joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409c80
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
out dx, al
xlatb
dec esp
push ebx
and eax, 0x8b5756c0
aad 0xc
mov dword [ebp - 0x14], eax
mov dword [edi - 0x10], edi
mov eax, dword [esi + 0x239cdb33]
add byte [eax], al
mov dword [ebp - 0x56], ebx
jno 0x409cff
in al, 0x89
pop ebp
call 0xa13ce233
dec ebp
jne 0x409cca
test byte [esi - 0x188affbf], ah
push 0xbb410684
ja 0x409d0d
push ebx
outsb dx, byte [esi]
push ebx
push ebx
rcl dword [ebx - 0x73], 0xd5
hlt
pop ebp
cmc
mov byte [ebp + 0x10], bl
mov byte [ebp + 0x74], bl
mov edx, 0x45c66e5d
stc
add edi, edi
rol dword [eax + eax*8], 0x40
cli
test dword [ebp + 0x74], edi
punpckhbw mm6, mm3
sahf
inc eax
add al, ch
aas
sbb byte [eax], al
add byte [ebx + 0x6eb04c4], al
mov dword [0xeeb0684], ebx
jbe 0x409d2b
mov edx, dword [ebp + 0x23]
inc esp
and esp, dword [ebx + esi*4 + 0x881b12a]
scasb al, byte es:[edi]
movsb byte es:[edi], byte [esi]
mov bl, 0x2a
mov cl, 0x81
or byte [esi + 0x359e8fc], ch
add byte [eax], al
rcl byte [eax + 0xcebe589], cl
adc al, 0xe1
add al, ah
dec esp
sbb al, 0x56
int1
inc edi
mov ds, word [ebx + 0x528b6481]
xor byte [eax - 0x6ff3ad75], dl
Function at 0x401b4e
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x401b75
push 0xc1
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
leave
ret
push ebx
mov ebx, dword [eax + 0x3c]
add ebx, eax
cmp dword [ebx], 0x4550
je 0x401b95
push 0xc1
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x401cdb
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push edi
push 4
push 0x3000
push dword [ebx + 0x50]
push dword [ebx + 0x34]
call esi
mov edi, eax
test edi, edi
jne 0x401bd2
push 4
push 0x3000
push dword [ebx + 0x50]
push eax
call esi
mov edi, eax
test edi, edi
jne 0x401bd2
push 0xe
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x401cd0
nop
nop
nop
nop
nop
nop
nop
push 0x24
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
xor eax, eax
cmp esi, eax
jne 0x401c14
push 0xe
call dword [sym.imp.KERNEL32.dll_SetLastError]
nop
nop
nop
nop
nop
nop
nop
push 0x8000
push 0
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x401cd0
mov dword [esi + 0xc], eax
mov dword [esi + 8], eax
mov dword [esi + 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x18], eax
mov eax, dword [ebp + 0x14]
push 4
mov dword [esi + 0x1c], eax
mov eax, dword [ebp + 0x18]
push 0x1000
mov dword [esi + 4], edi
mov dword [esi + 0x20], eax
push dword [ebx + 0x54]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push dword [ebx + 0x54]
mov dword [ebp - 4], eax
push dword [ebp + 8]
push eax
call fcn.0059ff10
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x3c]
add eax, dword [ebp - 4]
push esi
push ebx
mov dword [esi], eax
push ecx
mov dword [eax + 0x34], edi
call fcn.00401351
add esp, 0x18
nop
nop
nop
nop
nop
nop
nop
mov eax, edi
sub eax, dword [ebx + 0x34]
je 0x401c88
push eax
mov eax, esi
call fcn.004014fe
pop ecx
call fcn.00401579
test eax, eax
je 0x401cc9
mov ebx, esi
call fcn.00401403
mov eax, esi
call fcn.004014d0
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esi]
mov eax, dword [eax + 0x28]
test eax, eax
je 0x401cd7
push 0
xor ebx, ebx
inc ebx
push ebx
add eax, edi
push edi
call eax
test eax, eax
jne 0x401cd4
push 0x45a
call dword [sym.imp.KERNEL32.dll_SetLastError]
push esi
call fcn.004017c6
pop ecx
xor eax, eax
jmp 0x401cd9
mov dword [esi + 0x10], ebx
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401df2
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
sub esp, 0x14
push ebx
push esi
push edi
cmp ecx, 1
jle 0x401ee6
push 0x34
pop eax
cdq
idiv ecx
mov esi, dword [ebp + 8]
and dword [ebp + 0xc], 0
add eax, 6
mov dword [ebp - 0xc], eax
lea eax, [esi + ecx - 1]
mov dword [ebp - 0x14], eax
movzx eax, byte [eax]
dec ecx
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], ecx
sub dword [ebp + 0xc], 0x61c88647
mov eax, dword [ebp + 0xc]
shr eax, 2
and eax, 3
xor ecx, ecx
mov dword [ebp - 8], eax
cmp dword [ebp - 0x10], ecx
jbe 0x401e93
movzx edx, byte [ecx + esi + 1]
mov edi, dword [ebp - 4]
mov ebx, dword [ebp - 4]
shr edi, 5
mov eax, edx
shl eax, 2
xor eax, edi
mov edi, edx
xor edx, dword [ebp + 0xc]
shr edi, 3
shl ebx, 4
xor edi, ebx
mov ebx, dword [ebp + 0x10]
add eax, edi
mov edi, ecx
and edi, 3
xor edi, dword [ebp - 8]
mov edi, dword [ebx + edi*4]
xor edi, dword [ebp - 4]
add edi, edx
movzx edx, byte [ecx + esi]
xor eax, edi
add eax, edx
mov byte [ecx + esi], al
movzx eax, al
inc ecx
mov dword [ebp - 4], eax
cmp ecx, dword [ebp - 0x10]
jb 0x401e45
movzx edx, byte [esi]
mov edi, dword [ebp - 4]
mov ebx, dword [ebp - 4]
shr edi, 5
mov eax, edx
shl eax, 2
xor eax, edi
mov edi, edx
xor edx, dword [ebp + 0xc]
and ecx, 3
xor ecx, dword [ebp - 8]
shr edi, 3
shl ebx, 4
xor edi, ebx
add eax, edi
mov edi, dword [ebp + 0x10]
mov ecx, dword [edi + ecx*4]
xor ecx, dword [ebp - 4]
add ecx, edx
xor eax, ecx
mov ecx, dword [ebp - 0x14]
movzx edx, byte [ecx]
add eax, edx
dec dword [ebp - 0xc]
mov byte [ecx], al
movzx eax, al
mov dword [ebp - 4], eax
jne 0x401e2b
jmp 0x401fc2
cmp ecx, 0xffffffff
jge 0x401fc2
push 0x34
neg ecx
pop eax
cdq
idiv ecx
mov edi, dword [ebp + 8]
lea edx, [ecx - 1]
lea ecx, [edi + ecx - 1]
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], ecx
add eax, 6
mov dword [ebp - 0xc], eax
imul eax, eax, 0x9e3779b9
mov dword [ebp + 0xc], eax
movzx eax, byte [edi]
mov ecx, dword [ebp + 0xc]
mov esi, dword [ebp - 0x10]
shr ecx, 2
and ecx, 3
mov dword [ebp - 8], ecx
test esi, esi
je 0x401f74
movzx ecx, byte [esi + edi - 1]
mov ebx, ecx
shr ebx, 5
mov edx, eax
shl edx, 2
xor edx, ebx
mov ebx, eax
xor eax, dword [ebp + 0xc]
shr ebx, 3
shl ecx, 4
xor ebx, ecx
add edx, ebx
mov ebx, dword [ebp + 0x10]
mov ecx, esi
and ecx, 3
xor ecx, dword [ebp - 8]
mov ebx, dword [ebx + ecx*4]
movzx ecx, byte [esi + edi - 1]
xor ebx, ecx
add ebx, eax
movzx eax, byte [esi + edi]
xor edx, ebx
sub eax, edx
mov byte [esi + edi], al
dec esi
movzx eax, al
jne 0x401f2c
mov ecx, dword [ebp - 0x14]
movzx ecx, byte [ecx]
mov bl, cl
shl bl, 4
mov edx, eax
shr edx, 3
xor dl, bl
mov dword [ebp - 4], ecx
shr ecx, 5
mov bl, al
shl bl, 2
xor cl, bl
mov bl, byte [ebp + 0xc]
add dword [ebp + 0xc], 0x61c88647
add dl, cl
mov ecx, dword [ebp + 0x10]
and esi, 3
xor esi, dword [ebp - 8]
xor bl, al
mov cl, byte [ecx + esi*4]
xor cl, byte [ebp - 4]
add cl, bl
xor dl, cl
sub byte [edi], dl
dec dword [ebp - 0xc]
movzx eax, byte [edi]
jne 0x401f19
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40205b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
movzx eax, byte [ebp + 0x10]
push esi
push 0x5f
cdq
pop ecx
idiv ecx
mov esi, dword [ebp + 0xc]
lea ecx, [edx + 0x58]
test esi, esi
je 0x402082
mov eax, dword [ebp + 8]
mov dl, byte [eax]
xor dl, cl
add dl, cl
mov byte [eax], dl
inc eax
dec esi
jne 0x402076
pop esi
pop ebp
ret

Function at 0x40fd67
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x40fdae
call fcn.00424d1c
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x40fdae
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x40fdca
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.0040f86c
mov esi, eax
test edi, edi
je 0x40fdc8
test ebx, ebx
je 0x40fdc8
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x4110ec
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x5cf642
call fcn.005a1312
mov esi, ecx
cmp dword [esi + 0x6c], 0
jne 0x411111
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x411163
call fcn.00425923
push eax
lea ecx, [ebp - 0x10]
call fcn.00403f33
mov ecx, dword [esi + 0x6c]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.005a1279
push eax
call fcn.0040294b
add esp, 0x14
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00402a87
mov eax, esi
call fcn.005a13ea
ret 8
Function at 0x413c36
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov dword [ebp - 4], ecx
call fcn.00424d1c
mov esi, dword [eax + 0xc]
push 0xf1
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
jne 0x413c63
xor eax, eax
jmp 0x413d0a
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 8], eax
test eax, eax
je 0x413c5c
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x413c5c
movzx eax, word [esi + 6]
push ebx
push edi
xor ecx, ecx
push 4
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004028f0
pop ecx
mov edi, eax
xor ecx, ecx
xor eax, eax
cmp cx, word [esi + 6]
jae 0x413cbb
lea ecx, [esi + 8]
movzx edx, word [ecx]
mov dword [edi + eax*4], edx
movzx edx, word [esi + 6]
inc eax
add ecx, 2
cmp eax, edx
jl 0x413ca9
movzx eax, word [esi + 6]
mov ecx, dword [ebp - 4]
push eax
push edi
call fcn.00412613
push edi
mov ebx, eax
call fcn.0040291f
pop ecx
test ebx, ebx
je 0x413cfd
movzx ecx, word [esi + 4]
movzx eax, word [esi + 2]
push ecx
lea esi, [ecx + 7]
mov ecx, dword [ebp - 4]
push eax
lea edx, [eax + 7]
push esi
push edx
call fcn.00412e15
push dword [ebp + 8]
mov ecx, dword [ebp - 4]
call fcn.00412f46
mov ebx, eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, ebx
pop ebx
pop esi
leave
ret 4

Function at 0x41a60b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor ebx, ebx
call fcn.00424d1c
mov esi, dword [eax + 0xc]
push 5
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x41a644
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov ecx, dword [ebp - 4]
push esi
push dword [ebp + 0xc]
push ebx
call fcn.0041a24d
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8

Function at 0x41a6a2
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x78], ebx
test ebx, 0xffff0000
jne 0x41a6c6
cmp dword [edi + 0x74], 0
jne 0x41a6c6
movzx eax, bx
mov dword [edi + 0x74], eax
call fcn.00424d1c
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.0041a663
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x41b20e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
cmp dword [ebp + 0xc], ebx
je 0x41b256
call fcn.00424d1c
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x41b256
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
test eax, eax
je 0x41b299
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
test ebx, ebx
je 0x41b282
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x41b282
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x68], 0
je 0x41b296
mov ecx, dword [esi + 0x68]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x43ed30
Capabilities:
Move file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi], 0
je 0x43ed6e
push 0x5f83c0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x43ed7c
push str.MoveFileTransactedA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x43ed7c
push dword [esi]
push 2
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x43ed7e
cmp dword [esi + 4], 0
je 0x43ed7c
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_MoveFileA]
xor eax, eax
pop esi
pop ebp
ret 8
Function at 0x44b7a5
Capabilities:
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi], 0
je 0x44b7dd
push 0x5f83c0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x44b7eb
push str.SetFileAttributesTransactedA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x44b7eb
push dword [esi]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x44b7ed
cmp dword [esi + 4], 0
je 0x44b7eb
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
xor eax, eax
pop esi
pop ebp
ret 8

Function at 0x4573d1
Capabilities:
Query or enumerate registry value

Disassembly:
push 0
mov eax, 0x5d4382
call fcn.005a1312
push dword [ebp + 0xc]
lea ecx, [ebp + 0xc]
call fcn.0040f697
and dword [ebp - 4], 0
cmp dword [ebp + 8], 0x80000000
jne 0x457433
call fcn.00424124
cmp eax, 1
jne 0x457433
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 8]
push str.SoftwareClasses_
push eax
call fcn.0041910e
add esp, 0xc
push eax
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 1
call fcn.00404212
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00402a87
mov dword [ebp + 8], SysReAllocString
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00402a87
mov eax, esi
call fcn.005a13ea
ret 0x10

Function at 0x45745c
Capabilities:
Set registry value

Disassembly:
push 0
mov eax, 0x5d43ad
call fcn.005a1312
push dword [ebp + 0xc]
lea ecx, [ebp + 0xc]
call fcn.0040f697
and dword [ebp - 4], 0
cmp dword [ebp + 8], 0x80000000
jne 0x4574be
call fcn.00424124
cmp eax, 1
jne 0x4574be
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 8]
push str.SoftwareClasses_
push eax
call fcn.0041910e
add esp, 0xc
push eax
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 1
call fcn.00404212
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00402a87
mov dword [ebp + 8], SysReAllocString
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueA]
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00402a87
mov eax, esi
call fcn.005a13ea
ret 0x14

Function at 0x4574ea
Capabilities:
Delete registry key

Disassembly:
push 0
mov eax, 0x5d43d8
call fcn.005a1312
push dword [ebp + 0xc]
lea ecx, [ebp + 0xc]
call fcn.0040f697
mov esi, dword [ebp + 8]
and dword [ebp - 4], 0
cmp esi, 0x80000000
jne 0x45754c
call fcn.00424124
cmp eax, 1
jne 0x45754c
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 8]
push str.SoftwareClasses_
push eax
call fcn.0041910e
add esp, 0xc
push eax
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 1
call fcn.00404212
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0
call fcn.00402a87
inc esi
mov ecx, dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
test ecx, ecx
je 0x45755e
call fcn.00418dfa
jmp 0x457564
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00402a87
mov eax, esi
call fcn.005a13ea
ret 0xc
Function at 0x4a8182
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push esi
mov esi, ecx
call fcn.0055b0c2
call fcn.0042466b
cmp dword [eax + 0x14], 0
jne 0x4a819f
mov ecx, esi
pop esi
jmp fcn.004a7c5f
pop esi
ret

Function at 0x4ae498
Capabilities:
Get common file path
Get file system object information

Disassembly:
mov edi, edi
push esi
mov esi, ecx
call fcn.0040933c
call fcn.0042466b
cmp dword [eax + 0x14], 0
jne 0x4ae4b5
mov ecx, esi
pop esi
jmp fcn.004ade48
pop esi
ret

Function at 0x4ca773
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push dword [ebp + 0xc]
mov ecx, esi
call fcn.004c9b72
cmp dword [esi], 0
mov edi, eax
mov dword [esi + 0xc], 1
je 0x4ca7bd
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.0040db17
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.00407212
jmp 0x4ca7c8
mov eax, dword [ebp + 0x10]
push dword [eax]
push edi
call fcn.00426354
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x4ca8c6
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 4]
lea eax, [ebp + 8]
push eax
push dword [ebp + 0xc]
call fcn.00410641
push 0xfffffffffffffff0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowLongA]
push dword [ebp + 0xc]
and eax, 3
mov ecx, esi
cmp al, 3
je 0x4ca903
call fcn.004c9b72
mov dword [esi + 0xc], 1
jmp 0x4ca908
call fcn.004c9b72
cmp dword [esi], 0
je 0x4ca951
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
test eax, eax
jle 0x4ca929
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.0040db17
jmp 0x4ca93b
mov ecx, dword [ebp + 0x10]
push 0xff
call fcn.004040aa
push 0x100
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.00407212
jmp 0x4ca975
mov esi, dword [ebp + 0x10]
push dword [esi]
push 0xffffffffffffffff
push 0x14d
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 0xffffffff
jne 0x4ca975
push dword [esi]
push dword [ebp + 8]
call fcn.00426354
pop esi
pop ebp
ret 0xc
Function at 0x4d3a3a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov dword [ebp - 4], ecx
test esi, esi
jne 0x4d3a54
call fcn.00424d1c
mov esi, dword [eax + 0xc]
push dword [0x6b43dc]
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x4d3a72
xor eax, eax
pop edi
pop esi
leave
ret 8
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp + 0xc], eax
test eax, eax
je 0x4d3a6a
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
jne 0x4d3a9f
xor esi, esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop ebx
jmp 0x4d3a6c
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 4]
push eax
push ebx
call fcn.004d3968
mov esi, eax
jmp 0x4d3a91

Function at 0x53815f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
test byte [esi + 4], 1
push edi
mov ebx, ecx
je 0x538177
mov edi, dword [esi + 0xc]
jmp 0x5381b7
push 5
push dword [esi + 0xc]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x538190
call fcn.0042b43d
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x5381a5
call fcn.0042b43d
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x5381b7
call fcn.0042b43d
call fcn.00424d1c
cmp dword [eax + 0x3c], 0
je 0x5381cc
push edi
mov ecx, ebx
call fcn.00536ccc
mov edi, eax
push dword [ebp + 0xc]
push edi
call fcn.00538079
mov dword [ebp + 8], eax
mov eax, dword [ebx + 0x7c]
test eax, eax
je 0x5381ea
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
and dword [ebx + 0x7c], 0
mov eax, dword [ebp + 8]
test eax, eax
je 0x5381f6
mov edi, eax
mov dword [ebx + 0x7c], eax
or dword [esi + 4], 1
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x579170
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
push esi
mov esi, ecx
jne 0x579182
xor eax, eax
jmp 0x5791f7
cmp dword [ebp + 0xc], 0
je 0x57917e
mov eax, dword [ebp + 0x10]
test eax, eax
jne 0x57919b
call fcn.00424d1c
mov eax, dword [eax + 0xc]
test eax, eax
je 0x57917e
push edi
push dword [ebp + 0xc]
mov dword [esi + 8], eax
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
je 0x5791c3
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp + 0xc], eax
test eax, eax
jne 0x5791c7
xor eax, eax
jmp 0x5791f6
push ebx
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x5791f5
push dword [ebp + 0xc]
mov edi, dword [esi]
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
mov ecx, esi
call dword [edi + 4]
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop ebx
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x59a994
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3c
push 0x3c
lea eax, [ebp - 0x3c]
push 0
push eax
call fcn.005a0280
mov eax, dword [ebp + 8]
and dword [ebp - 0x34], 0
and dword [ebp - 0x1c], 0
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x20], eax
add esp, 0xc
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x38], 0x40
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
leave
ret 0x14

Function at 0x5a1303
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x6af0f0]
jne 0x5a130d
repz ret
jmp fcn.005b00d1