joyce8/EMBER2024-capa huggingface dataset:
Function at 0x431ff0
Capabilities:
Get file size
Read file on windows
Set current directory

Disassembly:
sub esp, 0x420
mov eax, dword [0x4da6bc]
xor eax, esp
mov dword [esp + 0x41c], eax
mov eax, dword [esp + 0x428]
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x434]
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocStringLen
mov ebx, ecx
push edi
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x34], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x432076
push edi
lea edx, [esp + 0x20]
xor ecx, ecx
push 0x3afc
push edx
mov word [esp + 0x28], cx
call fcn.0042f7e0
mov ecx, dword [ebx + 0x24]
push 0x10
push 0x4ba1cc
lea eax, [esp + 0x30]
push eax
push ecx
call fcn.00436c30
add esp, 0x1c
xor al, al
jmp 0x432171
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
lea edx, [ebx + 1]
push edx
call fcn.0049f212
add esp, 4
mov ebp, eax
test ebx, ebx
je 0x4320a3
push 0
lea eax, [esp + 0x18]
push eax
push ebx
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
lea ecx, [esp + 0x18]
mov byte [ebx + ebp], 0
call fcn.0040cf30
mov ebx, dword [esp + 0x10]
lea ecx, [esp + 0x14]
lea esi, [ebx + 0x20]
push ecx
mov ecx, esi
call fcn.00402640
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4320eb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push edi
lea ecx, [esp + 0x14]
call fcn.00431f80
mov edi, dword [esi]
push edi
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
cmp word [eax], 0
jne 0x432109
or eax, 0xffffffff
jmp 0x43210d
sub eax, edi
sar eax, 1
mov esi, dword [esi]
lea ecx, [esi + eax*2 + 2]
push 0x4bdb00
push ecx
mov edi, 1
call fcn.0049ecda
add esp, 8
test eax, eax
jne 0x43212c
xor edi, edi
mov eax, dword [esp + 0x18]
push 0
push 0
push 0
push ecx
mov esi, esp
test eax, eax
jne 0x43218c
mov dword [esi], eax
push ecx
mov ecx, esp
push ebp
call fcn.004317f0
push edi
mov ecx, ebx
call fcn.00431ae0
push ebp
mov bl, al
call fcn.0049f207
mov esi, dword [esp + 0x14]
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push esi
call fcn.0049f207
add esp, 4
mov al, bl
mov ecx, dword [esp + 0x42c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0049e9d2
add esp, 0x420
ret 8
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [esi], eax
test eax, eax
jne 0x43213f
push 0x8007000e
call fcn.00401000
int3
Function at 0x435070
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x1c
push edi
mov edi, dword [esp + 0x24]
push 0x1c
lea eax, [esp + 8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x43508f
pop edi
add esp, 0x1c
ret
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
push esi
mov esi, dword [esp + 0xc]
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x4350af
pop esi
pop edi
add esp, 0x1c
ret
mov eax, dword [esi + 0x3c]
movzx ecx, word [eax + esi + 0x14]
add eax, esi
push ebx
push ebp
movzx ebp, word [eax + 6]
sub edi, esi
xor ebx, ebx
lea ecx, [ecx + eax + 0x18]
test ebp, ebp
jbe 0x4350f0
lea eax, [ecx + 0x10]
mov edi, edi
mov ecx, dword [eax]
mov edx, dword [eax - 8]
mov esi, dword [eax - 4]
cmp ecx, edx
ja 0x4350de
mov ecx, edx
cmp edi, esi
jb 0x4350e8
add ecx, esi
cmp edi, ecx
jbe 0x4350fa
inc ebx
add eax, 0x28
cmp ebx, ebp
jb 0x4350d0
pop ebp
pop ebx
pop esi
xor eax, eax
pop edi
add esp, 0x1c
ret
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x40]
inc ebx
pop ebp
mov dword [edx], ebx
sub edi, esi
pop ebx
mov dword [eax], edi
pop esi
mov eax, 1
pop edi
add esp, 0x1c
ret

Function at 0x435120
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x408
mov eax, dword [0x4da6bc]
xor eax, esp
mov dword [esp + 0x404], eax
mov ecx, dword [esp + 0x40c]
push esi
lea eax, [esp + 0x414]
push eax
push ecx
lea edx, [esp + 0x10]
push edx
call fcn.004a1a1b
mov edx, dword [0x4dd770]
add esp, 0xc
push 0
mov esi, eax
lea eax, [esp + 8]
push eax
push esi
lea ecx, [esp + 0x14]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esp + 0x408]
mov eax, esi
pop esi
xor ecx, esp
call fcn.0049e9d2
add esp, 0x408
ret

Function at 0x435540
Capabilities:
Create a process with modified i/o handles and window
Create process on windows

Disassembly:
sub esp, 0x54
push esi
push 0x44
lea eax, [esp + 0x18]
push 0
push eax
mov esi, ecx
call fcn.0049e9f0
mov ecx, dword [esp + 0x6c]
mov edx, dword [esp + 0x70]
mov eax, dword [esp + 0x74]
add esp, 0xc
mov dword [esp + 0x50], ecx
xor ecx, ecx
mov word [esp + 0x44], cx
mov ecx, dword [esi + 0x20]
mov dword [esp + 0x54], eax
mov dword [esp + 0x4c], edx
mov dword [esp + 0x14], 0x44
mov dword [esp + 0x40], 0x101
mov eax, dword [ecx - 0xc]
neg eax
sbb eax, eax
and eax, ecx
lea edx, [esp + 4]
push edx
mov edx, dword [esp + 0x60]
lea ecx, [esp + 0x18]
push ecx
push eax
push 0
push 0x10
push 1
push 0
push 0
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x4355bf
pop esi
add esp, 0x54
ret 0x10
mov ecx, dword [esp + 8]
mov eax, dword [esp + 4]
push ecx
mov dword [esi + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop esi
add esp, 0x54
ret 0x10
Function at 0x435620
Capabilities:
Terminate thread

Disassembly:
sub esp, 0x84
mov eax, dword [0x4da6bc]
xor eax, esp
mov dword [esp + 0x80], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
push edi
mov esi, ecx
xor edi, edi
cmp dword [esi + 4], edi
je 0x4356b5
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp eax, dword [esi + 0xc]
je 0x4356a8
mov eax, dword [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [esi + 4]
push 0x1388
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x4356a8
mov eax, dword [0x5144c8]
push 0x40
lea edx, [esp + 0x10]
push edx
push 0x3b07
push eax
call dword [sym.imp.USER32.dll_LoadStringW]
mov edx, dword [esi]
mov edx, dword [edx + 8]
push 0x4b0
lea eax, [esp + 0x10]
push eax
mov ecx, esi
call edx
mov eax, dword [esi + 4]
push 0xfffffffffffffffe
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [esi + 4]
cmp eax, edi
je 0x4356b5
push eax
call ebx
mov dword [esi + 4], edi
mov eax, dword [esi + 8]
cmp eax, edi
je 0x4356c2
push eax
call ebx
mov dword [esi + 8], edi
mov eax, dword [esi + 0x1c]
cmp eax, edi
je 0x4356cf
push eax
call ebx
mov dword [esi + 0x1c], edi
mov eax, dword [esi + 0x14]
cmp eax, edi
je 0x4356dc
push eax
call ebx
mov dword [esi + 0x14], edi
mov eax, dword [esi + 0x18]
cmp eax, edi
je 0x4356e9
push eax
call ebx
mov dword [esi + 0x18], edi
mov ecx, dword [esp + 0x8c]
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0049e9d2
add esp, 0x84
ret
Function at 0x435710
Capabilities:
Read file on windows
Read pipe

Disassembly:
sub esp, 0x8c
mov eax, dword [0x4da6bc]
xor eax, esp
mov dword [esp + 0x88], eax
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
xor ebx, ebx
push ebx
lea eax, [esp + 0x18]
push eax
push ebx
push ebx
mov esi, ecx
mov ecx, dword [esi + 0x18]
push ebx
push ecx
mov dword [esp + 0x2c], ebx
call edi
test eax, eax
je 0x4357b7
mov ebp, dword [sym.imp.KERNEL32.dll_ReadFile]
nop
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x4357fa
mov dword [esp + 0x10], ebx
cmp eax, 0x1ffe
jbe 0x43576c
mov eax, 0x1ffe
push ebx
lea edx, [esp + 0x14]
push edx
push eax
mov eax, dword [esi + 0x18]
push 0x4ddd88
push eax
call ebp
test eax, eax
je 0x4357b7
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x4357b7
mov byte [eax + 0x4ddd88], bl
mov edx, dword [esi]
mov eax, dword [edx + 4]
push 0xffffffffffffffff
push 0x4ddd88
mov ecx, esi
call eax
mov edx, dword [esi + 0x18]
push ebx
lea ecx, [esp + 0x18]
push ecx
push ebx
push ebx
push ebx
push edx
mov dword [esp + 0x2c], ebx
call edi
test eax, eax
jne 0x435750
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
je 0x435801
cmp eax, 0xe8
je 0x435801
mov ecx, dword [0x5144c8]
push 0x40
lea eax, [esp + 0x1c]
push eax
push 0x3b08
push ecx
call dword [sym.imp.USER32.dll_LoadStringW]
mov edx, dword [esi]
mov edx, dword [edx + 8]
push 0x4b0
lea eax, [esp + 0x1c]
push eax
mov ecx, esi
call edx
or eax, 0xffffffff
jmp 0x435824
mov eax, 1
jmp 0x435824
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x10]
push eax
push ecx
mov dword [esp + 0x18], ebx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov edx, dword [esi]
mov eax, dword [esp + 0x10]
mov edx, dword [edx + 0xc]
push eax
mov ecx, esi
call edx
xor eax, eax
mov ecx, dword [esp + 0x98]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0049e9d2
add esp, 0x8c
ret
Function at 0x435980
Capabilities:
Create pipe
Create thread
Create two anonymous pipes

Disassembly:
push ebp
lea ebp, [esp - 0xd4]
sub esp, 0xd4
push 0xfffffffffffffffe
push 0x4cdc70
push 0x49f4c0
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x4da6bc]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp + 0xd0], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x34], esi
mov eax, dword [ebp + 0xdc]
mov dword [ebp - 0x38], eax
mov edx, dword [esi]
push eax
mov eax, dword [edx + 0x10]
call eax
mov edx, dword [esi]
mov ecx, esi
mov eax, dword [edx + 0x14]
call eax
xor ebx, ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x44], 0xc
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x3c], 1
mov dword [ebp - 0x30], ebx
mov dword [ebp - 4], ebx
push ebx
lea ecx, [ebp - 0x44]
push ecx
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x435b26
push 2
push 1
push ebx
lea ecx, [ebp - 0x24]
push ecx
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call edi
push eax
mov edx, dword [ebp - 0x1c]
push edx
call edi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x435b26
push ebx
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x20]
push ecx
lea edx, [ebp - 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x435b26
push 2
push ebx
push ebx
lea eax, [esi + 0x18]
push eax
call edi
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
call edi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x435b26
push 2
push ebx
push ebx
lea edx, [esi + 0x14]
push edx
call edi
push eax
mov eax, dword [ebp - 0x20]
push eax
call edi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x435b26
lea ecx, [ebp - 0x2c]
push ecx
mov ecx, esi
call fcn.00435510
lea edx, [ebp - 0x20]
push edx
mov ecx, esi
call fcn.00435510
mov eax, dword [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x38]
push eax
mov ecx, esi
call fcn.00435540
test eax, eax
je 0x435b26
lea ecx, [ebp - 0x1c]
push ecx
mov ecx, esi
call fcn.00435510
lea edx, [ebp - 0x28]
push edx
mov ecx, esi
call fcn.00435510
lea eax, [ebp - 0x24]
push eax
mov ecx, esi
call fcn.00435510
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 8], eax
lea ecx, [esi + 0xc]
push ecx
push ebx
push esi
push 0x4358a0
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 4], eax
cmp eax, ebx
je 0x435b26
mov dword [ebp - 0x30], 1
mov dword [ebp - 4], 0xfffffffe
call fcn.00435b61
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0xd0]
xor ecx, ebp
call fcn.0049e9d2
add ebp, 0xd4
mov esp, ebp
pop ebp
ret 4
Function at 0x436dc0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
mov eax, dword [0x4da6bc]
xor eax, esp
mov dword [esp + 0x208], eax
push esi
mov esi, dword [esp + 0x214]
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0xe]
push ecx
mov word [esp + 0x10], ax
call fcn.0049e9f0
add esp, 0xc
lea edx, [esp + 4]
push edx
push 0x100
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x436e20
pop esi
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.0049e9d2
add esp, 0x20c
ret
push 0x4dfdc0
push 0
push esi
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov ecx, dword [esp + 0x20c]
neg eax
sbb eax, eax
pop esi
xor ecx, esp
and eax, 0x4dfdc0
call fcn.0049e9d2
add esp, 0x20c
ret

Function at 0x436eb0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
mov ecx, eax
sar ecx, 5
inc ecx
cmp eax, ecx
push esi
mov esi, eax
jl 0x436eee
mov edx, dword [esp + 8]
push ebx
push ebp
push edi
lea edi, [ecx + ecx]
lea edx, [edx + eax*2 - 2]
nop
mov ebx, eax
mov ebp, eax
shl ebx, 5
sar ebp, 2
add ebx, ebp
movzx ebp, word [edx]
add ebx, ebp
sub esi, ecx
xor eax, ebx
sub edx, edi
cmp esi, ecx
jge 0x436ed0
pop edi
pop ebp
pop ebx
pop esi
ret

Function at 0x436ef0
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x4da6bc]
xor eax, esp
mov dword [esp + 0x114], eax
mov eax, dword [0x4d447c]
cmp eax, 0xffffffff
jne 0x436f3d
push 0x110
lea eax, [esp + 8]
push 0
push eax
mov dword [esp + 0xc], 0x114
call fcn.0049e9f0
add esp, 0xc
lea ecx, [esp]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [esp + 4]
mov dword [0x4d447c], eax
mov ecx, dword [esp + 0x114]
xor edx, edx
cmp eax, 6
setge dl
xor ecx, esp
mov al, dl
call fcn.0049e9d2
add esp, 0x118
ret

Function at 0x4370b0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x4370c0
ret
push ebx
mov ebx, dword [esp + 0x10]
push esi
push edi
add ebx, ebx
lea ecx, [ebx + 2]
push ecx
push 2
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x437122
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edx, dword [esp + 0x14]
push ebx
mov esi, eax
push edx
push esi
call fcn.004a0130
add esp, 0xc
xor eax, eax
push edi
mov word [ebx + esi], ax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_EmptyClipboard]
push edi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
mov esi, eax
neg esi
sbb esi, esi
neg esi
jne 0x437122
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
mov eax, esi
pop esi
pop ebx
ret
Function at 0x4374c0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x43751f
push esi
push edi
push 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
mov edi, eax
xor esi, esi
test edi, edi
je 0x437514
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ebx, eax
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [esp + 0x14]
mov esi, eax
push esi
call fcn.00402060
lea ecx, [esi + esi]
push ecx
push ebx
push eax
call fcn.004a0130
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
pop ebx
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
mov eax, esi
pop esi
ret
xor eax, eax
ret

Function at 0x437a40
Capabilities:
Extract resource via kernel32 functions

Disassembly:
movzx eax, word [esp + 4]
push esi
push 5
push eax
mov eax, dword [0x5144c8]
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x437ad3
mov ecx, dword [0x5144c8]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x437ad3
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edx, 0xffff
cmp word [eax + 2], dx
jne 0x437aaa
add eax, 0x1a
mov dword [esp + 8], eax
lea eax, [esp + 8]
push eax
call fcn.00436d70
mov ecx, dword [esp + 0xc]
add esp, 4
push ecx
mov ecx, dword [esp + 0x10]
call fcn.00402a90
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop esi
ret
lea edx, [esp + 8]
add eax, 0x12
push edx
mov dword [esp + 0xc], eax
call fcn.00436d70
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
add esp, 4
push eax
call fcn.00402a90
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop esi
ret
Function at 0x437b40
Capabilities:
Get file version info

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [esi + 0x10], edi
cmp dword [esi + 4], edi
je 0x437b62
mov eax, dword [esi + 4]
push eax
call fcn.0049e944
add esp, 4
mov dword [esi + 4], edi
mov ebp, dword [esp + 0x1c]
lea eax, [esp + 0x10]
push eax
xor ecx, ecx
mov edx, 0x4e4
lea ebx, [esi + 8]
push ebp
mov word [esi], cx
mov word [esi + 2], dx
mov dword [ebx], edi
mov dword [esi + 0xc], edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x18], edi
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
test edi, edi
je 0x437c42
xor eax, eax
ja 0x437bb4
jb 0x437ba4
cmp edi, 0xffffffff
ja 0x437bb4
push edi
call fcn.0049f69b
add esp, 4
mov dword [esi + 4], eax
test eax, eax
jne 0x437bc8
push 0xe
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 4
mov ecx, dword [esp + 0x10]
push eax
push edi
push ecx
push ebp
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x437c42
mov eax, dword [esi + 4]
lea edx, [esp + 0x1c]
push edx
lea ecx, [esi + 0x10]
push ecx
push 0x4be66c
push eax
mov dword [esp + 0x2c], 0
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x437c42
mov eax, dword [esi + 4]
lea ecx, [esp + 0x1c]
push ecx
push ebx
push 0x4bee4c
push eax
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x437c33
mov eax, dword [esp + 0x1c]
cmp eax, 4
jb 0x437c33
shr eax, 2
mov dword [esi + 0xc], eax
mov eax, dword [ebx]
mov dx, word [eax]
mov word [esi], dx
mov ax, word [eax + 2]
mov word [esi + 2], ax
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 8
ret 4
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4

Function at 0x4386c0
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x18
mov eax, dword [0x4da6bc]
xor eax, esp
mov dword [esp + 0x14], eax
push ebx
push ebp
mov ebp, dword [esp + 0x28]
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
mov esi, ecx
mov eax, dword [esi]
push 0x455
push eax
call edi
test al, 8
jne 0x43870e
mov ecx, dword [esi]
push 0
push 0
push 0x455
push ecx
call edi
mov edx, dword [esi]
or eax, 8
push eax
push 0
push 0x454
push edx
call edi
mov eax, dword [esp + 0x2c]
mov ecx, dword [esi]
push 0
push eax
push 0x419
push ecx
call edi
mov ebx, eax
xor eax, eax
lea edx, [esp + 0x10]
push edx
push ebx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov eax, dword [esi]
push 0x417
push eax
call edi
mov ecx, dword [esi]
push ebp
push 0
push 0x44d
push ecx
call edi
mov edx, dword [esi]
or byte [esp + 0x19], 0x50
push 0
push ebx
push 0x416
push edx
mov dword [esp + 0x30], eax
call edi
mov ecx, dword [esi]
lea eax, [esp + 0x10]
push eax
push ebx
push 0x443
push ecx
call edi
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0049e9d2
add esp, 0x18
ret 8
Function at 0x439490
Capabilities:
Resolve function by parsing pe exports

Disassembly:
fld1
xor eax, eax
push esi
mov esi, ecx
mov ecx, 3
fstp dword [esi + 0x58]
fld dword [0x4bef74]
mov dword [esi + 0x2c], ecx
mov dword [esi + 0x34], ecx
fst dword [esi + 0x5c]
mov dword [esi + 0x3c], ecx
fstp dword [esi + 0x60]
movzx ecx, cl
and ecx, 1
lea edx, [esi + 0x68]
or ecx, 6
push edx
mov dword [esi + 0x28], eax
mov dword [esi + 0x30], eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x38], ecx
mov dword [esi + 0x64], eax
mov byte [esi + 0x78], al
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], eax
mov dword [esi + 0x50], eax
mov dword [esi + 0x54], eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], eax
call dword [sym.imp.USER32.dll_SetRectEmpty]
mov eax, esi
pop esi
ret

Function at 0x439494
Capabilities:
Resolve function by parsing pe exports

Disassembly:
fld1
xor eax, eax
push esi
mov esi, ecx
mov ecx, 3
fstp dword [esi + 0x58]
fld dword [0x4bef74]
mov dword [esi + 0x2c], ecx
mov dword [esi + 0x34], ecx
fst dword [esi + 0x5c]
mov dword [esi + 0x3c], ecx
fstp dword [esi + 0x60]
movzx ecx, cl
and ecx, 1
lea edx, [esi + 0x68]
or ecx, 6
push edx
mov dword [esi + 0x28], eax
mov dword [esi + 0x30], eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x38], ecx
mov dword [esi + 0x64], eax
mov byte [esi + 0x78], al
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], eax
mov dword [esi + 0x50], eax
mov dword [esi + 0x54], eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], eax
call dword [sym.imp.USER32.dll_SetRectEmpty]
mov eax, esi
pop esi
ret
Function at 0x439960
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x74
mov eax, dword [0x4da6bc]
xor eax, esp
mov dword [esp + 0x70], eax
push ebx
push ebp
push esi
mov esi, ecx
mov ecx, dword [esi + 0x36c]
push edi
call fcn.00481510
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 4]
call eax
xor ebx, ebx
mov edi, eax
cmp dword [esi + 0x4d8], ebx
je 0x4399ab
mov ecx, dword [esi + 0x4d8]
push ecx
call dword [sym.imp.GDI32.dll_DeleteObject]
test eax, eax
je 0x4399ab
mov dword [esi + 0x4d8], ebx
mov eax, dword [esi + 4]
push eax
mov dword [esp + 0x20], eax
call dword [sym.imp.USER32.dll_GetDC]
mov ebp, eax
call fcn.00403350
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0x1b]
push edx
push str.MirrorFont
push str.Print
mov ecx, eax
mov dword [esp + 0x2c], eax
mov byte [esp + 0x27], bl
call fcn.00403f90
cmp byte [esp + 0x13], bl
je 0x439a02
push ebx
push ebx
push 0x31
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
lea ecx, [esp + 0x24]
push ecx
push 0x5c
push eax
call dword [sym.imp.GDI32.dll_GetObjectW]
jmp 0x439a2a
push 0x5a1
call fcn.00403bb0
add esp, 4
lea edx, [esp + 0x24]
push edx
mov edi, eax
push 0x5c
push edi
call dword [sym.imp.GDI32.dll_GetObjectW]
cmp edi, ebx
je 0x439a2a
push edi
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [esp + 0x88]
mov edi, dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 0x58
push eax
call edi
push 0x58
mov ebx, eax
push ebp
mov dword [esp + 0x28], ebx
call edi
mov ecx, eax
mov eax, ebx
cdq
idiv ecx
mov dword [esp + 0x14], eax
fild dword [esp + 0x14]
fstp dword [esp + 0x14]
fild dword [esp + 0x24]
fmul dword [esp + 0x14]
call fcn.004a1680
lea edx, [esp + 0x24]
push edx
mov dword [esp + 0x28], eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
push 1
push eax
mov dword [esi + 0x4d8], eax
mov ecx, dword [esi + 0x5c]
push 0x30
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
lea edi, [esi + 0x4b8]
push edi
call dword [sym.imp.USER32.dll_SetRectEmpty]
mov edx, dword [esp + 0x18]
push edx
push 0x10
push edi
push 0x4bef80
push str.Print
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStructW]
fild dword [esp + 0x20]
fdiv qword [0x4bef78]
fstp dword [esp + 0x14]
fild dword [edi]
fld dword [esp + 0x14]
fmul st(1), st(0)
fxch st(1)
call fcn.004a1680
fild dword [esi + 0x4c0]
mov dword [edi], eax
fmul st(1)
call fcn.004a1680
fild dword [esi + 0x4bc]
mov dword [esi + 0x4c0], eax
fmul st(1)
call fcn.004a1680
fimul dword [esi + 0x4c4]
mov dword [esi + 0x4bc], eax
add esi, 0x4c4
call fcn.004a1680
mov dword [esi], eax
mov eax, dword [esp + 0x1c]
push ebp
push eax
call dword [sym.imp.USER32.dll_ReleaseDC]
mov ecx, dword [esp + 0x80]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0049e9d2
add esp, 0x74
ret 4