joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403a30
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0xc0
mov eax, dword [0x603144]
xor eax, esp
mov dword [esp + 0xbc], eax
push ebx
push esi
mov esi, dword [esp + 0xd0]
lea eax, [esp + 8]
push edi
mov edi, dword [esp + 0xd0]
push eax
mov dword [esp + 0x10], 8
mov dword [esp + 0x14], 2
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
push 0
push esi
push 0
push edi
push 0
push 0
push 0
push 0
push 0x40800900
push 0
push str.ToolbarWindow32
push 0x80
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov ebx, eax
test ebx, ebx
jne 0x403ab3
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xbc]
xor ecx, esp
call fcn.00572cc2
add esp, 0xc0
ret
push 0
push 0
push 0
push 0
push 0x12c
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.USER32.dll_LoadImageW]
push 0
push 9
push 0x11
push 0x10
push 0x10
mov edi, eax
call dword [sym.imp.COMCTL32.dll_ImageList_Create]
push 0xffffff
mov esi, eax
push edi
push esi
call dword [sym.imp.COMCTL32.dll_ImageList_AddMasked]
push edi
call dword [sym.imp.GDI32.dll_DeleteObject]
push esi
push 0
push 0x430
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
push 0xffffffffffffffff
push 0
push 0x432
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
xorps xmm0, xmm0
mov dword [esp + 0x14], 0x11
push 0
mov dword [esp + 0x1c], 0x7d0
mov word [esp + 0x20], 4
movq qword [esp + 0x22], xmm0
mov word [esp + 0x2a], 0
mov dword [esp + 0x2c], 0x12
mov dword [esp + 0x30], 0x7d3
mov word [esp + 0x34], 4
movq qword [esp + 0x36], xmm0
mov word [esp + 0x3e], 0
mov dword [esp + 0x40], 0x13
mov dword [esp + 0x44], 0x7d2
mov word [esp + 0x48], 4
movq qword [esp + 0x4a], xmm0
mov word [esp + 0x52], 0
mov dword [esp + 0x54], 4
mov dword [esp + 0x58], 0x65
mov word [esp + 0x5c], 0x104
movq qword [esp + 0x5e], xmm0
mov word [esp + 0x66], 0
mov dword [esp + 0x68], 0x14
mov dword [esp + 0x6c], 0x7d6
mov word [esp + 0x70], 4
movq qword [esp + 0x72], xmm0
mov word [esp + 0x7a], 0
mov dword [esp + 0x7c], 0x15
mov dword [esp + 0x80], 0x7d4
mov word [esp + 0x84], 4
movq qword [esp + 0x86], xmm0
mov word [esp + 0x8e], 0
mov dword [esp + 0x90], 4
mov dword [esp + 0x94], 0x65
mov word [esp + 0x98], 0x104
movq qword [esp + 0x9a], xmm0
mov word [esp + 0xa2], 0
mov dword [esp + 0xa4], 0x16
mov dword [esp + 0xa8], 0x7d7
mov word [esp + 0xac], 4
movq qword [esp + 0xae], xmm0
mov word [esp + 0xb6], 0
mov dword [esp + 0xb8], 0x17
mov dword [esp + 0xbc], 0x68
mov word [esp + 0xc0], 4
movq qword [esp + 0xc2], xmm0
mov word [esp + 0xca], 0
push 0x14
push 0x41e
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [esp + 0x14]
push eax
push 9
push 0x414
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x421
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
push 1
push ebx
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esp + 0xc8]
mov eax, ebx
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00572cc2
add esp, 0xc0
ret
Function at 0x403f80
Capabilities:
Get file version info

Disassembly:
sub esp, 0x81c
mov eax, dword [0x603144]
xor eax, esp
mov dword [esp + 0x818], eax
push ebx
mov ebx, dword [esp + 0x824]
lea eax, [esp + 0x10]
push ebp
mov ebp, dword [esp + 0x82c]
push edi
push eax
push ebx
mov dword [esp + 0x20], 0
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
test edi, edi
je 0x4040a3
push esi
push edi
call fcn.00581a1c
mov esi, eax
add esp, 4
test esi, esi
je 0x4040a2
push esi
push edi
push 0
push ebx
mov dword [esp + 0x20], 0
call sub.VERSION.dll_GetFileVersionInfoW
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x28]
push eax
push 0x5ae06c
push esi
call sub.VERSION.dll_VerQueryValueW
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x24]
push eax
push str.VarFileInfoTranslation
push esi
call sub.VERSION.dll_VerQueryValueW
push 0x800
lea eax, [esp + 0x2c]
push 0
push eax
call fcn.00574900
mov ecx, dword [esp + 0x2c]
push 0x5aeb58
movzx eax, word [ecx + 2]
push eax
movzx eax, word [ecx]
push eax
push str.StringFileInfo_04x_04x_S
lea eax, [esp + 0x44]
push 0x800
push eax
call fcn.00405770
add esp, 0x24
mov dword [esp + 0x14], 0
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 4
push eax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x30]
push eax
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x404097
push dword [esp + 0x14]
push 0x5aeba0
push ebp
call fcn.00405550
push esi
call fcn.00577ef3
add esp, 0x10
cmp dword [esp + 0x18], 0
setne al
jmp 0x4040a2
push esi
call fcn.00577ef3
add esp, 4
xor al, al
pop esi
mov ecx, dword [esp + 0x824]
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.00572cc2
add esp, 0x81c
ret
Function at 0x404720
Capabilities:
Initialize winhttp library
Prepare http request
Receive http response

Disassembly:
sub esp, 0xc
push ebx
push edi
push 0x7f02
xor ebx, ebx
push ebx
call dword [sym.imp.USER32.dll_LoadCursorW]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
push ebx
push ebx
push ebx
push ebx
push 0x5ae070
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov edi, eax
test edi, edi
je 0x40485e
push ebp
push ebx
push 0x1bb
push str.www.mzrst.com
push edi
call dword [sym.imp.WINHTTP.dll_WinHttpConnect]
mov ebp, eax
test ebp, ebp
je 0x404856
push esi
push 0x800000
push ebx
push ebx
push ebx
push str._puppy_ver
push 0x5ae0bc
push ebp
call dword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov esi, eax
test esi, esi
je 0x40484e
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push esi
call dword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
mov ebx, eax
test ebx, ebx
je 0x404847
push 0
push esi
call dword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
mov ebx, eax
test ebx, ebx
je 0x404847
lea eax, [esp + 0x10]
mov dword [esp + 0x18], 0
push eax
push esi
mov dword [esp + 0x18], 0
call dword [sym.imp.WINHTTP.dll_WinHttpQueryDataAvailable]
mov ebx, eax
mov eax, dword [esp + 0x10]
cmp eax, 5
jbe 0x4047e9
xor ebx, ebx
jmp 0x404847
test ebx, ebx
je 0x404847
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
lea ecx, [esp + 0x18]
mov dword [esp + 0x14], eax
push ecx
push dword [esp + 0x14]
push eax
push esi
call dword [sym.imp.WINHTTP.dll_WinHttpReadData]
mov ebx, eax
test ebx, ebx
je 0x404834
push dword [esp + 0x10]
push str.1.13
push dword [esp + 0x1c]
call fcn.005829e0
xor ebx, ebx
add esp, 0xc
test eax, eax
setg bl
push dword [esp + 0x14]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push esi
call dword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
push ebp
call dword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
pop esi
push edi
call dword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
pop ebp
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorW]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
pop edi
mov eax, ebx
pop ebx
add esp, 0xc
ret
Function at 0x404880
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 0x218
mov eax, dword [0x603144]
xor eax, esp
mov dword [esp + 0x214], eax
mov eax, dword [esp + 0x21c]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x230]
push edi
push 0x104
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x234]
push 0
push esi
mov dword [esp + 0x24], eax
call fcn.00574900
push 0x208
lea eax, [esp + 0x2c]
push 0
push eax
call fcn.00574900
add esp, 0x18
lea eax, [esp + 0x1c]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, 0x69
mov word [esp + eax*2 + 0x1a], di
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, 0x6e
mov word [esp + eax*2 + 0x18], cx
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0
push 0x80
push 3
push 0
push 1
mov word [esp + eax*2 + 0x2a], di
lea eax, [esp + 0x30]
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x40495c
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebp, eax
test ebp, ebp
jne 0x40497a
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov word [esi], ax
mov ecx, dword [esp + 0x224]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00572cc2
add esp, 0x218
ret
push 4
push 0x3000
push ebp
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ebx, eax
test ebx, ebx
je 0x404a73
push 0
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0
push eax
push ebp
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x404a73
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 4
push 0x3000
push ebp
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ebp, eax
test ebp, ebp
je 0x404a73
push 0
push 0
push 0xffffffffffffffff
push ebx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push eax
push ebp
push 0xffffffffffffffff
push ebx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0x8000
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
push dword [esp + 0x14]
push ebp
call dword [sym.imp.SHLWAPI.dll_StrStrW]
test eax, eax
je 0x40495c
push dword [esp + 0x18]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrW]
test eax, eax
je 0x40495c
push 0x5aeb18
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrW]
lea ecx, [eax + 2]
movzx eax, word [ecx]
cmp eax, 0xd
je 0x404a60
mov edx, eax
test dx, dx
je 0x404a60
add ecx, 2
mov word [esi], dx
add esi, 2
movzx eax, word [ecx]
mov edx, eax
cmp eax, 0xd
jne 0x404a48
push 0x8000
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x404961
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x404961
Function at 0x405040
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x82c
mov eax, dword [0x603144]
xor eax, esp
mov dword [esp + 0x828], eax
mov eax, dword [esp + 0x83c]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x83c]
push edi
push 0x800
mov dword [esp + 0x18], eax
lea eax, [esp + 0x3c]
push 0
push eax
call fcn.00574900
push esi
lea eax, [esp + 0x48]
push 0x5aeb1c
push eax
call fcn.004057b0
add esp, 0x18
lea eax, [esp + 0x38]
push 1
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [esp + 0x10], eax
test eax, eax
je 0x40519e
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40519e
mov ecx, dword [eax + 0x3c]
cmp dword [ecx + eax], 0x4550
jne 0x40519e
mov edx, dword [ecx + eax + 0x78]
mov esi, 0x20b
cmp word [ecx + eax + 0x18], si
jne 0x4050de
mov edx, dword [ecx + eax + 0x88]
lea ebp, [edx + eax]
mov esi, ebp
test ebp, ebp
je 0x40519e
mov edi, dword [esp + 0x14]
mov ebx, dword [esp + 0x30]
cmp esi, ebp
je 0x4050fb
cmp esi, edi
jne 0x40511d
push 0x1c
lea eax, [esp + 0x20]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x40519e
mov edi, dword [esp + 0x28]
add edi, dword [esp + 0x1c]
mov ebx, dword [esp + 0x30]
test bl, 0xee
mov ecx, 0
mov esi, edi
setne cl
xor eax, eax
test ebx, 0x101
cmove eax, ecx
test eax, eax
je 0x40519e
lea eax, [ebp + 0x28]
cmp eax, edi
ja 0x4050f3
mov edx, dword [ebp + 0x20]
xor ecx, ecx
mov esi, dword [esp + 0x10]
add edx, esi
mov ebx, dword [ebp + 0x24]
mov edi, dword [ebp + 0x18]
add ebx, esi
test edi, edi
je 0x405197
mov eax, dword [ebp + 0x10]
mov ebp, dword [esp + 0x848]
mov dword [esp + 0x10], eax
nop word [eax + eax]
movzx eax, word [ebx + ecx*2]
add eax, dword [esp + 0x10]
mov dword [esp + 0x18], 0
cmp eax, dword [esp + 0x844]
jne 0x40518f
cmp dword [esp + 0x18], ebp
je 0x4051b9
inc ecx
add edx, 4
cmp ecx, edi
jb 0x405170
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
mov ecx, dword [esp + 0x838]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00572cc2
add esp, 0x82c
ret
mov eax, dword [edx]
add eax, esi
push eax
push 0x5aeb1c
push dword [esp + 0x1c]
call fcn.004057b0
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 1
jmp 0x4051a0
Function at 0x4051e0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x860
mov eax, dword [0x603144]
xor eax, esp
mov dword [esp + 0x85c], eax
push ebp
push esi
mov ebp, edx
push edi
mov edi, ecx
test ebp, ebp
je 0x4053ab
cmp dword [esp + 0x870], 0
je 0x4053ab
push 0x58
lea eax, [esp + 0x14]
push 0
push eax
call fcn.00574900
push 0x800
lea eax, [esp + 0x78]
push 0
push eax
call fcn.00574900
add esp, 0x18
lea eax, [esp + 0x68]
mov ecx, 0x400
nop dword [eax]
cmp word [eax], 0
je 0x40524e
add eax, 2
sub ecx, 1
jne 0x405240
mov edx, 0x400
mov esi, ecx
mov eax, edx
sub eax, ecx
neg esi
sbb esi, esi
and esi, eax
test ecx, ecx
je 0x40529b
lea ecx, [esp + 0x68]
lea ecx, [ecx + esi*2]
sub edx, esi
je 0x40528e
mov eax, SysReAllocString
sub edi, ecx
test eax, eax
je 0x40528e
movzx esi, word [edi + ecx]
test si, si
je 0x40528e
mov word [ecx], si
dec eax
add ecx, 2
sub edx, 1
jne 0x405275
test edx, edx
lea eax, [ecx - 2]
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
push 0x5ae06c
lea eax, [esp + 0x6c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrW]
test eax, eax
jne 0x40533f
push str._:____
lea eax, [esp + 0x6c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrW]
test eax, eax
jne 0x40533f
push 0x5ae1b4
lea eax, [esp + 0x6c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrW]
test eax, eax
jne 0x40533f
push 0x5ae1b8
lea eax, [esp + 0x6c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrW]
test eax, eax
jne 0x40533f
push 0x5ae1bc
lea eax, [esp + 0x6c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrW]
test eax, eax
jne 0x40533f
push 0x5ae1c0
lea eax, [esp + 0x6c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrW]
test eax, eax
jne 0x40533f
push 0x5ae1c4
lea eax, [esp + 0x6c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrW]
test eax, eax
jne 0x40533f
push 0x5ae1c8
lea eax, [esp + 0x6c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrW]
test eax, eax
je 0x405346
xor eax, eax
mov word [esp + 0x68], ax
lea eax, [esp + 0x68]
mov dword [esp + 0x30], 0x400
push str.comdlg32.dll
mov dword [esp + 0x14], 0x58
mov dword [esp + 0x20], str.Executable_files__.exe_
mov dword [esp + 0x30], eax
mov dword [esp + 0x2c], 1
mov dword [esp + 0x48], 0x10201804
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
push str.GetSaveFileNameW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
lea eax, [esp + 0x10]
push eax
mov ecx, esi
call dword [0x5a699c]
call esi
test eax, eax
jne 0x4053c7
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
mov ecx, dword [esp + 0x868]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.00572cc2
add esp, 0x860
ret 4
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
push dword [esp + 0x44]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp esi, 0xffffffff
je 0x4053ab
push 0
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x878]
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x40541f
push eax
push str.Error
push str.Could_not_save_the_file
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x4053ab
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x4053ad
Function at 0x405430
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [eax*2 + 4]
push esi
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push esi
mov ebx, eax
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push eax
call fcn.00574a60
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
call dword [sym.imp.USER32.dll_EmptyClipboard]
push ebx
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop esi
mov eax, 1
pop ebx
ret
Function at 0x421300
Capabilities:
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
sub esp, 0xc
push esi
mov esi, edx
mov dword [esp + 0xc], 0x10
push edi
mov edi, ecx
test esi, esi
jne 0x421323
mov eax, dword [esp + 0x18]
pop edi
pop esi
mov byte [eax], dl
add esp, 0xc
ret 4
push 0xf0000020
push 1
push 0
push 0
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x421382
lea eax, [esp + 8]
push eax
push 0
push 0
push 0x8003
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x421382
push 0
push esi
push edi
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x421382
push 0
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x20]
push 2
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push 0
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
pop edi
pop esi
add esp, 0xc
ret 4
Function at 0x422b60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x5f0258
push 0x5747a0
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x603144]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov eax, edx
mov dword [ebp - 0x38], eax
mov esi, ecx
mov dword [ebp - 0x40], eax
mov dword [ebp - 4], 0
mov edx, dword [0x608688]
mov ecx, dword [edx + 0x3c]
lea eax, [ecx + edx]
movzx edi, word [eax + 0x14]
add edi, ecx
add edi, edx
xorps xmm0, xmm0
movups xmmword [ebp - 0x30], xmm0
mov word [ebp - 0x20], 0
cmp esi, 0x1000
jae 0x422c36
movzx eax, byte [edi + 0x18]
mov word [ebp - 0x30], ax
movzx eax, byte [edi + 0x19]
mov word [ebp - 0x2e], ax
movzx eax, byte [edi + 0x1a]
mov word [ebp - 0x2c], ax
movzx eax, byte [edi + 0x1b]
mov word [ebp - 0x2a], ax
movzx eax, byte [edi + 0x1c]
mov word [ebp - 0x28], ax
movzx eax, byte [edi + 0x1d]
mov word [ebp - 0x26], ax
movzx eax, byte [edi + 0x1e]
mov word [ebp - 0x24], ax
movzx eax, byte [edi + 0x1f]
mov word [ebp - 0x22], ax
lea eax, [ebp - 0x30]
push eax
push 0x5aeba0
push dword [ebp - 0x38]
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
mov dword [ebp - 4], 0xfffffffe
mov eax, 1
jmp 0x422cef
mov ax, word [eax + 6]
dec ax
movzx eax, ax
mov dword [ebp - 0x34], eax
xor ecx, ecx
mov dword [ebp - 0x3c], ecx
movzx eax, cx
lea edx, [eax + eax*4]
cmp cx, word [ebp - 0x34]
jae 0x422c62
cmp esi, dword [edi + edx*8 + 0x4c]
jae 0x422c5f
cmp esi, dword [edi + edx*8 + 0x24]
jae 0x422c62
inc ecx
jmp 0x422c44
movzx eax, byte [edi + edx*8 + 0x18]
mov word [ebp - 0x30], ax
movzx eax, byte [edi + edx*8 + 0x19]
mov word [ebp - 0x2e], ax
movzx eax, byte [edi + edx*8 + 0x1a]
mov word [ebp - 0x2c], ax
movzx eax, byte [edi + edx*8 + 0x1b]
mov word [ebp - 0x2a], ax
movzx eax, byte [edi + edx*8 + 0x1c]
mov word [ebp - 0x28], ax
movzx eax, byte [edi + edx*8 + 0x1d]
mov word [ebp - 0x26], ax
movzx eax, byte [edi + edx*8 + 0x1e]
mov word [ebp - 0x24], ax
movzx eax, byte [edi + edx*8 + 0x1f]
mov word [ebp - 0x22], ax
lea eax, [ebp - 0x30]
push eax
cmp cx, word [ebp - 0x34]
jne 0x422c14
push str._s__Last_section_
push dword [ebp - 0x38]
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x422ce6
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.00572cc2
mov esp, ebp
pop ebp
ret
Function at 0x435650
Capabilities:
Get common file path

Disassembly:
sub esp, 0x528
mov eax, dword [0x603144]
xor eax, esp
mov dword [esp + 0x524], eax
push ebx
mov ebx, dword [esp + 0x538]
lea eax, [esp + 0x258]
push esi
mov esi, dword [esp + 0x534]
push 0x64
push eax
push 0x67
push esi
call dword [sym.imp.USER32.dll_LoadStringW]
push 0x64
lea eax, [esp + 0x58]
push eax
push 0x6d
push esi
call dword [sym.imp.USER32.dll_LoadStringW]
push 0x6b
push esi
mov dword [esp + 0x10], 0x30
mov dword [esp + 0x14], 3
mov dword [esp + 0x18], 0x423500
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], esi
call dword [sym.imp.USER32.dll_LoadIconW]
push 0x7f00
push 0
mov dword [esp + 0x28], eax
call dword [sym.imp.USER32.dll_LoadCursorW]
push 0x6b
push dword [esp + 0x20]
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x5c]
mov dword [esp + 0x30], 6
mov dword [esp + 0x34], 0x6d
mov dword [esp + 0x38], eax
call dword [sym.imp.USER32.dll_LoadIconW]
mov dword [esp + 0x34], eax
lea eax, [esp + 8]
push eax
call dword [sym.imp.USER32.dll_RegisterClassExW]
push dword [esp + 0x540]
push esi
call fcn.00420dc0
add esp, 8
test eax, eax
je 0x435894
push edi
push 0x67
push esi
call dword [sym.imp.USER32.dll_LoadAcceleratorsW]
cmp word [ebx], 0
mov edi, eax
je 0x43583b
push 0x208
lea eax, [esp + 0x5c]
push 0
push eax
call fcn.00574900
add esp, 0xc
lea eax, [esp + 0x58]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea eax, [esp + 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp word [esp + eax*2 + 0x56], 0x5c
je 0x43578c
lea eax, [esp + 0x58]
push eax
push 0x5afa64
push eax
call fcn.00405550
add esp, 0xc
push 0x5c
push ebx
call fcn.00574fd4
add esp, 8
test eax, eax
jne 0x4357f6
lea eax, [esp + 0x58]
push 0x5c
push eax
call fcn.00575084
push 0x208
mov esi, eax
lea eax, [esp + 0x334]
push 0
push eax
call fcn.00574900
lea eax, [esp + 0x6c]
sub esi, eax
sar esi, 1
push esi
push eax
lea eax, [esp + 0x344]
push eax
call fcn.00583888
push ebx
lea eax, [esp + 0x34c]
push eax
push 0x5afa6c
push 0x104
push 0x6081a0
call fcn.00435620
add esp, 0x34
jmp 0x43580b
push 0xffffffffffffffff
push ebx
push 0x104
push 0x6081a0
call fcn.0058387d
add esp, 0x10
push 0x104
push 0x6081a0
push 0x6081a0
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
push 0xbeef
push 0x7d0
push 0x111
push dword [0x60769c]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0
lea eax, [esp + 0x48]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x43588f
lea eax, [esp + 0x3c]
push eax
push edi
push dword [esp + 0x44]
call dword [sym.imp.USER32.dll_TranslateAcceleratorW]
test eax, eax
jne 0x43587a
lea eax, [esp + 0x3c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0x3c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push 0
push 0
push 0
lea eax, [esp + 0x48]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jne 0x435850
mov eax, dword [esp + 0x44]
pop edi
mov ecx, dword [esp + 0x52c]
pop esi
pop ebx
xor ecx, esp
call fcn.00572cc2
add esp, 0x528
ret 0x10