joyce8/EMBER2024-capa huggingface dataset:
Function at 0x415ca0
Capabilities:
Get common file path

Disassembly:
sub esp, 0xa30
mov eax, dword [0x493008]
xor eax, esp
mov dword [esp + 0xa2c], eax
push ebx
push ebp
push esi
mov esi, dword [0x55ff60]
mov eax, 0x10
push edi
mov edi, ecx
mov ebp, edx
xor ecx, ecx
cmp dword [esp + 0xa48], ecx
push 0x104
cmovne eax, ecx
mov dword [esp + 0x14], eax
lea eax, [esp + 0x428]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [esp + 0x424]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0x104
lea eax, [esp + 0x838]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [esp + 0x14]
push eax
push 0
push 0
push 5
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpynW]
test esi, esi
je 0x415db2
push edi
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
jne 0x415db2
mov esi, dword [sym.imp.SHLWAPI.dll_PathIsPrefixW]
lea eax, [esp + 0x424]
push eax
lea eax, [esp + 0x18]
push eax
call esi
test eax, eax
jne 0x415db2
push edi
lea eax, [esp + 0x18]
push eax
call esi
mov esi, dword [esp + 0x10]
test eax, eax
je 0x415db6
push esi
push edi
push 0x10
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x22c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRelativePathToW]
test eax, eax
je 0x415db6
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [esp + 0x14]
push str._CSIDL:MYDOCUMENTS_
push eax
call esi
lea eax, [esp + 0x21c]
push eax
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x220]
push eax
call esi
jmp 0x415e0a
mov esi, dword [esp + 0x10]
push edi
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
jne 0x415dfa
push eax
lea eax, [esp + 0x838]
push eax
lea eax, [esp + 0x42c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCommonPrefixW]
test eax, eax
jne 0x415dfa
push esi
push edi
push 0x10
lea eax, [esp + 0x430]
push eax
lea eax, [esp + 0x22c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRelativePathToW]
test eax, eax
jne 0x415e0a
push 0x104
push edi
lea eax, [esp + 0x224]
push eax
call ebx
push 0x104
lea eax, [esp + 0x630]
push eax
lea eax, [esp + 0x224]
push eax
call dword [sym.imp.SHLWAPI.dll_PathUnExpandEnvStringsW]
test eax, eax
jne 0x415e40
push 0x104
lea eax, [esp + 0x220]
push eax
lea eax, [esp + 0x634]
push eax
call ebx
test ebp, ebp
je 0x415e58
cmp edi, ebp
je 0x415e58
push 0x104
lea eax, [esp + 0x630]
push eax
push ebp
jmp 0x415e66
push 0x104
lea eax, [esp + 0x630]
push eax
push edi
call ebx
mov ecx, dword [esp + 0xa3c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00422d0c
add esp, 0xa30
ret
Function at 0x415e90
Capabilities:
Get common file path
Get program files directory
Query environment variable

Disassembly:
sub esp, 0x684
mov eax, dword [0x493008]
xor eax, esp
mov dword [esp + 0x680], eax
push ebx
push esi
push edi
push 0x13
mov edi, ecx
mov ebx, edx
push str._CSIDL:MYDOCUMENTS_
push edi
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpynW]
test eax, eax
lea eax, [esp + 0x214]
jne 0x415eed
push eax
push 0
push 0
push 5
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [edi + 0x26]
push eax
lea eax, [esp + 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
jmp 0x415ef6
push 0x104
push edi
push eax
call esi
push 0x138
lea eax, [esp + 0x420]
push eax
lea eax, [esp + 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x415f2c
push 0x104
lea eax, [esp + 0x420]
push eax
lea eax, [esp + 0x21c]
push eax
call esi
lea eax, [esp + 0x214]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
push 0x104
test eax, eax
je 0x415f70
lea eax, [esp + 0x10]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [esp + 0x214]
push eax
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
jmp 0x415f7f
lea eax, [esp + 0x218]
push eax
lea eax, [esp + 0x14]
push eax
call esi
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCanonicalizeW]
test eax, eax
je 0x415fa9
lea eax, [esp + 0x41c]
push eax
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.SHLWAPI.dll_PathGetDriveNumberW]
cmp eax, 0xffffffff
je 0x415fc6
push 1
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_CharUpperBuffW]
test ebx, ebx
je 0x415fdb
cmp edi, ebx
je 0x415fdb
push 0x104
lea eax, [esp + 0x10]
push eax
push ebx
jmp 0x415fe6
push 0x104
lea eax, [esp + 0x10]
push eax
push edi
call esi
mov ecx, dword [esp + 0x68c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00422d0c
add esp, 0x684
ret
Function at 0x416080
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x4d4
mov eax, dword [0x493008]
xor eax, esp
mov dword [esp + 0x4d0], eax
push ebp
push esi
push edi
lea eax, [esp + 0x10]
xor esi, esi
push eax
push 0x47fd7c
push 1
push esi
push 0x48378c
mov edi, edx
mov ebp, ecx
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x416136
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x14]
push edx
push 0x48094c
push eax
mov ecx, dword [eax]
mov eax, dword [ecx]
call eax
test eax, eax
js 0x41612a
push ebp
lea eax, [esp + 0x26c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x268]
push esi
push edx
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 0x14]
call eax
test eax, eax
js 0x41611e
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x18]
push esi
push edx
push dword [esp + 0x4ec]
mov ecx, dword [eax]
push edi
push eax
mov eax, dword [ecx + 0xc]
call eax
test eax, eax
mov ecx, 1
cmove esi, ecx
mov eax, dword [esp + 0x14]
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 8]
call eax
mov eax, dword [esp + 0x10]
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 8]
call eax
test edi, edi
je 0x41618c
cmp word [edi], 0
je 0x41618c
test esi, esi
je 0x416172
push 0x138
lea eax, [esp + 0x26c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x416172
push dword [esp + 0x4e4]
lea eax, [esp + 0x26c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov eax, esi
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x4d0]
xor ecx, esp
call fcn.00422d0c
add esp, 0x4d4
ret
mov ecx, dword [esp + 0x4dc]
xor eax, eax
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.00422d0c
add esp, 0x4d4
ret

Function at 0x416590
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x274
mov eax, dword [0x493008]
xor eax, esp
mov dword [esp + 0x270], eax
push esi
push edi
push 0x138
lea eax, [esp + 0xc]
mov esi, ecx
push eax
push esi
mov edi, edx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x4165cc
push edi
lea eax, [esp + 0xc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov ecx, dword [esp + 0x278]
pop edi
pop esi
xor ecx, esp
call fcn.00422d0c
add esp, 0x274
ret
Function at 0x4166e0
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x14
mov eax, dword [0x493008]
xor eax, esp
mov dword [esp + 0x10], eax
push ebx
push edi
mov ebx, ecx
xor edi, edi
test ebx, ebx
je 0x41678c
cmp word [ebx], di
je 0x41678c
push 8
lea eax, [esp + 0xc]
push eax
push 0xf
push edi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x416723
mov eax, 0x27
mov word [esp + 8], ax
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
push ebx
call ebp
lea eax, [ebx + eax*2]
push eax
push ebx
call dword [sym.imp.USER32.dll_CharPrevW]
mov esi, eax
cmp esi, ebx
je 0x416776
nop
inc edi
cmp edi, 3
jne 0x416768
push esi
xor edi, edi
call ebp
lea eax, [eax*2 + 2]
push eax
lea eax, [esi + 2]
push esi
push eax
call fcn.0042e770
mov ax, word [esp + 0x1c]
add esp, 0xc
mov word [esi], ax
push esi
push ebx
call dword [sym.imp.USER32.dll_CharPrevW]
mov esi, eax
cmp esi, ebx
jne 0x416740
push ebx
call ebp
pop esi
pop ebp
pop edi
pop ebx
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.00422d0c
add esp, 0x14
ret
mov ecx, dword [esp + 0x18]
xor eax, eax
pop edi
pop ebx
xor ecx, esp
call fcn.00422d0c
add esp, 0x14
ret
Function at 0x417a20
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 0x6c
mov eax, dword [0x493008]
xor eax, esp
mov dword [esp + 0x64], eax
push ebx
push ebp
push esi
push edi
push 5
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x417c20
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x417c20
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x417c20
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebp, eax
test ebp, ebp
je 0x417c19
lea ecx, [ebp + 0x40]
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x417c19
push ebp
push ebx
push esi
call fcn.004253d0
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
push 0x40
lea eax, [esp + 0x34]
push 0
push eax
call fcn.00425950
add esp, 0xc
mov dword [esp + 0x20], 0
lea edx, [esp + 0x20]
lea ecx, [esp + 0x30]
call fcn.004176a0
test eax, eax
je 0x417c04
lea eax, [esi + 2]
mov edx, 0xffff
mov dword [esp + 0x28], eax
movzx eax, word [eax]
mov ecx, eax
mov dword [esp + 0x2c], ecx
cmp ax, dx
jne 0x417aff
mov eax, dword [esi + 0xc]
mov ebx, 6
and eax, 0x40
or dword [esi + 0xc], 0x48
jmp 0x417b0c
mov eax, dword [esi]
mov ebx, 2
and eax, 0x40
or dword [esi], 0x48
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x30]
push eax
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
mov ecx, 0xffff
lea edi, [ebx + eax*2]
mov eax, dword [esp + 0x28]
xor ebx, ebx
mov dword [esp + 0x24], edi
cmp word [eax], cx
sete bl
lea ebx, [ebx*8 + 0x12]
add ebx, esi
cmp word [ebx], cx
jne 0x417b50
add ebx, 4
jmp 0x417b5b
mov ax, word [ebx]
add ebx, 2
test ax, ax
jne 0x417b50
cmp word [ebx], cx
jne 0x417b65
add ebx, 4
jmp 0x417b70
mov ax, word [ebx]
add ebx, 2
test ax, ax
jne 0x417b65
mov ax, word [ebx]
add ebx, 2
test ax, ax
jne 0x417b70
mov eax, dword [esp + 0x18]
add eax, ebx
cmp dword [esp + 0x1c], 0
je 0x417b9b
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [esp + 0x14]
add ecx, 2
lea eax, [ecx + eax*2]
jmp 0x417b9d
xor eax, eax
add edi, 3
lea ecx, [eax + 3]
add ecx, ebx
add edi, ebx
mov edx, 0xffff
and ecx, 0xfffffffc
and edi, 0xfffffffc
cmp word [esp + 0x2c], dx
jne 0x417bbf
movzx edx, word [esi + 0x10]
jmp 0x417bc3
movzx edx, word [esi + 8]
cmp dword [esp + 0x24], eax
je 0x417bdf
test dx, dx
je 0x417bdf
mov eax, esi
sub eax, ecx
add eax, ebp
push eax
push ecx
push edi
call fcn.0042e770
add esp, 0xc
mov eax, dword [esp + 0x24]
sub eax, dword [esp + 0x14]
mov cx, word [esp + 0x20]
push eax
lea eax, [esp + 0x34]
mov word [ebx], cx
push eax
mov eax, dword [esp + 0x20]
add eax, ebx
push eax
call fcn.0042e770
add esp, 0xc
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00422d0c
add esp, 0x6c
ret
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov ecx, dword [esp + 0x74]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00422d0c
add esp, 0x6c
ret
Function at 0x417c80
Capabilities:
Find taskbar

Disassembly:
sub esp, 0x28
mov eax, dword [0x493008]
xor eax, esp
mov dword [esp + 0x24], eax
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_FindWindowExW]
mov esi, ecx
push 0
push str.Shell_TrayWnd
push 0
push 0
call edi
test eax, eax
je 0x417cd2
push 0
push str.TrayNotifyWnd
push 0
push eax
call edi
test eax, eax
je 0x417cd2
push esi
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
pop edi
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.00422d0c
add esp, 0x28
ret
lea eax, [esp + 8]
mov dword [esp + 8], 0x24
push eax
push 5
call dword [sym.imp.SHELL32.dll_SHAppBarMessage]
test eax, eax
je 0x417d5b
mov eax, dword [esp + 0x14]
cmp eax, 3
ja case.default.0x417cf8
jmp dword [eax*4 + 0x417de0]
mov ecx, dword [esp + 0x24]
pop edi
lea eax, [ecx - 0x64]
mov dword [esi + 4], eax
lea eax, [ecx - 0x10]
mov dword [esi + 0xc], eax
mov eax, dword [esp + 0x14]
mov dword [esi], eax
mov eax, dword [esp + 0x1c]
mov dword [esi + 8], eax
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.00422d0c
add esp, 0x28
ret
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
mov dword [esi + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esi + 0xc], eax
lea eax, [ecx - 0x64]
mov dword [esi], eax
lea eax, [ecx - 0x10]
pop edi
mov dword [esi + 8], eax
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.00422d0c
add esp, 0x28
ret
push 0
push str.Shell_TrayWnd
push 0
push 0
call edi
test eax, eax
je 0x417dae
push esi
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov ecx, dword [esi + 8]
mov eax, ecx
sub eax, dword [esi]
cmp eax, 0x96
jle 0x417d8a
lea eax, [ecx - 0x96]
mov dword [esi], eax
mov ecx, dword [esi + 0xc]
mov eax, ecx
sub eax, dword [esi + 4]
cmp eax, 0x1e
jle case.default.0x417cf8
lea eax, [ecx - 0x1e]
pop edi
mov dword [esi + 4], eax
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.00422d0c
add esp, 0x28
ret
push 0
push esi
push 0
push 0x30
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
mov eax, dword [esi + 8]
sub eax, 0x96
mov dword [esi], eax
mov eax, dword [esi + 0xc]
sub eax, 0x1e
mov dword [esi + 4], eax
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
xor ecx, esp
call fcn.00422d0c
add esp, 0x28
ret

Function at 0x418460
Capabilities:
Get geographical location

Disassembly:
sub esp, 0xb4
mov eax, dword [0x493008]
xor eax, esp
mov dword [esp + 0xb0], eax
cmp word [0x560590], 0
je 0x4184d0
push 0x55
lea eax, [esp + 8]
push eax
push 0x560590
call dword [sym.imp.KERNEL32.dll_ResolveLocaleName]
test eax, eax
jle 0x4184d0
push 2
lea eax, [esp + 4]
mov dword [esp + 4], 0
push eax
push 0x20000001
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jle 0x4184d0
mov ax, word [esp]
mov ecx, dword [esp + 0xb0]
xor ecx, esp
call fcn.00422d0c
add esp, 0xb4
ret
mov ecx, dword [esp + 0xb0]
mov eax, 0x409
xor ecx, esp
call fcn.00422d0c
add esp, 0xb4
ret
Function at 0x4184f0
Capabilities:
Get geographical location

Disassembly:
sub esp, 0xb8
mov eax, dword [0x493008]
xor eax, esp
mov dword [esp + 0xb4], eax
push ebx
push esi
push edi
push 0xaa
lea eax, [esp + 0x18]
mov dword [esp + 0x10], 0
push 0
push eax
mov ebx, ecx
mov dword [esp + 0x1c], 0
call fcn.00425950
mov esi, dword [sym.imp.KERNEL32.dll_GetUserPreferredUILanguages]
lea eax, [esp + 0x1c]
add esp, 0xc
push eax
push 0
lea eax, [esp + 0x14]
push eax
push 8
call esi
test eax, eax
je 0x4185ce
mov eax, dword [esp + 0x10]
lea eax, [eax*2 + 4]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
test edi, edi
je 0x41860e
lea eax, [esp + 0x10]
push eax
push edi
lea eax, [esp + 0x14]
push eax
push 8
call esi
test eax, eax
je 0x4185bf
cmp dword [esp + 0xc], 0
jbe 0x4185bf
lea ecx, [esp + 0x14]
mov esi, edi
mov eax, ecx
mov edx, 0x55
sub esi, eax
lea eax, [edx + 0x7fffffa9]
test eax, eax
je 0x4185b0
movzx eax, word [esi + ecx]
test ax, ax
je 0x4185b0
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x418592
test edx, edx
lea eax, [ecx - 2]
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
jmp 0x4185c7
mov dword [esp + 0xc], 0
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [esp + 0xc], 0
jne 0x418618
push 0x55
lea eax, [esp + 0x18]
push eax
push 0x5c
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
xor ecx, ecx
cmp eax, 1
setg cl
mov dword [esp + 0xc], ecx
jg 0x418618
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [esp + 0xb4]
xor ecx, esp
call fcn.00422d0c
add esp, 0xb8
ret
mov dword [esp + 0xc], 0
jmp 0x4185d5
push 0x7ffffffe
lea eax, [esp + 0x18]
mov edx, 0x55
push eax
push ecx
mov ecx, ebx
call fcn.0040d900
mov ecx, dword [esp + 0xc0]
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00422d0c
add esp, 0xb8
ret
Function at 0x41a880
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x20c
mov eax, dword [0x493008]
xor eax, esp
mov dword [esp + 0x208], eax
push esi
mov esi, ecx
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
je 0x41a8cf
push 0x104
lea eax, [esp + 8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [esp + 4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push esi
lea eax, [esp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea esi, [esp + 4]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41a90b
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x41a90b
push 0x2010
push eax
push eax
push eax
push esi
push eax
call dword [sym.imp.USER32.dll_LoadImageW]
pop esi
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.00422d0c
add esp, 0x20c
ret
mov ecx, dword [esp + 0x20c]
xor eax, eax
pop esi
xor ecx, esp
call fcn.00422d0c
add esp, 0x20c
ret
Function at 0x41f9a0
Capabilities:
Check if file exists
Get file attributes
Get file system object information
Query environment variable
Set current directory

Disassembly:
sub esp, 0x6d4
mov eax, dword [0x493008]
xor eax, esp
mov dword [esp + 0x6cc], eax
push esi
push edi
mov edi, edx
test ecx, ecx
je 0x41fbcf
cmp word [ecx], 0
je 0x41fbcf
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [esp + 0x4c8]
push ecx
push eax
call esi
push 0x138
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x4d0]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x41fa0f
push 0x104
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x4d0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
lea eax, [esp + 0x2c0]
push eax
lea ecx, [esp + 0x4cc]
call fcn.00416640
add esp, 4
test eax, eax
jne 0x41fa3c
lea eax, [esp + 0x4c8]
push eax
lea eax, [esp + 0x2c4]
push eax
call esi
lea ecx, [esp + 0x2c0]
call fcn.00416000
test eax, eax
je 0x41fa6f
lea ecx, [esp + 0x2c0]
call fcn.0041fbf0
pop edi
pop esi
mov ecx, dword [esp + 0x6cc]
xor ecx, esp
call fcn.00422d0c
add esp, 0x6d4
ret
lea eax, [esp + 0x2c0]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41fbc4
test al, 0x10
lea eax, [esp + 0x2c0]
push eax
je 0x41fae9
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
je 0x41fbc4
push 0
push 0x19d0d
push 0x111
push dword [0x564b3c]
call dword [sym.imp.USER32.dll_PostMessageW]
push 0
push 0
push 0x1013
push dword [0x561c6c]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, 1
pop edi
pop esi
mov ecx, dword [esp + 0x6cc]
xor ecx, esp
call fcn.00422d0c
add esp, 0x6d4
ret
lea eax, [esp + 0x4cc]
push eax
call esi
push 0x2b4
lea eax, [esp + 0xc]
push 0
push eax
call fcn.00425950
add esp, 0xc
lea eax, [esp + 8]
push 0x200
push 0x2b4
push eax
push 0
lea eax, [esp + 0x2d0]
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
push 0x5c
push 0
lea eax, [esp + 0x2c8]
push eax
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
mov esi, eax
test esi, esi
je 0x41fb67
xor eax, eax
mov word [esi + 2], ax
lea eax, [esp + 0x2c0]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsRootW]
test eax, eax
jne 0x41fb59
mov word [esi], ax
lea eax, [esp + 0x2c0]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0x19d0d
push 0x111
push dword [0x564b3c]
call esi
lea eax, [esp + 0x4c8]
push eax
lea edx, [esp + 0x18]
call fcn.00414140
add esp, 4
test eax, eax
jne 0x41fba8
push eax
push eax
push 0x1013
push dword [0x561c6c]
call esi
mov eax, 1
pop edi
pop esi
mov ecx, dword [esp + 0x6cc]
xor ecx, esp
call fcn.00422d0c
add esp, 0x6d4
ret
push edi
push 2
call fcn.00412d90
add esp, 8
mov ecx, dword [esp + 0x6d4]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.00422d0c
add esp, 0x6d4
ret
Function at 0x420030
Capabilities:
Enumerate gui resources
Get common file path

Disassembly:
sub esp, 0x21c
mov eax, dword [0x493008]
xor eax, esp
mov dword [esp + 0x218], eax
cmp dword [0x55ff64], 0
push esi
mov dword [esp + 4], 0
jne 0x42022e
cmp dword [0x561498], 0
jne 0x42022e
lea eax, [esp + 4]
push eax
push 0x41ffb0
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [esp + 4]
test eax, eax
je 0x42022e
push eax
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x4201aa
push dword [esp + 4]
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x4200ac
push 9
push dword [esp + 8]
call dword [sym.imp.USER32.dll_ShowWindowAsync]
push dword [esp + 4]
call dword [sym.imp.USER32.dll_IsWindowVisible]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
jne 0x4200e4
push 0x203
push 0
push 0x400
push dword [esp + 0x10]
call esi
push 0x202
push 0
push 0x400
push dword [esp + 0x10]
call esi
push dword [esp + 4]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov eax, dword [0x561078]
test eax, eax
je 0x420213
push eax
call dword [sym.imp.KERNEL32.dll_GlobalSize]
mov ecx, dword [0x561078]
shr eax, 1
mov edx, eax
call fcn.00416590
push dword [0x561078]
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
je 0x420153
lea eax, [esp + 0x14]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push dword [0x561078]
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [esp + 0x14]
push eax
push dword [0x561078]
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push dword [0x561078]
mov dword [esp + 0xc], 0xfb30
call dword [sym.imp.KERNEL32.dll_GlobalSize]
mov dword [esp + 0xc], eax
mov eax, dword [0x561078]
mov dword [esp + 0x10], eax
lea eax, [esp + 8]
push eax
push 0
push 0x4a
push dword [esp + 0x10]
call esi
push dword [0x561078]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, 1
pop esi
mov ecx, dword [esp + 0x218]
xor ecx, esp
call fcn.00422d0c
add esp, 0x21c
ret
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
lea eax, [esp + 0x14]
push 0x100
push eax
push 0xc35f
push dword [0x560844]
call esi
test eax, eax
jne 0x4201e2
push 0x100
lea eax, [esp + 0x18]
push eax
push 0xc35f
push dword [0x560a58]
call esi
push 0xa
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.SHLWAPI.dll_StrChrW]
test eax, eax
je 0x4201fb
xor ecx, ecx
mov word [eax], cx
add eax, 2
push 0x10024
lea ecx, [esp + 0x18]
push ecx
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
je 0x42022e
mov eax, 1
pop esi
mov ecx, dword [esp + 0x218]
xor ecx, esp
call fcn.00422d0c
add esp, 0x21c
ret
mov ecx, dword [esp + 0x21c]
xor eax, eax
pop esi
xor ecx, esp
call fcn.00422d0c
add esp, 0x21c
ret
Function at 0x423c21
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x423c60
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x423c60
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x423c60
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x423c60
cmp dword [ecx + 0x74], 0xe
jbe 0x423c60
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x463566
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4896ec
push 0x4896e4
push str.FlsAlloc
push 0x1e
call fcn.00463236
mov esi, eax
add esp, 0x10
test esi, esi
je 0x46359a
push dword [ebp + 8]
mov ecx, esi
call dword [0x47e614]
call esi
jmp 0x4635a0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x4635e4
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4896fc
push 0x4896f4
push str.FlsGetValue
push 0x20
call fcn.00463236
mov esi, eax
add esp, 0x10
test esi, esi
je 0x46361b
push dword [ebp + 8]
mov ecx, esi
call dword [0x47e614]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]