joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4076f0
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x28a0
call fcn.0055d630
mov eax, dword [0x5e3efc]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x2894], ecx
lea eax, [ebp - 0x2884]
mov dword [ebp - 0x2888], eax
mov dword [ebp - 0x28a0], 0
mov dword [ebp - 0x289c], 0x2880
mov dword [ebp - 0x2898], 0
lea ecx, [ebp - 0x289c]
push ecx
mov edx, dword [ebp - 0x2888]
push edx
call sub.IPHLPAPI.DLL_GetAdaptersInfo
cmp dword [ebp - 0x2888], 0
je 0x407907
mov eax, dword [ebp - 0x2888]
add eax, 8
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.005670c0
add esp, 8
test eax, eax
jne 0x4078f4
mov dword [ebp - 0x2890], 0
jmp 0x407790
mov edx, dword [ebp - 0x2890]
add edx, 1
mov dword [ebp - 0x2890], edx
mov eax, dword [ebp - 0x2888]
mov ecx, dword [ebp - 0x2890]
cmp ecx, dword [eax + 0x190]
jge 0x4077c3
mov edx, dword [ebp + 0x10]
add edx, dword [ebp - 0x2890]
mov eax, dword [ebp - 0x2888]
add eax, dword [ebp - 0x2890]
mov cl, byte [eax + 0x194]
mov byte [edx], cl
jmp 0x407781
mov edx, dword [ebp - 0x2888]
add edx, 0x1ac
mov dword [ebp - 0x288c], edx
cmp dword [ebp - 0x288c], 0
je 0x407841
mov eax, dword [ebp - 0x288c]
add eax, 4
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00567150
add esp, 8
mov edx, dword [ebp - 0x288c]
add edx, 4
push edx
mov eax, dword [ebp - 0x2894]
add eax, 0xd70
push eax
call fcn.00567150
add esp, 8
mov ecx, dword [ebp - 0x288c]
add ecx, 0x14
push ecx
mov edx, dword [ebp - 0x2894]
add edx, 0xdb0
push edx
call fcn.00567150
add esp, 8
mov eax, dword [ebp - 0x288c]
mov ecx, dword [eax]
mov dword [ebp - 0x288c], ecx
jmp 0x4077d5
mov edx, dword [ebp - 0x2888]
add edx, 0x1d8
push edx
call fcn.00563220
add esp, 4
test eax, eax
jbe 0x4078b9
mov eax, dword [ebp - 0x2888]
add eax, 0x1d8
push eax
mov ecx, dword [ebp + 0x14]
push ecx
call fcn.00567150
add esp, 8
mov edx, dword [ebp - 0x2888]
add edx, 0x1d8
push edx
mov eax, dword [ebp - 0x2894]
add eax, 0xd90
push eax
call fcn.00567150
add esp, 8
mov ecx, dword [ebp - 0x2888]
add ecx, 8
push ecx
push 0x593540
mov edx, dword [ebp - 0x2894]
add edx, 0xdd4
push edx
call fcn.00403060
add esp, 0xc
jmp 0x4078ca
push 0x593544
mov eax, dword [ebp + 0x14]
push eax
call fcn.00567150
add esp, 8
mov ecx, dword [ebp - 0x2888]
add ecx, 0x10c
push ecx
mov ecx, dword [ebp - 0x2894]
add ecx, 0xdd0
call fcn.00402710
mov dword [ebp - 0x2898], 1
jmp 0x407907
mov edx, dword [ebp - 0x2888]
mov eax, dword [edx]
mov dword [ebp - 0x2888], eax
jmp 0x40774a
mov eax, dword [ebp - 0x2898]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0055d390
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4105e0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0x103
push 0x5eaa3c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [ebp - 8]
push eax
mov ecx, dword [0x5eaa34]
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push 0x5eaa3c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 8]
je 0x410671
push 0x5eaa3c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x5e8cd8
push 0
mov eax, dword [0x5eaa38]
push eax
push 0x4106d0
push 0
push 0
call fcn.0056c726
add esp, 0x18
mov dword [0x5eaa34], eax
push 0x5eaa3c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [0x5eaa34], 0xffffffff
jne 0x410671
push 0
push 0
push str.Recv_Scan_Error_please_Restart
call fcn.0042867b
or eax, 0xffffffff
jmp 0x410673
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x412410
Capabilities:
Monitor local ipv4 address changes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
cmp dword [0x5ea9a8], 0
jne 0x412431
movzx eax, byte [0x5ea9ad]
test eax, eax
je 0x412431
xor al, al
jmp 0x412520
mov dword [ebp - 4], 0xffffffff
cmp dword [0x5ea9a8], 0
je 0x412448
mov dword [ebp - 4], 0xbb8
mov dword [ebp - 8], 0
call dword [sym.imp.WS2_32.dll_WSACreateEvent]
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x20]
push ecx
lea edx, [ebp - 8]
push edx
call sub.IPHLPAPI.DLL_NotifyAddrChange
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x412496
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
je 0x412496
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.NotifyAddrChange_error..._d_n
call fcn.0040e200
add esp, 8
mov al, 1
jmp 0x412520
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x4124b2
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.WS2_32.dll_WSACloseEvent]
mov byte [0x5e9bac], 0
movzx eax, byte [0x5e9bad]
test eax, eax
je 0x4124d1
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4124b9
cmp dword [0x5ea9a8], 0
je 0x4124fd
push str.Retrying_failed_Listening_Interfaces..
push 0x5e9858
call fcn.00418480
add esp, 8
push 1
push 0x5e9858
call fcn.00414450
add esp, 8
jmp 0x41251e
push str.Network_changed__re_detecting_Interfaces..
push 0x5e9858
call fcn.00418480
add esp, 8
push 1
push 0x5e9858
call fcn.00414450
add esp, 8
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x412590
Capabilities:
Create udp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x27c
mov eax, dword [0x5e3efc]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x158
push 0
mov eax, dword [ebp + 8]
push eax
call fcn.0055f580
add esp, 0xc
push 0
push 0
push 0
push 0
push 2
push 2
call dword [sym.imp.WS2_32.dll_WSASocketA]
mov dword [ebp - 0x270], eax
cmp dword [ebp - 0x270], 0xffffffff
jne 0x4125dc
jmp 0x4126e9
push 0
push 0
lea ecx, [ebp - 0x278]
push ecx
push 0x260
lea edx, [ebp - 0x264]
push edx
push 0
push 0
push 0x4004747f
mov eax, dword [ebp - 0x270]
push eax
call dword [sym.imp.WS2_32.dll_WSAIoctl]
cmp eax, 0xffffffff
jne 0x412613
jmp 0x4126e9
mov eax, dword [ebp - 0x278]
xor edx, edx
mov ecx, 0x4c
div ecx
mov dword [ebp - 0x27c], eax
mov dword [ebp - 0x268], 0
jmp 0x412643
mov edx, dword [ebp - 0x268]
add edx, 1
mov dword [ebp - 0x268], edx
mov eax, dword [ebp - 0x268]
cmp eax, dword [ebp - 0x27c]
jge 0x4126dc
imul ecx, dword [ebp - 0x268], 0x4c
lea edx, [ebp + ecx - 0x260]
mov dword [ebp - 0x26c], edx
imul eax, dword [ebp - 0x268], 0x4c
mov ecx, dword [ebp + eax - 0x264]
mov dword [ebp - 0x274], ecx
mov edx, dword [ebp - 0x26c]
cmp dword [edx + 4], 0
je 0x4126d7
mov eax, dword [ebp - 0x26c]
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [ebp + 8]
add edx, 0xe0
push edx
call fcn.00412250
add esp, 8
mov eax, dword [ebp - 0x274]
and eax, 8
jne 0x4126d7
mov ecx, dword [ebp - 0x274]
and ecx, 1
je 0x4126d7
mov edx, dword [ebp - 0x26c]
mov eax, dword [edx + 4]
push eax
mov ecx, dword [ebp + 8]
add ecx, 0x100
push ecx
call fcn.00412250
add esp, 8
jmp 0x412634
mov edx, dword [ebp - 0x270]
push edx
call dword [sym.imp.WS2_32.dll_closesocket]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0055d390
mov esp, ebp
pop ebp
ret

Function at 0x4182e0
Capabilities:
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5e3efc]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
je 0x418399
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp dword [ebp - 0x1c], 1
je 0x418399
lea edx, [ebp - 0x20]
push edx
push 1
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_ControlService]
push str.Stopping_Service.
call fcn.0040e200
add esp, 4
mov dword [ebp - 0x24], 0
jmp 0x418341
mov ecx, dword [ebp - 0x24]
add ecx, 1
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x24], 0x64
jge 0x418388
lea edx, [ebp - 0x20]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp dword [ebp - 0x1c], 1
jne 0x41836e
push str.Stopped_n
call fcn.0040e200
add esp, 4
mov al, 1
jmp 0x41839b
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x5936f8
call fcn.0040e200
add esp, 4
jmp 0x418338
push str.Failed_n
call fcn.0040e200
add esp, 4
xor al, al
jmp 0x41839b
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0055d390
mov esp, ebp
pop ebp
ret
Function at 0x418f20
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0x103
push 0x5eaa3c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [ebp - 8]
push eax
mov ecx, dword [0x5e3084]
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push 0x5eaa3c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 8]
je 0x418fae
push 0x5eaa3c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0
push 0
mov eax, dword [0x5e308c]
push eax
push 0x418690
push 0
push 0
call fcn.0056c726
add esp, 0x18
mov dword [0x5e3084], eax
push 0x5eaa3c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [0x5e3084], 0xffffffff
jne 0x418fae
push 0
push 0
push str.Specific_Error
call fcn.0042867b
or eax, 0xffffffff
jmp 0x418fb0
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x418fc0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
push 0x5eaa3c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x10
mov eax, dword [ebp + 8]
push eax
push 0
push 0x62
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [0x5e3088]
push edx
call dword [sym.imp.WS2_32.dll_sendto]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x419017
push str.sendto__
call fcn.004193a0
add esp, 4
push 0x5eaa3c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
or eax, 0xffffffff
jmp 0x419065
push 0x10
mov eax, dword [ebp + 8]
push eax
push 0
push 0x62
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [0x5e3088]
push edx
call dword [sym.imp.WS2_32.dll_sendto]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x419058
push str.sendto__
call fcn.004193a0
add esp, 4
push 0x5eaa3c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
or eax, 0xffffffff
jmp 0x419065
push 0x5eaa3c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x41e4ec
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
mov ecx, dword [esi + 4]
call fcn.0042691f
push 0xfffffffffffffff0
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowLongA]
push dword [ebp + 0xc]
and eax, 3
mov ecx, esi
cmp al, 3
je 0x41e528
call fcn.0041e70e
mov dword [esi + 0xc], 1
jmp 0x41e52d
call fcn.0041e70e
cmp dword [esi], 0
je 0x41e576
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov esi, dword [ebp + 0x10]
test eax, eax
jle 0x41e550
lea ecx, [eax + 1]
push ecx
push eax
mov ecx, esi
call fcn.0041c78d
jmp 0x41e561
push 0xff
mov ecx, esi
call fcn.00404730
push 0x100
push eax
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0xffffffffffffffff
mov ecx, esi
call fcn.0041c7b0
jmp 0x41e59a
mov esi, dword [ebp + 0x10]
push dword [esi]
push 0xffffffffffffffff
push 0x14d
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 0xffffffff
jne 0x41e59a
push dword [esi]
push dword [ebp - 4]
call fcn.004340e9
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x41e663
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
push edi
push dword [ebp + 0xc]
call fcn.0041e70e
cmp dword [esi], 0
mov edi, eax
mov dword [esi + 0xc], 1
je 0x41e6ab
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.0041c78d
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.0041c7b0
jmp 0x41e6b6
mov eax, dword [ebp + 0x10]
push dword [eax]
push edi
call fcn.004340e9
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x421408
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 4], ecx
mov esi, edi
cmp dword [ebp + 8], esi
je 0x42144d
call fcn.00429878
push 0xf0
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x42144d
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x421469
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.0041e92d
mov ebx, eax
test edi, edi
je 0x421467
test esi, esi
je 0x421467
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x421e63
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
je 0x421f21
cmp dword [esi + 0x20], 0
je 0x421f21
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x421f21
cmp dword [ebp + 8], 0
je 0x421f21
xor eax, eax
mov ebx, eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], ebx
mov edi, eax
call fcn.00429878
push 0x598350
push dword [ebp + 8]
mov eax, dword [eax + 0xc]
push eax
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x421ef2
mov edi, dword [ebp - 0xc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp - 0x10]
mov dword [ebp - 4], eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x421f21
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov dword [ebp - 8], eax
push dword [ebp - 4]
push ebx
push esi
call fcn.00436cce
add esp, 0xc
mov ebx, eax
cmp dword [ebp - 8], 0
je 0x421f12
test edi, edi
je 0x421f12
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
test ebx, ebx
je 0x421f1d
mov ecx, esi
call fcn.00421c06
mov eax, ebx
jmp 0x421f23
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x426d09
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x58da0a
call fcn.0055dee9
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x74], ebx
jne 0x426d2f
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x426d8e
call fcn.0041cb17
push eax
lea ecx, [ebp - 0x10]
call fcn.00401ef0
mov edi, dword [edi + 0x74]
lea ecx, [ebp - 0x10]
push ecx
mov dword [ebp - 4], ebx
mov eax, dword [edi]
mov esi, dword [eax + 0x8c]
mov ecx, esi
call fcn.0055deac
mov ecx, edi
call esi
mov esi, dword [ebp + 8]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push esi
call fcn.0056ef4d
push eax
call fcn.00405ca0
add esp, 0x14
test esi, esi
je 0x426d81
push esi
call fcn.00563220
pop ecx
mov ebx, eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00404800
mov eax, ebx
call fcn.0055deb2
ret 8

Function at 0x42761b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, ecx
push edi
mov edi, dword [ebp + 8]
mov dword [ebx + 0x84], edi
test edi, 0xffff0000
jne 0x427646
cmp dword [ebx + 0x80], 0
jne 0x427646
movzx eax, di
mov dword [ebx + 0x80], eax
call fcn.00429878
push 5
push edi
mov esi, dword [eax + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov edi, eax
mov ecx, ebx
push edi
call fcn.004278d4
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x427680
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor esi, esi
call fcn.00429878
push 5
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x4276b7
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
mov ecx, dword [ebp - 4]
push ebx
push dword [ebp + 0xc]
push esi
call fcn.004276d8
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x42b6fc
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
push edi
cmp dword [ecx + 0x58], esi
je 0x42b74f
push esi
push dword [ebp + 8]
call fcn.0042b8ec
mov edi, eax
test edi, edi
jne 0x42b71f
mov eax, dword [ebp + 0x10]
jmp 0x42b761
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp + 0xc]
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x42b71a
mov eax, dword [ebp - 8]
jmp 0x42b761
push dword [ecx + 0x6c]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x42d86d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor esi, esi
mov eax, ecx
push edi
mov edi, esi
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], esi
je 0x42d8b7
call fcn.00429878
push 0xf0
push dword [ebp + 0xc]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x42d8b4
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x42d905
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
mov eax, dword [ebp - 4]
xor ebx, ebx
inc ebx
test esi, esi
je 0x42d8e3
mov ecx, dword [eax]
push dword [ebp + 0x10]
push esi
mov esi, dword [ecx + 0x20]
mov ecx, esi
push dword [ebp + 8]
call fcn.0055deac
mov ecx, dword [ebp - 4]
call esi
mov ebx, eax
test edi, edi
je 0x42d8e3
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp + 8]
mov edi, dword [eax + 0x70]
test edi, edi
je 0x42d903
mov eax, dword [edi]
push dword [ebp + 0x10]
mov esi, dword [eax + 0xa0]
mov ecx, esi
call fcn.0055deac
mov ecx, edi
call esi
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4391ff
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
mov dword [ebp - 4], ebx
test byte [esi + 4], 1
je 0x439219
mov edi, dword [esi + 0xc]
jmp 0x439259
push 5
push dword [esi + 0xc]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x439232
call fcn.0041d74d
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x439247
call fcn.0041d74d
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x439259
call fcn.0041d74d
call fcn.00429878
cmp dword [eax + 0x3c], 0
je 0x43926e
push edi
mov ecx, ebx
call fcn.00438893
mov edi, eax
push dword [ebp + 0xc]
push edi
call fcn.0043944b
mov ebx, eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x88]
test ecx, ecx
je 0x439297
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 4]
and dword [eax + 0x88], 0
test ebx, ebx
je 0x4392a3
mov edi, ebx
mov dword [eax + 0x88], ebx
or dword [esi + 4], 1
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x47eb5f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
test esi, esi
jne 0x47eb78
call fcn.00429878
mov esi, dword [eax + 0xc]
push 0x5a1734
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov ebx, eax
test ebx, ebx
je 0x47ebce
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x47ebcd
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
test eax, eax
jne 0x47ebae
xor esi, esi
jmp 0x47ebc4
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 8]
push eax
push dword [ebp - 4]
call fcn.0047ebd6
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x499365
Capabilities:
Get file system object information

Disassembly:
push 0x274
mov eax, 0x587141
call fcn.0055df1d
mov ebx, ecx
mov eax, dword [ebx + 0x14]
sub eax, 0x10
push eax
call fcn.00402b20
pop ecx
lea esi, [eax + 0x10]
mov dword [ebp - 0x278], esi
and dword [ebp - 4], 0
lea ecx, [ebp - 0x278]
push 0
push 0x5991d8
call fcn.00406c00
cmp eax, 0xffffffff
jne 0x499430
push 0
push 0x5a16f0
lea ecx, [ebp - 0x278]
call fcn.00406c00
cmp eax, 0xffffffff
jne 0x499430
push 0
push 0x599148
lea ecx, [ebp - 0x278]
call fcn.00406c00
cmp eax, 0xffffffff
jne 0x499430
mov eax, dword [ebx + 0x14]
sub eax, 0x10
push eax
call fcn.00402b20
mov edi, eax
pop ecx
mov dword [ebp - 0x27c], edi
lea ecx, [edi + 0x10]
mov dword [ebp - 0x280], ecx
xor edx, edx
mov byte [ebp - 4], 1
push edx
lea eax, [ebp - 0x114]
push eax
push 0x104
push edx
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_SearchPathA]
test eax, eax
jne 0x49940d
mov eax, dword [ebx]
mov edi, dword [eax + 0x14]
mov ecx, edi
call fcn.0055deac
mov ecx, ebx
call edi
mov ecx, dword [ebp - 0x27c]
mov edi, eax
call fcn.00404800
jmp 0x499468
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x278]
call fcn.00404960
mov ecx, edi
mov byte [ebp - 4], 0
call fcn.00404800
mov esi, dword [ebp - 0x278]
push 0x105
push 0x160
lea eax, [ebp - 0x274]
push eax
push 0
push esi
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
test eax, eax
je 0x499456
mov edi, dword [ebp - 0x274]
jmp 0x499468
mov eax, dword [ebx]
mov edi, dword [eax + 0x14]
mov ecx, edi
call fcn.0055deac
mov ecx, ebx
call edi
mov edi, eax
lea ecx, [esi - 0x10]
call fcn.00404800
mov eax, edi
call fcn.0055dec7
ret

Function at 0x576e92
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00576d11

Function at 0x57c6ee
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0057c3ae