joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42e300
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f59f8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5374e4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [ebp + 0x1c], 0
jne 0x42e4ac
mov ecx, dword [ebp + 0xc]
mov eax, dword [esi + 0x40]
mov ebx, dword [ebp + 0x10]
mov dword [ebp + 0x1c], eax
cmp ecx, 0x113
jne 0x42e387
push ebx
lea ecx, [esi + 0x40]
mov dword [esi + 0x40], 1
call fcn.0042c530
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
cmp dword [esi + 0x40], 0
mov eax, dword [ebp + 0x1c]
je 0x42e384
mov dword [esi + 0x40], eax
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov ecx, dword [ebp + 0xc]
mov dword [esi + 0x40], eax
cmp ecx, 0x113
jne 0x42e4ac
mov dword [esi + 0x24], 1
cmp ebx, 0x17d4
jne 0x42e468
mov edi, dword [sym.imp.USER32.dll_KillTimer]
push ebx
push dword [esi + 4]
call edi
push 0
push dword [esi + 0x34]
lea eax, [ebp + 0x1c]
mov dword [ebp + 0xc], 0
push eax
mov ecx, esi
call fcn.004296e0
lea eax, [ebp + 0x10]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x10], 4
push eax
lea eax, [ebp - 0x10]
mov dword [ebp + 0x10], 4
push eax
push str.auto_elapse
push dword [ebp + 0x1c]
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov eax, dword [ebp + 0xc]
test eax, eax
jle 0x42e40e
cdq
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], edx
push dword [esi + 0x34]
mov ecx, esi
call fcn.0042ad00
test eax, eax
je 0x42e43b
push 0x17d6
push dword [esi + 4]
call edi
push 0
push dword [esi + 0x38]
push 0x17d6
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetTimer]
jmp 0x42e444
push 0
mov ecx, esi
call fcn.0042bc10
mov edx, dword [ebp + 0x1c]
or eax, 0xffffffff
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x42e499
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x42e499
cmp ebx, 0x17d5
jne 0x42e47e
push ebx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_KillTimer]
push 1
jmp 0x42e492
cmp ebx, 0x17d6
jne 0x42e499
push ebx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_KillTimer]
push 0
mov ecx, esi
call fcn.0042c730
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
cmp dword [esi + 0x24], 0
jne 0x42e36b
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x42f410
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x5374e4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, ecx
push 0x30
push 0
push esi
call fcn.0049a810
push 0x110
lea eax, [ebp - 0x114]
mov dword [ebp - 0x118], 0x114
push 0
push eax
call fcn.0049a810
add esp, 0x18
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x42f473
cmp dword [ebp - 0x114], 6
mov eax, 0x30
jae 0x42f478
mov eax, 0x2c
mov ecx, dword [ebp + 0x10]
mov dword [esi], eax
mov eax, dword [ebp + 8]
mov dword [esi + 4], eax
test ecx, ecx
jne 0x42f496
push edi
call dword [sym.imp.USER32.dll_GetParent]
or dword [esi + 4], 1
mov ecx, edi
jmp 0x42f498
mov eax, edi
mov dword [esi + 8], eax
mov eax, dword [ebp + 0x14]
mov dword [esi + 0xc], ecx
test eax, eax
je 0x42f4ac
movups xmm0, xmmword [eax]
movups xmmword [esi + 0x10], xmm0
mov ecx, dword [0x53c510]
mov eax, esi
mov dword [esi + 0x20], ecx
mov ecx, dword [ebp + 0x18]
mov dword [esi + 0x24], ecx
mov ecx, dword [ebp + 0x1c]
mov dword [esi + 0x28], ecx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0046a581
mov esp, ebp
pop ebp
ret 0x18
Function at 0x4309d0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f5ff8
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x5374e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0
lea eax, [ebp - 0x20]
xorps xmm0, xmm0
push eax
push 0
push 0x30
movups xmmword [ebp - 0x20], xmm0
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
add ecx, 0xffffff89
mov edi, dword [sym.imp.USER32.dll_SetWindowPos]
add eax, 0xfffffe9d
push 0xd
push 0xffffffffffffffff
push 0xffffffffffffffff
push ecx
push eax
push 0
push dword [esi + 4]
call edi
push 0x1e
push 0x77
push 0x163
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push 0
push dword [esi + 4]
call edi
push 0x508f1c
push 0
push 0xe3
call fcn.00459e70
add esp, 0xc
mov dword [esi + 0x74], eax
mov ecx, esi
call fcn.0042fdf0
call fcn.0042fc20
xor ecx, ecx
push 0
cmp dword [eax + 0x40], ecx
setne cl
push ecx
call fcn.00430210
add esp, 8
push 4
push dword [esi + 4]
test eax, eax
je 0x430abe
call dword [sym.imp.USER32.dll_ShowWindow]
push 3
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push dword [esi + 4]
call edi
push 3
push 0
push 0
push 0
push 0
push 0xfffffffffffffffe
push dword [esi + 4]
call edi
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
jmp 0x430ae2
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x13
push 0
push 0
push 0
push 0
push 0xfffffffffffffffe
push dword [esi + 4]
call edi
push str.popup_lite_wnd_notopmost
call fcn.00421b90
add esp, 4
mov ecx, dword [esi + 0x24]
lea eax, [esi + 0x24]
push 0
push 0
push eax
call dword [ecx + 0x20]
sub esp, 0x28
mov eax, esp
mov dword [ebp - 0x24], esp
mov dword [eax + 0x24], 0
push 0
push 0
push str.tipwnd_show
mov dword [ebp - 4], 0
call fcn.00415cf0
mov ecx, eax
mov dword [ebp - 4], 0xffffffff
call fcn.00425470
push str.show_update_end_tip_wnd.
call fcn.00421b90
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046a581
mov esp, ebp
pop ebp
ret
Function at 0x430c50
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f6028
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5374e4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [ebp + 0x1c], 0
mov eax, dword [edi + 0x70]
mov dword [ebp - 0x10], eax
jne 0x430d56
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x18]
cmp eax, 0xa1
jne 0x430cac
mov dword [edi + 0x70], 1
mov dword [ebx], 0
cmp dword [edi + 0x70], 0
jne 0x430d45
mov esi, dword [edi + 0x28]
push 0
push ebx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push dword [ebp + 8]
call fcn.00431690
mov dword [edi + 0x28], esi
test eax, eax
jne 0x430d45
cmp dword [ebp + 0xc], 0x111
jne 0x430d56
mov eax, dword [ebp + 0x10]
mov ecx, 0x7d1
movzx eax, ax
cmp cx, ax
jne 0x430d4c
push 0
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
call fcn.0042fc20
mov ecx, eax
call fcn.0042b520
sub esp, 0x28
mov eax, esp
mov dword [ebp + 0xc], esp
mov dword [eax + 0x24], 0
push 1
push 0
push str.tipwnd_click
mov dword [ebp - 4], 0
call fcn.00415cf0
mov ecx, eax
mov dword [ebp - 4], 0xffffffff
call fcn.00425470
push 0
push 0
push 0x10
push dword [edi + 0x78]
call dword [sym.imp.USER32.dll_PostMessageW]
mov dword [ebx], 0
mov eax, 1
jmp 0x430d58
mov ecx, 0x7d2
cmp cx, ax
je 0x430d30
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword [edi + 0x70], ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x4339c0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f6440
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x5374e4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
push 0
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push str.TLudashiFormMain
call dword [sym.imp.USER32.dll_FindWindowW]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
mov dword [0x53c14c], eax
lea ecx, [ebx + 0x110]
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 1
push eax
push dword [ebx + 4]
call fcn.0041ee20
call fcn.0040db10
mov ecx, eax
test ecx, ecx
je 0x433b82
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x10], esi
mov edi, dword [ebx + 0x7c]
mov dword [ebp - 4], 0
test edi, edi
je 0x433ab3
cmp dword [edi + 0xa4], 0
je 0x433ab3
mov edi, dword [edi + 0x88]
test edi, edi
je 0x433ab3
push edi
call fcn.0042fc20
mov ecx, eax
call fcn.0042b5f0
test eax, eax
je 0x433ab3
push dword [edi]
lea eax, [ebp - 0x10]
push str.instsoft
push str._s__s
push eax
call fcn.0040da10
sub esp, 0x18
mov eax, esp
mov dword [ebp - 0x18], esp
mov dword [eax + 0x24], 0
mov esi, dword [ebp - 0x10]
push 0
push 0
push esi
mov byte [ebp - 4], 1
call fcn.00415cf0
mov ecx, eax
mov byte [ebp - 4], 0
call fcn.00425470
mov eax, dword [ebx + 0x80]
test eax, eax
je 0x433b21
cmp dword [eax + 0xa4], 0
je 0x433b21
mov edi, dword [eax + 0x88]
test edi, edi
je 0x433b21
push edi
call fcn.0042fc20
mov ecx, eax
call fcn.0042b5f0
test eax, eax
je 0x433b21
push dword [edi]
lea eax, [ebp - 0x10]
push str.instsoft
push str._s__s
push eax
call fcn.0040da10
sub esp, 0x18
mov eax, esp
mov dword [ebp - 0x18], esp
mov dword [eax + 0x24], 0
mov esi, dword [ebp - 0x10]
push 0
push 0
push esi
mov byte [ebp - 4], 2
call fcn.00415cf0
mov ecx, eax
mov byte [ebp - 4], 0
call fcn.00425470
sub esp, 0x28
mov eax, esp
mov dword [ebp - 0x18], esp
mov dword [eax + 0x24], 0
push 0
push 0
push str.btn_upgrade
mov byte [ebp - 4], 3
call fcn.00415cf0
mov ecx, eax
mov byte [ebp - 4], 0
call fcn.00425470
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x433b6c
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 0x80004005
call fcn.004034a0
int3
Function at 0x433ec0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f6537
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x5374e4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esi + 0x110]
call fcn.0041e2d0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [ebp - 0x20]
call fcn.004174e0
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], 0
call fcn.00418540
lea ecx, [ebp - 0x20]
call fcn.00417eb0
test eax, eax
je 0x433f59
push str.svc_update_v3_return
call fcn.00421b90
add esp, 4
push 0
push 0
push 0x10
push dword [esi + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
lea ecx, [ebp - 0x20]
call fcn.004175c0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
call fcn.0042fc20
push 0
cmp dword [eax + 0x40], 0
je 0x433f74
call fcn.0042fc20
mov ecx, eax
call fcn.0042bb40
jmp 0x433f2c
call fcn.0042fc20
mov ecx, eax
call fcn.0042bd40
mov eax, dword [0x53c14c]
test eax, eax
je 0x433fa9
push str.g_bComputerZExist_is_true._launch_zcn.
call fcn.00421b90
add esp, 4
push 0
call fcn.0042fc20
mov ecx, eax
call fcn.0042b520
mov eax, dword [0x53c14c]
cmp dword [esi + 0x194], 0
jne 0x433f2c
test eax, eax
jne 0x433f2c
cmp dword [esi + 0x190], eax
jne 0x433f3b
push 0x7c
call fcn.0046a756
add esp, 4
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 1
test eax, eax
je 0x433fea
mov ecx, eax
call fcn.0042f2a0
mov ecx, eax
jmp 0x433fec
xor ecx, ecx
mov eax, dword [esi + 4]
push dword [ebp - 0x10]
mov dword [esi + 0x190], ecx
mov dword [ecx + 0x78], eax
mov esi, dword [esi + 0x190]
mov byte [ebp - 4], 0
lea eax, [esi + 0x20]
push eax
push 0x537210
push 0x53604c
push 0x53c508
call fcn.00403800
movzx ebx, ax
add esp, 0x14
mov eax, dword [esi + 0x14]
test eax, eax
jne 0x434043
call fcn.004593a0
mov dword [esi + 0x14], eax
test eax, eax
jne 0x434043
push 0xe
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x433f3b
push 0
push 0
push eax
call fcn.004594a2
test bx, bx
je 0x433f3b
lea edi, [esi + 8]
test edi, edi
je 0x4340d2
test esi, esi
je 0x4340d2
mov dword [edi], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0x536050
mov dword [edi + 4], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x536068]
mov dword [edi + 8], eax
push 0x536050
mov dword [0x536068], edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [0x53607c]
mov eax, dword [0x536084]
mov edx, dword [0x536078]
sub eax, ecx
push 0
push dword [0x53c50c]
push 0
push 0
push eax
mov eax, dword [0x536080]
sub eax, edx
push eax
push ecx
push edx
push SysReAllocStringLen
push 0
push ebx
push 0x80080
call dword [sym.imp.USER32.dll_CreateWindowExW]
jmp 0x433f3b
push 1
push 0xc0000005
call fcn.0040bdf0
int3
Function at 0x434260
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f65a0
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
push esi
push edi
mov eax, dword [0x5374e4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push str.lds_updater
call fcn.00415cf0
mov ecx, eax
call fcn.004258d0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [ebp - 0x20]
call fcn.004174e0
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], 0
call fcn.00418540
lea ecx, [ebp - 0x20]
call fcn.00417d10
test eax, eax
je 0x434327
call fcn.0042fc20
mov ecx, eax
call fcn.0042afb0
test eax, eax
je 0x4342db
push str.new_version_is_null
jmp 0x43430b
push str.start_download_cfg.
call fcn.00421b90
mov esi, dword [edi + 4]
add esp, 4
call fcn.0042fc20
lea ecx, [edi + 0x158]
mov dword [eax + 0x48], esi
call fcn.0042ec70
test eax, eax
jne 0x4343e3
push str.StartDownloadCfg_return_false.
call fcn.00421b90
add esp, 4
push 0
push 0
push 0x10
push dword [edi + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x4343e3
lea ecx, [ebp - 0x20]
call fcn.00417df0
test eax, eax
je 0x434346
push dword [edi + 4]
lea ecx, [edi + 0x110]
call fcn.0041e0e0
jmp 0x4343e3
push str.need_slient_update.
call fcn.00421b90
add esp, 4
lea ecx, [ebp - 0x20]
call fcn.00418250
test eax, eax
je 0x434387
push str.need_replace_now_update.
call fcn.00421b90
add esp, 4
mov dword [ebp - 0x10], 1
lea eax, [ebp - 0x10]
lea ecx, [edi + 0x110]
push eax
push dword [edi + 4]
call fcn.0041ee20
jmp 0x4343e3
lea ecx, [ebp - 0x48]
call fcn.00413b60
push str.ComputerZTray.exe
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 1
call fcn.004145c0
test eax, eax
jne 0x4343bf
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 1
push eax
push dword [edi + 4]
lea ecx, [edi + 0x110]
call fcn.0041ee20
jmp 0x4343db
push str.found_tray__give_up_replace.
call fcn.00421b90
add esp, 4
push 0
push 0
push 0x10
push dword [edi + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
lea ecx, [ebp - 0x48]
call fcn.00413c00
lea ecx, [ebp - 0x20]
call fcn.004175c0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x434980
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f65fe
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5374e4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov eax, dword [0x53c144]
test al, 1
jne 0x4349e1
or eax, 1
mov dword [0x53c144], eax
mov ecx, 0x53c140
mov dword [ebp - 4], 0
call fcn.004365e0
push 0x500300
call fcn.0046ab94
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov ecx, 0x53c140
call fcn.004366c0
push 0x509388
push dword [edi + 4]
lea esi, [edi + 4]
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov ebx, dword [sym.imp.USER32.dll_SetWindowPos]
push 0x1e
push 0x21d
push 0x20f
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push dword [esi]
call ebx
push 0x508f1c
push 0
push 0xde
call fcn.00459e70
add esp, 0xc
mov dword [edi + 0x74], eax
mov ecx, edi
call fcn.00432c40
call fcn.00423560
push 0x508f1c
push 0
push 0xd9
mov dword [edi + 0x78], eax
call fcn.00459e70
mov ecx, dword [edi + 0x78]
add esp, 0xc
add ecx, 0x24
push 1
mov edx, dword [ecx]
push eax
push 0
push dword [esi]
push ecx
call dword [edx + 4]
mov ecx, edi
call fcn.00433400
push 0
mov ecx, esi
call fcn.00432480
call fcn.0042fc20
xor ecx, ecx
push 0
cmp dword [eax + 0x40], ecx
setne cl
push ecx
call fcn.00430210
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
add esp, 8
push 4
push dword [esi]
test eax, eax
je 0x434ac7
call edi
push 3
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push dword [esi]
call ebx
push 3
push 0
push 0
push 0
push 0
push 0xfffffffffffffffe
push dword [esi]
call ebx
push dword [esi]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
jmp 0x434ae6
call edi
push 0x13
push 0
push 0
push 0
push 0
push 0xfffffffffffffffe
push dword [esi]
call ebx
push str.popup_wnd_notopmost
call fcn.00421b90
add esp, 4
mov ecx, dword [ebp - 0x10]
call fcn.00434c30
push 0
push dword [esi]
call edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x435e20
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f6720
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x5374e4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov edx, dword [edi + 0x30]
or esi, 0xffffffff
sub edx, 0x10
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x435e63
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [edi + 0x2c]
mov eax, esi
sub edx, 0x10
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x435e7d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [edi + 0x28]
mov eax, esi
sub edx, 0x10
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x435e97
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [edi + 0x24]
mov eax, esi
sub edx, 0x10
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x435eb1
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [edi + 0x20]
mov eax, esi
sub edx, 0x10
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x435ecb
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [edi + 0x1c]
mov eax, esi
sub edx, 0x10
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x435ee5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [edi + 0x18]
mov eax, esi
sub edx, 0x10
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x435eff
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [edi + 0x14]
mov eax, esi
sub edx, 0x10
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x435f19
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [edi + 0x10]
mov eax, esi
sub edx, 0x10
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x435f33
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [edi + 0xc]
mov eax, esi
sub edx, 0x10
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x435f4d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [edi + 8]
mov eax, esi
sub edx, 0x10
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x435f67
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [edi + 4]
mov eax, esi
sub edx, 0x10
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x435f81
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [edi]
sub edx, 0x10
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x435f98
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4396f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f6ad6
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x5374e4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x430], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], 0
mov dword [ebp - 0x418], 0
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push 0x60
push 0
push edi
mov byte [ebp - 4], 1
call ebx
mov esi, eax
mov dword [ebp - 0x424], esi
test esi, esi
jne 0x43979c
push 2
push eax
push edi
call ebx
mov esi, eax
mov dword [ebp - 0x424], eax
test esi, esi
jne 0x43979c
call fcn.00406120
mov edi, eax
jmp 0x4398bb
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x4397bf
call fcn.00406120
jmp 0x4398ae
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [ebp - 0x420], ebx
test ebx, ebx
jne 0x4397dd
call fcn.00406120
jmp 0x4398ae
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov dword [ebp - 0x41c], edi
lea eax, [edi + 1]
cmp eax, edi
jae 0x4397fe
mov edi, 0x8007000e
jmp 0x4398b0
mov ecx, 2
mov byte [ebp - 4], 2
mul ecx
test edx, edx
ja 0x4398f4
jb 0x43981c
cmp eax, 0xffffffff
ja 0x4398f4
cmp eax, 0x400
jbe 0x439831
push eax
lea ecx, [ebp - 0x418]
call fcn.00438820
jmp 0x439857
lea eax, [ebp - 0x414]
mov dword [ebp - 0x418], eax
jmp 0x439857
cmp dword [ebp - 0x418], 0
mov dword [ebp - 4], 1
jne 0x43986e
mov edi, 0x8007000e
jmp 0x4398b0
push edi
push dword [ebp - 0x418]
push edi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
jne 0x43988e
call fcn.00406120
jmp 0x4398ae
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x42c]
push dword [ebp - 0x418]
call fcn.00439550
mov edi, eax
test esi, esi
je 0x4398bb
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x4398d4
lea ecx, [ebp - 0x418]
call fcn.00438c00
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0046a581
mov esp, ebp
pop ebp
ret 0x10
push 0x80070216
call fcn.004034a0
int3