joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41dcd0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x605bb8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
push ebx
push ebp
push esi
push edi
mov ebp, ecx
xor ebx, ebx
mov dword [esp + 0x48], ebx
call fcn.0041e570
lea ecx, [esp + 0x20]
call fcn.004097d0
mov eax, dword [0x69cfe8]
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x50]
mov byte [esp + 0x48], 2
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x41dd69
lea ecx, [esp + 0x10]
mov byte [esp + 0x48], 1
call fcn.005eb9e1
mov dword [esp + 0x20], vtable.CArray_class_CFileInfo__class_CFileInfo__.0
mov esi, dword [esp + 0x24]
mov byte [esp + 0x48], 3
cmp esi, ebx
je 0x41ded3
mov eax, dword [esp + 0x28]
cmp eax, ebx
je 0x41deca
lea edi, [eax]
push 0
mov ecx, esi
call fcn.0040abe0
add esi, 0x38
dec edi
jne 0x41dd55
jmp 0x41dec6
push 0x6723a0
lea ecx, [esp + 0x54]
call fcn.005e7fba
push 0x6723a0
lea ecx, [esp + 0x54]
call fcn.005ebdbd
push ebx
push ebx
push ebx
push ebx
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push str..tns
call fcn.005eba4f
push ecx
lea edx, [esp + 0x6c]
mov ecx, esp
mov dword [esp + 0x30], esp
push edx
mov byte [esp + 0x68], 4
call fcn.005eb756
lea ecx, [esp + 0x3c]
mov byte [esp + 0x64], 2
call fcn.00409c20
mov eax, dword [esp + 0x28]
mov dword [esp + 0x14], ebx
cmp eax, ebx
jle 0x41de8c
mov eax, dword [esp + 0x24]
lea ecx, [ebx + eax + 4]
push ecx
lea ecx, [esp + 0x14]
call fcn.005ebb1a
push ecx
lea edx, [esp + 0x14]
mov ecx, esp
mov dword [esp + 0x20], esp
push edx
call fcn.005eb756
mov ecx, ebp
call fcn.0041df70
test eax, eax
je 0x41de74
push 0xc
call fcn.005eb722
mov esi, eax
add esp, 4
test esi, esi
je 0x41de74
mov eax, dword [0x69cfe8]
lea ecx, [esi + 4]
lea edi, [esi + 8]
mov dword [ecx], eax
mov edx, dword [0x69cfe8]
lea eax, [esp + 0x10]
mov dword [edi], edx
push eax
mov dword [esi], vtable.CIRTransitionDLLInfo.0
call fcn.005ebb1a
push ecx
lea edx, [esp + 0x14]
mov ecx, esp
mov dword [esp + 0x20], esp
push edx
call fcn.005eb756
lea eax, [esp + 0x1c]
mov ecx, ebp
push eax
call fcn.0041e080
push eax
mov ecx, edi
mov byte [esp + 0x4c], 5
call fcn.005ebb1a
lea ecx, [esp + 0x18]
mov byte [esp + 0x48], 2
call fcn.005eb9e1
push esi
lea ecx, [ebp + 4]
call fcn.005eb118
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x28]
inc eax
add ebx, 0x38
cmp eax, ecx
mov dword [esp + 0x14], eax
jl 0x41ddd0
lea ecx, [esp + 0x10]
mov byte [esp + 0x48], 1
call fcn.005eb9e1
mov dword [esp + 0x20], vtable.CArray_class_CFileInfo__class_CFileInfo__.0
mov esi, dword [esp + 0x24]
mov byte [esp + 0x48], 6
test esi, esi
je 0x41ded3
mov eax, dword [esp + 0x28]
test eax, eax
je 0x41deca
lea edi, [eax]
mov ecx, esi
call fcn.004090b0
add esi, 0x38
dec edi
jne 0x41deb9
mov esi, dword [esp + 0x24]
push esi
call fcn.005eb74b
add esp, 4
lea ecx, [esp + 0x50]
mov dword [esp + 0x48], 0xffffffff
call fcn.005eb9e1
mov ecx, dword [esp + 0x40]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x3c
ret 4
Function at 0x41edb0
Capabilities:
Delete directory
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x605e30
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov eax, dword [0x69cfe8]
push ebx
push ebp
mov ebp, ecx
push esi
push edi
mov dword [esp + 0x24], ebp
mov dword [esp + 0x14], eax
xor edi, edi
mov dword [esp + 0x10], eax
mov dword [esp + 0x30], edi
mov bl, 1
push str.gdi32.dll
mov byte [esp + 0x34], bl
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
cmp esi, edi
mov dword [esp + 0x20], esi
je 0x41ee0e
push str.RemoveFontResourceExA
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
mov ebp, dword [ebp + 8]
test ebp, ebp
je 0x41eed2
mov eax, ebp
mov ebp, dword [ebp]
mov eax, dword [eax + 8]
test eax, eax
je 0x41eec6
lea esi, [eax + 0x24]
mov eax, dword [eax + 0x24]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x41eec6
push str..TFT
lea ecx, [esp + 0x1c]
push esi
push ecx
call fcn.005ebc76
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x34], 2
call fcn.005ebb1a
lea ecx, [esp + 0x18]
mov byte [esp + 0x30], bl
call fcn.005eb9e1
push str..FON
lea edx, [esp + 0x20]
push esi
push edx
call fcn.005ebc76
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x34], 3
call fcn.005ebb1a
lea ecx, [esp + 0x1c]
mov byte [esp + 0x30], bl
call fcn.005eb9e1
test edi, edi
je 0x41eea3
mov eax, dword [esp + 0x14]
push 0
push 0x10
push eax
call edi
jmp 0x41eeae
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.GDI32.dll_RemoveFontResourceA]
test eax, eax
je 0x41eec6
mov edx, dword [esp + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push edx
call esi
mov eax, dword [esp + 0x14]
push eax
call esi
test ebp, ebp
jne 0x41ee19
mov esi, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
mov eax, dword [ecx + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test esi, esi
je 0x41eeeb
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [esp + 0x10]
mov byte [esp + 0x30], 0
call fcn.005eb9e1
lea ecx, [esp + 0x14]
mov dword [esp + 0x30], 0xffffffff
call fcn.005eb9e1
mov ecx, dword [esp + 0x28]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret

Function at 0x41ef20
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x605e4b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10c
mov eax, dword [0x69cfe8]
push esi
push edi
mov esi, ecx
mov dword [esp + 8], eax
lea ecx, [esp + 0x10]
mov dword [esp + 0x11c], 0
push ecx
push 0x104
mov edi, 1
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea edx, [esp + 0x10]
lea ecx, [esp + 8]
push edx
call fcn.005ebb6a
push 0x6723a0
lea ecx, [esp + 0xc]
call fcn.005e7fba
add esi, 0x20
mov eax, dword [esp + 8]
push edi
push eax
push str._s_ir_tmpfnt__d
push esi
call fcn.005e7f5e
mov eax, dword [esi]
push 0
push eax
call fcn.005cedd3
add esp, 0x18
test eax, eax
je 0x41efc2
push ecx
mov ecx, esp
mov dword [esp + 0x10], esp
push esi
call fcn.005eb756
call fcn.0040eb80
add esp, 4
test eax, eax
jne 0x41efc5
inc edi
jmp 0x41ef87
lea ecx, [esp + 8]
mov dword [esp + 0x11c], 0xffffffff
call fcn.005eb9e1
mov ecx, dword [esp + 0x114]
pop edi
mov dword fs:[0], ecx
pop esi
add esp, 0x118
ret
Function at 0x420230
Capabilities:
Terminate process

Disassembly:
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x42027c
mov edx, dword [esi + 4]
lea ecx, [esp + 4]
push ecx
push edx
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov eax, dword [esp + 4]
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
je 0x42027c
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ecx
ret
Function at 0x423140
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x60660f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
mov dword [esp + 0x24], 0
push 0x6a1e40
lea ecx, [esp + 0xc]
mov dword [esp + 0x34], 1
call fcn.005eba4f
mov eax, dword [esp + 0x40]
mov bl, 2
sub eax, 0
mov byte [esp + 0x30], bl
je 0x4232c8
dec eax
je 0x423255
dec eax
jne 0x42333a
lea eax, [esp + 0x40]
push 7
push eax
lea ecx, [esp + 0x44]
call fcn.005e7b3e
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x34], 7
call fcn.005ebb1a
lea ecx, [esp + 0x40]
mov byte [esp + 0x30], bl
call fcn.005eb9e1
mov ecx, dword [esp + 8]
push str.http:__
push ecx
call fcn.005cf1ee
add esp, 8
test eax, eax
je 0x42333a
lea edx, [esp + 0xc]
push 8
push edx
lea ecx, [esp + 0x44]
call fcn.005e7b3e
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x34], 8
call fcn.005ebb1a
lea ecx, [esp + 0xc]
mov byte [esp + 0x30], bl
call fcn.005eb9e1
mov eax, dword [esp + 8]
push str.https:__
push eax
call fcn.005cf1ee
add esp, 8
test eax, eax
je 0x42333a
lea ecx, [esp + 0x3c]
lea edx, [esp + 0x10]
push ecx
push str.https:__
push edx
call fcn.005ebcea
push eax
lea ecx, [esp + 0x40]
mov byte [esp + 0x34], 9
call fcn.005ebb1a
mov byte [esp + 0x30], bl
lea ecx, [esp + 0x10]
jmp 0x423335
lea eax, [esp + 0x14]
push 7
push eax
lea ecx, [esp + 0x44]
call fcn.005e7b3e
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x34], 5
call fcn.005ebb1a
lea ecx, [esp + 0x14]
mov byte [esp + 0x30], bl
call fcn.005eb9e1
mov ecx, dword [esp + 8]
push str.http:__
push ecx
call fcn.005cf1ee
add esp, 8
test eax, eax
je 0x42333a
lea edx, [esp + 0x3c]
lea eax, [esp + 0x18]
push edx
push str.http:__
push eax
call fcn.005ebcea
push eax
lea ecx, [esp + 0x40]
mov byte [esp + 0x34], 6
call fcn.005ebb1a
mov byte [esp + 0x30], bl
lea ecx, [esp + 0x18]
jmp 0x423335
lea ecx, [esp + 0x1c]
push 6
push ecx
lea ecx, [esp + 0x44]
call fcn.005e7b3e
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x34], 3
call fcn.005ebb1a
lea ecx, [esp + 0x1c]
mov byte [esp + 0x30], bl
call fcn.005eb9e1
mov edx, dword [esp + 8]
push str.ftp:__
push edx
call fcn.005cf1ee
add esp, 8
test eax, eax
je 0x42333a
lea eax, [esp + 0x3c]
lea ecx, [esp + 0x20]
push eax
push str.ftp:__
push ecx
call fcn.005ebcea
push eax
lea ecx, [esp + 0x40]
mov byte [esp + 0x34], 4
call fcn.005ebb1a
mov byte [esp + 0x30], bl
lea ecx, [esp + 0x20]
call fcn.005eb9e1
mov esi, dword [esp + 0x38]
lea edx, [esp + 0x3c]
push edx
mov ecx, esi
call fcn.005eb756
mov dword [esp + 0x24], 1
lea ecx, [esp + 8]
mov byte [esp + 0x30], 1
call fcn.005eb9e1
lea ecx, [esp + 0x3c]
mov byte [esp + 0x30], 0
call fcn.005eb9e1
mov ecx, dword [esp + 0x28]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x2c
ret 0xc
Function at 0x42be80
Capabilities:
Check os version
Compare security identifiers

Disassembly:
sub esp, 0xac
push ebx
push ebp
push esi
lea eax, [esp + 0x24]
push edi
push eax
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x42beb9
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xac
ret
cmp dword [esp + 0x38], 2
je 0x42bed0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xac
ret
cmp dword [esp + 0x2c], 6
jb 0x42bedf
mov dword [esp + 0x24], 1
lea ecx, [esp + 0x10]
mov byte [esp + 0x14], 0
push ecx
push 1
push 8
mov byte [esp + 0x21], 0
mov byte [esp + 0x22], 0
mov byte [esp + 0x23], 0
mov byte [esp + 0x24], 0
mov byte [esp + 0x25], 5
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x42bf56
call ebp
cmp eax, 0x3f0
je 0x42bf33
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xac
ret
lea edx, [esp + 0x10]
push edx
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x42bf56
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xac
ret
push 0x1000
call fcn.005cec99
mov ecx, dword [esp + 0x14]
mov ebx, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
add esp, 4
mov esi, eax
lea eax, [esp + 0x1c]
push eax
push 0x1000
push esi
push 2
push ecx
call ebx
mov edi, eax
call ebp
test edi, edi
jne 0x42bfb4
cmp eax, 0x7a
jne 0x42bfb4
mov edx, dword [esp + 0x1c]
push edx
push esi
call fcn.005d028f
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x18]
add esp, 8
mov esi, eax
lea eax, [esp + 0x1c]
push eax
push ecx
push esi
push 2
push edx
call ebx
mov edi, eax
call ebp
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
jne 0x42bfd9
push esi
call fcn.005cebb0
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xac
ret
lea ecx, [esp + 0x20]
lea edx, [esp + 0x14]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
push edx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x42c018
push esi
call fcn.005cebb0
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xac
ret
mov eax, dword [esi]
xor ebx, ebx
xor edi, edi
test eax, eax
jbe 0x42c049
lea ebp, [esi + 4]
mov eax, dword [ebp]
mov ecx, dword [esp + 0x20]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x42c044
mov eax, dword [esi]
inc edi
add ebp, 8
cmp edi, eax
jb 0x42c025
jmp 0x42c049
mov ebx, 1
mov edx, dword [esp + 0x20]
push edx
call dword [sym.imp.ADVAPI32.dll_FreeSid]
push esi
call fcn.005cebb0
mov eax, dword [esp + 0x28]
add esp, 4
test eax, eax
je 0x42c070
test ebx, ebx
je 0x42c070
call fcn.0042c080
mov ebx, eax
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0xac
ret
Function at 0x42c0f0
Capabilities:
Check os version
Compare security identifiers

Disassembly:
sub esp, 0xac
push ebx
push ebp
push esi
lea eax, [esp + 0x24]
push edi
push eax
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x42c129
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xac
ret
cmp dword [esp + 0x38], 2
je 0x42c140
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xac
ret
cmp dword [esp + 0x2c], 6
jb 0x42c14f
mov dword [esp + 0x24], 1
lea ecx, [esp + 0x10]
mov byte [esp + 0x14], 0
push ecx
push 1
push 8
mov byte [esp + 0x21], 0
mov byte [esp + 0x22], 0
mov byte [esp + 0x23], 0
mov byte [esp + 0x24], 0
mov byte [esp + 0x25], 5
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x42c1c6
call ebp
cmp eax, 0x3f0
je 0x42c1a3
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xac
ret
lea edx, [esp + 0x10]
push edx
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x42c1c6
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xac
ret
push 0x1000
call fcn.005cec99
mov ecx, dword [esp + 0x14]
mov ebx, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
add esp, 4
mov esi, eax
lea eax, [esp + 0x1c]
push eax
push 0x1000
push esi
push 2
push ecx
call ebx
mov edi, eax
call ebp
test edi, edi
jne 0x42c224
cmp eax, 0x7a
jne 0x42c224
mov edx, dword [esp + 0x1c]
push edx
push esi
call fcn.005d028f
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x18]
add esp, 8
mov esi, eax
lea eax, [esp + 0x1c]
push eax
push ecx
push esi
push 2
push edx
call ebx
mov edi, eax
call ebp
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
jne 0x42c249
push esi
call fcn.005cebb0
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xac
ret
lea ecx, [esp + 0x20]
lea edx, [esp + 0x14]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
push edx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x42c288
push esi
call fcn.005cebb0
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xac
ret
mov eax, dword [esi]
xor ebx, ebx
xor edi, edi
test eax, eax
jbe 0x42c2b9
lea ebp, [esi + 4]
mov eax, dword [ebp]
mov ecx, dword [esp + 0x20]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x42c2b4
mov eax, dword [esi]
inc edi
add ebp, 8
cmp edi, eax
jb 0x42c295
jmp 0x42c2b9
mov ebx, 1
mov edx, dword [esp + 0x20]
push edx
call dword [sym.imp.ADVAPI32.dll_FreeSid]
push esi
call fcn.005cebb0
mov eax, dword [esp + 0x28]
add esp, 4
test eax, eax
je 0x42c2e0
test ebx, ebx
je 0x42c2e0
call fcn.0042c2f0
mov ebx, eax
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0xac
ret
Function at 0x42c360
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag
Check os version
Get ntdll base address
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x606d38
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov ecx, 0x11
mov eax, 0xa
push edi
mov dword [esp + 0xc], esi
mov dword [esi + 4], vtable.CMap_class_CString__char_const___class_CISImageEx___class_CISImageEx__.0
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ecx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], eax
mov dword [esp + 0x20], ebx
mov dword [esi + 0x20], vtable.CMap_class_CString__char_const___class_CRect__class_CRect__.0
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ecx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], eax
push eax
lea ecx, [esi + 0x40]
mov byte [esp + 0x24], 1
mov byte [esi + 0x3c], bl
call fcn.005e9ec1
lea edi, [esi + 0x70]
push 0xa
mov ecx, edi
mov byte [esp + 0x24], 2
mov dword [esi + 0x5c], 0xffffffff
mov byte [esi + 0x60], bl
mov byte [esi + 0x61], bl
mov byte [esi + 0x62], bl
mov dword [esi + 0x64], ebx
mov byte [esi + 0x68], 1
mov dword [esi + 0x6c], ebx
call fcn.005e9ec1
lea ecx, [esi + 0x8c]
mov byte [esp + 0x20], 3
call fcn.005ea7d0
mov byte [esi + 0xa0], bl
mov byte [esi + 0xa1], bl
mov byte [esi + 0xa2], bl
mov dword [esi + 0xa4], ebx
mov dword [esi + 0xa8], ebx
mov dword [esi + 0xac], ebx
mov dword [esi + 0xb0], ebx
mov dword [esi + 0xb4], ebx
mov dword [esi + 0xb8], ebx
mov dword [esi + 0xbc], ebx
mov dword [esi + 0xc0], ebx
lea ecx, [esi + 0xd4]
mov byte [esp + 0x20], 4
mov dword [esi + 0xc4], ebx
mov dword [esi + 0xc8], 0xffffffff
mov dword [esi + 0xcc], ebx
mov dword [esi + 0xd0], 0xbb8
call fcn.0042ec90
push str..bmp
mov ecx, edi
mov byte [esp + 0x24], 5
mov byte [esi + 0x14c], bl
mov byte [esi + 0x14d], bl
mov byte [esi + 0x14e], bl
mov dword [esi + 0x150], 0x64
mov dword [esi + 0x154], 0x100
mov dword [esi + 0x158], 1
mov dword [esi + 0x15c], 0xff
mov dword [esi + 0x160], ebx
mov dword [esi + 0x164], ebx
mov dword [esi], vtable.CIRSlideShowCtrl.0
call fcn.005ea06a
push str..jpg
mov ecx, edi
call fcn.005ea06a
push str..pcx
mov ecx, edi
call fcn.005ea06a
push str..png
mov ecx, edi
call fcn.005ea06a
push str..tga
mov ecx, edi
call fcn.005ea06a
push str..tif
mov ecx, edi
call fcn.005ea06a
push str..wmf
mov ecx, edi
call fcn.005ea06a
push str..apm
mov ecx, edi
call fcn.005ea06a
push str..emf
mov ecx, edi
call fcn.005ea06a
push str..psd
mov ecx, edi
call fcn.005ea06a
push str..pcd
mov ecx, edi
call fcn.005ea06a
push str..gif
mov ecx, edi
call fcn.005ea06a
lea eax, [esp + 0x10]
push 8
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
mov eax, dword [esp + 0x10]
cmp eax, 0xa
mov ecx, eax
ja 0x42c57f
mov ecx, 0xa
mov edx, dword [esp + 0x14]
cmp ecx, edx
jae 0x42c593
cmp eax, 0xa
ja 0x42c595
mov eax, 0xa
jmp 0x42c595
mov eax, edx
mov ecx, esi
mov dword [esi + 0x150], eax
call fcn.0042d1c0
mov ecx, dword [esp + 0x18]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x42f210
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x60707f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push 0x6a1e40
lea ecx, [esp + 8]
mov dword [esp + 0xc], 0
call fcn.005eba4f
mov ecx, dword [esp + 0x20]
push 0
lea eax, [esp + 4]
push 0
push eax
push 0x400
push ecx
push 0
push 0x1100
mov dword [esp + 0x30], 1
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
mov eax, dword [esp]
test eax, eax
je 0x42f28b
push eax
lea ecx, [esp + 8]
call fcn.005ebb6a
mov edx, dword [esp]
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
push esi
mov esi, dword [esp + 0x20]
lea eax, [esp + 8]
mov ecx, esi
push eax
call fcn.005eb756
mov dword [esp + 0xc], 1
lea ecx, [esp + 8]
mov byte [esp + 0x18], 0
call fcn.005eb9e1
mov ecx, dword [esp + 0x10]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x18
ret

Function at 0x42f320
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x6070ae
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
mov eax, dword [0x69cfe8]
lea ebx, [esi + 0xc]
xor edi, edi
mov dword [esp + 0x18], edi
mov dword [ebx], eax
lea ecx, [esi + 0x44]
mov byte [esp + 0x18], 1
call fcn.005eab4c
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov dword [esi + 0x3c], ecx
push 0x6a1e40
mov ecx, ebx
mov byte [esp + 0x1c], 2
mov dword [esi], vtable.CThread.0
mov dword [esi + 0x40], edx
mov dword [esi + 0x20], edi
mov dword [esi + 0x30], edi
mov dword [esi + 8], edi
mov dword [esi + 4], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x34], 0xfffffffe
call fcn.005ebb6a
mov ecx, esi
call fcn.0042f4a0
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x4305e0
Capabilities:
Terminate thread

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x60722a
push eax
mov eax, dword [0x6a1e5c]
mov dword fs:[0], esp
push ebx
push ebp
push esi
push edi
test eax, eax
mov esi, ecx
je 0x43060b
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, esi
call fcn.004300a0
test eax, eax
jne 0x43063d
mov eax, dword [esi + 0x24]
test eax, eax
jne 0x43063d
mov eax, dword [esp + 0x20]
mov ecx, esi
mov dword [esi + 0x34], eax
call fcn.0042f4a0
mov eax, dword [0x6a1e5c]
test eax, eax
je 0x43071a
jmp 0x430713
mov eax, dword [esi + 0x24]
mov ebp, dword [esp + 0x20]
xor ebx, ebx
mov edi, 1
test eax, eax
je 0x430665
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov edi, eax
test edi, edi
jne 0x430665
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov ecx, esi
call fcn.0042fbf0
mov eax, dword [esp + 0x24]
test edi, edi
jne 0x4306e0
test eax, eax
jne 0x4306e4
push 0x14
call fcn.005eb722
mov edi, eax
add esp, 4
mov dword [esp + 0x20], edi
test edi, edi
mov dword [esp + 0x18], 0
je 0x4306b3
push 3
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push ebx
push ecx
call fcn.0042f210
add esp, 8
mov ecx, edi
push esi
call fcn.0042f110
mov esi, eax
jmp 0x4306b5
xor esi, esi
mov eax, dword [0x6a1e5c]
mov dword [esp + 0x18], 0xffffffff
test eax, eax
je 0x4306cd
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea edx, [esp + 0x20]
push 0x653cb0
push edx
mov dword [esp + 0x28], esi
call fcn.005d0fb1
test eax, eax
je 0x4306e7
mov dword [esi + 0x34], ebp
mov eax, dword [esi + 0x24]
test eax, eax
je 0x4306f5
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, esi
call fcn.0042f9a0
mov ecx, esi
call fcn.0042f4a0
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x10]
mov eax, dword [0x6a1e5c]
test eax, eax
je 0x43071a
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [esp + 0x10]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret 8

Function at 0x432910
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x124
lea eax, [esp + 0x10]
mov dword [esp], 3
push eax
mov dword [esp + 0x14], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x432960
cmp dword [esp + 0x20], 1
jne 0x432944
mov eax, dword [esp + 0x18]
test eax, eax
je 0x432960
lea ecx, [esp]
push 0
push ecx
push 0
push 0x68
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
mov eax, dword [esp]
add esp, 0x124
ret
lea edx, [esp + 4]
push edx
push 1
push 0
push str.Control_PanelDesktop
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4329cf
lea eax, [esp + 8]
lea ecx, [esp + 0xa4]
push eax
mov eax, dword [esp + 8]
lea edx, [esp + 0x10]
push ecx
push edx
push 0
push str.WheelScrollLines
push eax
mov dword [esp + 0x20], 0x80
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4329c4
push 0xa
lea ecx, [esp + 0xa8]
push eax
push ecx
call fcn.005d0251
add esp, 0xc
mov dword [esp], eax
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp]
add esp, 0x124
ret