joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4126bc
Capabilities:
Get common file path

Disassembly:
mov eax, 0x44fb7c
call fcn.00430f1c
push ecx
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x14], esi
call fcn.00442902
xor edi, edi
mov dword [esi], method.CStatic.virtual_0
mov dword [ebp - 4], edi
mov dword [esi + 0x6c], edi
mov dword [esi + 0x68], vtable.CFont.0
lea ecx, [esi + 0x74]
mov byte [ebp - 4], 1
call fcn.004407a3
lea ecx, [esi + 0x88]
mov byte [ebp - 4], 2
call fcn.004407e6
mov ebx, dword [sym.imp.USER32.dll_GetSysColor]
push 0xf
mov byte [ebp - 4], 3
call ebx
push 8
mov dword [esi + 0x50], eax
call ebx
push 0xffffffffffffffff
push edi
lea ecx, [esi + 0x74]
mov dword [esi + 0x54], eax
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x64], edi
mov dword [esi + 0x9c], edi
mov dword [esi + 0xa0], edi
mov dword [esi + 0xa4], edi
mov dword [esi + 0xa8], edi
mov dword [esi + 0x70], edi
call fcn.00440657
push 0xffffffffffffffff
push edi
lea ecx, [esi + 0x88]
call fcn.00440858
call fcn.00445f82
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
push 0x410
push 0x411
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 4
call fcn.00401640
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.0040dc60
push str.winhlp32.exe
lea ecx, [ebp - 0x10]
call fcn.004091b0
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
cmp ebx, edi
je 0x4127cc
push 0x6a
push ebx
call dword [sym.imp.USER32.dll_LoadCursorA]
cmp eax, edi
je 0x4127cc
push eax
call dword [sym.imp.USER32.dll_CopyIcon]
mov dword [esi + 0xa4], eax
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00401260
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x4126c9
Capabilities:
Get common file path

Disassembly:
mov eax, 0x44fb7c
call fcn.00430f1c
push ecx
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x14], esi
call fcn.00442902
xor edi, edi
mov dword [esi], method.CStatic.virtual_0
mov dword [ebp - 4], edi
mov dword [esi + 0x6c], edi
mov dword [esi + 0x68], vtable.CFont.0
lea ecx, [esi + 0x74]
mov byte [ebp - 4], 1
call fcn.004407a3
lea ecx, [esi + 0x88]
mov byte [ebp - 4], 2
call fcn.004407e6
mov ebx, dword [sym.imp.USER32.dll_GetSysColor]
push 0xf
mov byte [ebp - 4], 3
call ebx
push 8
mov dword [esi + 0x50], eax
call ebx
push 0xffffffffffffffff
push edi
lea ecx, [esi + 0x74]
mov dword [esi + 0x54], eax
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x64], edi
mov dword [esi + 0x9c], edi
mov dword [esi + 0xa0], edi
mov dword [esi + 0xa4], edi
mov dword [esi + 0xa8], edi
mov dword [esi + 0x70], edi
call fcn.00440657
push 0xffffffffffffffff
push edi
lea ecx, [esi + 0x88]
call fcn.00440858
call fcn.00445f82
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
push 0x410
push 0x411
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 4
call fcn.00401640
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.0040dc60
push str.winhlp32.exe
lea ecx, [ebp - 0x10]
call fcn.004091b0
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
cmp ebx, edi
je 0x4127cc
push 0x6a
push ebx
call dword [sym.imp.USER32.dll_LoadCursorA]
cmp eax, edi
je 0x4127cc
push eax
call dword [sym.imp.USER32.dll_CopyIcon]
mov dword [esi + 0xa4], eax
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00401260
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x41455a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push edi
lea eax, [ebp - 4]
push eax
push 1
xor ebx, ebx
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 4], ebx
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, eax
cmp edi, ebx
mov eax, dword [ebp + 0x10]
mov byte [eax], bl
jne 0x4145d7
push esi
mov esi, dword [ebp + 0x14]
lea eax, [ebp + 0xf]
push eax
lea eax, [esi + 1]
push eax
lea ecx, [ebp - 0x14]
mov dword [ebp + 8], esi
mov byte [ebp + 0xf], bl
call fcn.0040c1d0
lea eax, [ebp + 8]
push eax
push dword [ebp - 0x10]
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov edi, eax
cmp edi, ebx
jne 0x4145ce
push esi
push dword [ebp - 0x10]
push dword [ebp + 0x10]
call fcn.00430f3b
add esp, 0xc
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x14]
call fcn.0040a8c0
pop esi
mov eax, edi
pop edi
pop ebx
leave
ret 0x10
Function at 0x41705d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 2
push dword [ebp + 0xc]
mov dword [ebp - 4], ecx
push dword [ebp + 8]
xor esi, esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x4170e0
push edi
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push 0
mov esi, eax
call dword [sym.imp.USER32.dll_GetDC]
mov ecx, dword [ebp - 4]
mov edi, eax
lea eax, [ebp + 8]
push eax
push esi
call fcn.00416fbd
test eax, eax
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
je 0x4170be
push 0
push eax
push edi
call dword [sym.imp.GDI32.dll_SelectPalette]
push edi
call dword [sym.imp.GDI32.dll_RealizePalette]
mov eax, dword [ebp + 8]
push 0
push esi
lea eax, [esi + eax*4]
add eax, dword [esi]
push eax
push 4
push esi
push edi
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
push edi
push 0
mov esi, eax
call dword [sym.imp.USER32.dll_ReleaseDC]
pop edi
mov eax, esi
pop esi
leave
ret 0xc
Function at 0x418113
Capabilities:
Get file version info

Disassembly:
mov eax, 0x45068b
call fcn.00430f1c
sub esp, 0x43c
mov eax, dword [0x4697fc]
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x438], ebx
xor eax, eax
mov byte [ebp - 0x424], bl
mov ecx, 0x104
lea edi, [ebp - 0x423]
rep stosd dword es:[edi], eax
push 0x410
lea eax, [ebp - 0x424]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x434]
push eax
lea eax, [ebp - 0x424]
push eax
mov dword [ebp - 0x434], ebx
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
cmp esi, ebx
jne 0x4181a8
lea eax, [ebp - 0x434]
push eax
lea eax, [ebp - 0x424]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
cmp esi, ebx
jne 0x4181a8
mov ecx, dword [ebp + 8]
push 0x45327c
call fcn.004019e0
jmp 0x418288
lea eax, [ebp - 0x425]
push eax
push esi
lea ecx, [ebp - 0x448]
mov byte [ebp - 0x425], bl
call fcn.004180ea
push dword [ebp - 0x444]
lea eax, [ebp - 0x424]
push esi
push ebx
push eax
mov dword [ebp - 4], ebx
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x41820a
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x430]
push eax
push 0x452e5c
push dword [ebp - 0x444]
mov dword [ebp - 0x438], ebx
mov dword [ebp - 0x430], ebx
call sub.VERSION.dll_VerQueryValueA
test eax, eax
jne 0x418219
mov ecx, dword [ebp + 8]
push 0x45327c
call fcn.004019e0
jmp 0x41827d
call fcn.00445f82
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x42c], eax
mov eax, dword [ebp - 0x430]
movzx ecx, word [eax + 0x14]
push ecx
movzx ecx, word [eax + 0x16]
push ecx
movzx ecx, word [eax + 0x10]
movzx eax, word [eax + 0x12]
push ecx
push eax
lea eax, [ebp - 0x42c]
push str._d._d._d._d
push eax
mov byte [ebp - 4], 1
call fcn.004019c0
mov ecx, dword [ebp + 8]
add esp, 0x18
lea eax, [ebp - 0x42c]
push eax
call fcn.00402320
mov ecx, dword [ebp - 0x42c]
add ecx, 0xfffffff0
call fcn.00401260
lea ecx, [ebp - 0x448]
call fcn.0041f062
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop ebx
call fcn.0042ea18
leave
ret 4
Function at 0x41a770
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [0x46b304]
sub esp, 0xc
test eax, eax
mov dword [0x46b300], 0
je 0x41a78c
xor eax, eax
add esp, 0xc
ret
mov eax, 0x46b310
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41a794
sub eax, edx
push esi
mov dword [esp + 0xc], eax
jne 0x41a831
lea eax, [esp + 4]
push eax
push 1
xor esi, esi
push esi
push str.CLSID0280750F_22B0_46fd_BCCA_99B3BF28765EInprocServer32
push SysReAllocString
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x41a815
lea ecx, [esp + 0xc]
push ecx
push 0x46b310
lea edx, [esp + 0x10]
push edx
push eax
push eax
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x18]
push eax
mov dword [esp + 0x24], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x41a806
cmp dword [esp + 8], 1
jne 0x41a806
mov esi, 1
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x41a831
mov eax, dword [0x46b300]
test eax, eax
jle 0x41a827
mov word [0x46b302], 0x8007
mov eax, 0x80004005
pop esi
add esp, 0xc
ret
push 0x46b310
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [0x46b304], eax
je 0x41a815
xor eax, eax
pop esi
add esp, 0xc
ret

Function at 0x41b311
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x4697fc]
push esi
mov dword [ebp - 4], eax
lea eax, [ebp - 0x41c]
push eax
push 1
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x41b396
push edi
mov byte [ebp - 0x418], al
mov ecx, 0x104
lea edi, [ebp - 0x417]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x418]
push eax
push esi
push dword [ebp - 0x41c]
mov dword [ebp - 0x420], 0x410
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
lea eax, [ebp - 0x418]
push eax
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [ebp - 0x41c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
call fcn.0042ea18
leave
ret
Function at 0x41b7bf
Capabilities:
Get common file path

Disassembly:
mov eax, 0x450a0b
call fcn.00430f1c
push ecx
push edi
mov edi, ecx
cmp dword [edi + 0x80], 0
jne 0x41b864
push ebx
push esi
call fcn.00445f82
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
and dword [ebp - 4], 0
mov eax, 0x410
push eax
push eax
lea ecx, [ebp - 0x10]
call fcn.00401640
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.0040dc60
push str.winhlp32.exe
lea ecx, [ebp - 0x10]
call fcn.004091b0
mov ebx, dword [ebp - 0x10]
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x41b853
push 0x6a
push esi
call dword [sym.imp.USER32.dll_LoadCursorA]
test eax, eax
je 0x41b853
push eax
call dword [sym.imp.USER32.dll_CopyIcon]
mov dword [edi + 0x80], eax
mov dword [edi + 0xf0], 1
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [ebx - 0x10]
call fcn.00401260
pop esi
pop ebx
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
leave
ret

Function at 0x41cf09
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [esp + 0xc]
push eax
push 4
push 0
push dword [esp + 0x14]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
ret 8

Function at 0x41d55e
Capabilities:
Link many functions at runtime

Disassembly:
mov eax, 0x450c00
call fcn.00430f1c
push ecx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
mov eax, dword [ebp + 8]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
and dword [ebp - 4], 0
push str.DrawThemeParentBackground
push eax
mov dword [esi], 0x4561b0
mov dword [esi + 4], eax
call edi
push str.OpenThemeData
push dword [esi + 4]
mov dword [esi + 8], eax
call edi
push str.EnableTheming
push dword [esi + 4]
mov dword [esi + 0xc], eax
call edi
push str.GetWindowTheme
push dword [esi + 4]
mov dword [esi + 0x10], eax
call edi
push str.DrawThemeBackground
push dword [esi + 4]
mov dword [esi + 0x14], eax
call edi
push str.DrawThemeText
push dword [esi + 4]
mov dword [esi + 0x18], eax
call edi
push str.DrawThemeIcon
push dword [esi + 4]
mov dword [esi + 0x1c], eax
call edi
push str.DrawThemeEdge
push dword [esi + 4]
mov dword [esi + 0x20], eax
call edi
mov dword [esi + 0x24], eax
mov eax, dword [esi + 0x10]
test eax, eax
je 0x41d5f7
push 1
call eax
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x41f9a3
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x450c62
call fcn.00430f1c
push ecx
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi]
mov dword [esi], eax
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [edi + 0x10]
mov dword [esi + 0x10], eax
lea eax, [edi + 0x14]
push eax
lea ecx, [esi + 0x14]
mov dword [ebp - 0x10], esi
call fcn.0041f7c7
and dword [ebp - 4], 0
lea eax, [edi + 0x30]
push eax
lea ecx, [esi + 0x30]
call fcn.0041f7c7
add edi, 0x4c
push edi
lea ecx, [esi + 0x4c]
mov byte [ebp - 4], 1
call fcn.0041f7c7
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x421f71
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [ecx], 0xffffffff
mov eax, dword [0x4697fc]
mov dword [ebp - 4], eax
je 0x421fae
call fcn.00421f0a
push 7
lea ecx, [ebp - 0xc]
push ecx
movzx eax, ax
push 0x1004
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x421fae
lea eax, [ebp - 0xc]
push eax
call fcn.004310d1
pop ecx
jmp 0x421fb0
xor eax, eax
mov ecx, dword [ebp - 4]
call fcn.0042ea18
leave
ret

Function at 0x422118
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x4697fc]
push edi
push 0
push dword [ebp + 0xc]
mov dword [ebp - 4], eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov edi, eax
test edi, edi
jne 0x422146
mov edi, dword [ebp + 8]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [ebp + 8]
jmp 0x4221ce
push esi
push edi
call fcn.0042ffc6
mov esi, eax
test esi, esi
pop ecx
jne 0x422160
mov edi, dword [ebp + 8]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [ebp + 8]
jmp 0x4221cd
push esi
push edi
push 0
push dword [ebp + 0xc]
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x422187
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x452e5c
push esi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
jne 0x42219b
push esi
call fcn.0042e976
mov edi, dword [ebp + 8]
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [ebp + 8]
jmp 0x4221cc
mov eax, dword [ebp - 0x14]
movzx ecx, word [eax + 0x14]
push ecx
movzx ecx, word [eax + 0x16]
push ecx
movzx ecx, word [eax + 0x10]
movzx eax, word [eax + 0x12]
push ecx
push eax
lea ecx, [ebp - 0x10]
call fcn.0042202b
push esi
call fcn.0042e976
mov eax, dword [ebp + 8]
lea esi, [ebp - 0x10]
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
pop ecx
pop esi
mov ecx, dword [ebp - 4]
pop edi
call fcn.0042ea18
leave
ret
Function at 0x422ded
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x4510b0
call fcn.00430f1c
sub esp, 0x84
mov eax, dword [0x4697fc]
mov dword [ebp - 0x10], eax
push esi
mov eax, dword [ebp + 0x10]
xor esi, esi
cmp dword [ebp + 0x24], 0x10
mov dword [ebp - 4], esi
jae 0x422e17
lea eax, [ebp + 0x10]
lea ecx, [ebp - 0x4c]
push ecx
push 0x20019
push esi
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x422f7c
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x54]
push eax
push esi
lea eax, [ebp - 0x50]
push eax
push esi
push dword [0x4686d0]
push dword [ebp - 0x4c]
call edi
test eax, eax
jne 0x422f72
cmp dword [ebp - 0x50], 1
jne 0x422f72
mov eax, dword [ebp - 0x54]
inc eax
push ebx
push eax
call fcn.004461d5
pop ecx
mov ebx, eax
lea eax, [ebp - 0x54]
push eax
push ebx
lea eax, [ebp - 0x50]
push eax
push esi
push dword [0x4686d0]
push dword [ebp - 0x4c]
call edi
push ebx
lea ecx, [ebp - 0x48]
call fcn.00403400
push ebx
call fcn.004461da
pop ecx
xor ebx, ebx
push ebx
push 0x457a9c
lea ecx, [ebp - 0x48]
call fcn.0040a410
push esi
lea ecx, [ebp - 0x2c]
mov edi, eax
mov dword [ebp - 0x14], 0xf
call fcn.00403790
cmp edi, 0xffffffff
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x48]
jne 0x422eef
push edi
push ebx
lea eax, [ebp - 0x74]
push eax
call fcn.00405150
push edi
push esi
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 3
call fcn.00402f40
push esi
push 1
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 2
call fcn.00402bc0
jmp 0x422f26
mov eax, edi
sub eax, ebx
push eax
push ebx
lea eax, [ebp - 0x90]
push eax
call fcn.00405150
push 0xffffffffffffffff
push esi
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 4
call fcn.00402f40
push esi
push 1
lea ecx, [ebp - 0x90]
mov byte [ebp - 4], 2
call fcn.00402bc0
lea ebx, [edi + 1]
cmp dword [ebp - 0x18], esi
je 0x422f4e
cmp dword [ebp - 0x14], 0x10
mov eax, dword [ebp - 0x28]
jae 0x422f37
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.00422072
push dword [eax]
push dword [ebp + 8]
call fcn.00422d4f
add esp, 0x10
push esi
push 1
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.00402bc0
cmp edi, 0xffffffff
jne 0x422e98
push esi
push 1
lea ecx, [ebp - 0x48]
call fcn.00402bc0
pop ebx
push dword [ebp - 0x4c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
push esi
push 1
lea ecx, [ebp + 0xc]
call fcn.00402bc0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop esi
call fcn.0042ea18
leave
ret
Function at 0x426551
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
je 0x4265a4
call fcn.0044b1e8
mov edi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, ebx
je 0x4265a4
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebx
mov dword [ebp - 8], eax
jne 0x42659a
xor eax, eax
jmp 0x4266bd
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], ebx
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0xc], 1
je 0x4265d4
mov eax, dword [esi]
push edi
push dword [ebp - 4]
mov ecx, esi
push ebx
call dword [eax + 0x1c]
cmp dword [ebp - 8], 0
mov dword [ebp - 0xc], eax
je 0x4265d4
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebx + 0x48]
test eax, eax
je 0x4266ba
mov ecx, dword [eax + 0x40]
and dword [ebp + 0xc], 0
test ecx, ecx
mov dword [ebp + 8], ecx
mov dword [ebp - 8], ecx
je 0x426601
lea ecx, [eax + 0x3c]
lea eax, [ebp + 8]
push eax
call fcn.0042737c
mov eax, dword [eax]
mov dword [ebp + 0xc], eax
xor eax, eax
cmp dword [edi + 8], eax
mov dword [ebp - 4], eax
jbe 0x4266ba
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x42664a
mov ecx, dword [ecx + 4]
mov edx, dword [edi + 0xc]
mov ecx, dword [ecx + 0x28]
cmp ecx, dword [edx + eax*8]
jne 0x42664a
mov eax, dword [ebp + 8]
test eax, eax
mov dword [ebp - 8], eax
je 0x426644
mov ecx, dword [ebx + 0x48]
lea eax, [ebp + 8]
add ecx, 0x3c
push eax
call fcn.0042737c
mov eax, dword [eax]
mov dword [ebp + 0xc], eax
jmp 0x4266aa
and dword [ebp + 0xc], 0
jmp 0x4266aa
mov ecx, dword [edi + 0xc]
shl eax, 3
cmp dword [eax + ecx], 0
mov dword [ebp - 0x10], eax
je 0x4266aa
push 0xc
call fcn.004461aa
mov esi, eax
test esi, esi
pop ecx
je 0x42668c
mov eax, dword [edi + 0xc]
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebx + 0x1c]
add eax, edx
push dword [eax]
mov edi, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
and dword [esi + 4], 0
mov dword [esi + 8], edi
mov edi, dword [ebp + 0x10]
mov dword [esi], eax
jmp 0x42668e
xor esi, esi
mov ecx, dword [ebx + 0x48]
add ecx, 0x3c
cmp dword [ebp - 8], 0
push esi
je 0x4266a5
push dword [ebp - 8]
call fcn.00440bd4
jmp 0x4266aa
call fcn.00440bab
mov eax, dword [ebp - 4]
inc eax
cmp eax, dword [edi + 8]
mov dword [ebp - 4], eax
jb 0x42660f
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x43069c
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.00430780
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x430737
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x46d484]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x430737
cmp eax, 1
je 0x430758
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x430737
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x430704
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x430733
xor eax, eax
inc eax
jmp 0x430777
cmp edi, eax
jae 0x43073b
xor eax, eax
jmp 0x430777
cmp eax, esi
jae 0x430742
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x46d484]
jmp 0x43075b
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret