x78]
call fcn.004a6ac0
test ebx, ebx
je 0x42fd60
test eax, eax
je 0x42fd60
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, edi
cmp eax, ebx
jbe 0x42fd64
xor ebx, ebx
lea ecx, [ebp - 0x78]
call fcn.004a6000
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e8be6
mov eax, ebx
add esp, 0x6c
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
cmp byte [esi + 0x30], 0
je 0x42fd86
lea ecx, [ebp - 0x78]
push 0
call fcn.004a6c80
mov ebx, eax
jmp 0x42fd88

Function at 0x437b00
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov eax, dword [0x547008]
xor eax, ebp
mov dword [ebp - 0x10], eax
movzx esi, cx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
push 0xa
push esi
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
xor esi, esi
test eax, eax
je 0x437bab
mov ebx, eax
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x437ba9
mov esi, eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
push ebx
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
test eax, eax
je 0x437ba9
mov edi, eax
mov dword [ebp - 0x18], esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
mov esi, 0
je 0x437ba0
push ebx
push dword [ebp - 0x18]
push eax
call fcn.004ebca0
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea esi, [ebp - 0x14]
mov dword [esi], 0xffffffff
push esi
push 1
push edi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
mov esi, dword [esi]
jmp 0x437bab
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x437bab
xor esi, esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e8be6
mov eax, esi
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4382b0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, dword [0x547008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
xor ecx, ecx
mov esi, eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], ecx
inc esi
je 0x4383ed
cmp eax, 0xfffffffe
jle 0x438403
mov edi, eax
lea eax, [esi + esi]
push eax
call fcn.004e82a5
add esp, 4
mov ebx, eax
mov dword [ebp - 0x1c], eax
lea eax, [eax + esi*2]
mov dword [ebp - 0x20], edi
lea ecx, [edi*2 + 2]
xor edx, edx
mov edi, ebx
add edi, edx
je 0x4383d2
mov word [edi], 0
add edx, 2
cmp ecx, edx
jne 0x43830b
mov dword [ebp - 0x18], eax
push esi
push ebx
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [ebp - 0x20]
test ecx, ecx
js 0x43840b
lea esi, [ecx + ecx]
cmp esi, 9
jbe 0x438370
mov edi, ecx
or edi, 3
lea eax, [edi*2 + 2]
inc edi
push eax
call fcn.004e82a5
add esp, 4
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
or edi, 0x80000000
mov dword [ecx + 8], edi
mov edi, ecx
mov ecx, dword [ebp - 0x20]
mov dword [edi + 4], ecx
jmp 0x438378
mov edi, dword [ebp + 8]
mov byte [edi + 0xb], cl
mov eax, edi
test ecx, ecx
je 0x43838f
xor ecx, ecx
movzx edx, word [ebx + ecx]
mov word [eax + ecx], dx
add ecx, 2
cmp esi, ecx
jne 0x43837e
add eax, ecx
mov word [eax], 0
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4383be
mov ecx, dword [ebp - 0x18]
cmp ecx, eax
je 0x4383b5
add ecx, 0xfffffffe
jne 0x43839e
push str.null_pointer_given_to_destroy_at
push str.__loc___nullptr
push 0x44
jmp 0x4383de
push eax
call fcn.004e82d5
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e8be6
mov eax, edi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
push str.null_pointer_given_to_construct_at
push str.__location___nullptr
push 0x28
push str....._third_partylibc_srcinclude__memoryconstruct_at.h
push str._s:_d:_assertion__s_failed:__s_n
call fcn.00457520
push str.vector___index_out_of_bounds
push 0x52a71f
push 0x601
push str....._third_partylibc_srcinclude_vector
jmp 0x4383e3
lea ecx, [ebp - 0x1c]
call fcn.004171a0
mov ecx, dword [ebp + 8]
call fcn.004148d0
int3
Function at 0x439e90
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x10], esi
xor ebx, ebx
push 0x208
call fcn.004e82a5
add esp, 4
mov edi, eax
mov eax, edi
add eax, ebx
je 0x439f70
mov word [eax], 0
add ebx, 2
cmp ebx, 0x208
jne 0x439eae
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov ebx, eax
dec eax
cmp eax, 0x102
ja 0x439f2b
cmp ebx, 4
jbe 0x439f0e
mov esi, ebx
or esi, 3
lea eax, [esi*2 + 2]
inc esi
push eax
call fcn.004e82a5
add esp, 4
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
or esi, 0x80000000
mov dword [ecx + 8], esi
mov dword [ecx + 4], ebx
mov esi, eax
jmp 0x439f14
mov esi, dword [ebp + 8]
mov byte [esi + 0xb], bl
mov eax, ebx
add eax, ebx
push eax
push edi
push esi
call fcn.004ebca0
add esp, 0xc
mov word [esi + ebx*2], 0
jmp 0x439f38
xor eax, eax
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], eax
mov dword [ecx], eax
mov dword [ecx + 8], eax
test edi, edi
je 0x439f65
mov eax, 0x208
test eax, eax
je 0x439f5c
add eax, 0xfffffffe
mov ecx, edi
add ecx, eax
jne 0x439f41
push str.null_pointer_given_to_destroy_at
push str.__loc___nullptr
push 0x44
jmp 0x439f7c
push edi
call fcn.004e82d5
add esp, 4
mov eax, dword [ebp - 0x10]
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
push str.null_pointer_given_to_construct_at
push str.__location___nullptr
push 0x28
push str....._third_partylibc_srcinclude__memoryconstruct_at.h
push str._s:_d:_assertion__s_failed:__s_n
call fcn.00457520
int3