joyce8/EMBER2024-capa huggingface dataset:
Function at 0x61d2f8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x61d461
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.004b1568
mov ebx, eax
mov eax, dword [esi + 0xc]
mov eax, dword [eax]
mov dword [ebx + 0x2c], eax
push 0
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
mov edx, 4
mov eax, esi
call fcn.0061c588
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 0x10]
call fcn.0040a414
push 0
lea eax, [ebp - 0x20]
push eax
mov ecx, 1
mov edx, 4
mov eax, esi
call fcn.0061c588
mov edx, dword [ebp - 0x20]
lea eax, [ebx + 0xc]
call fcn.0040a414
push 0
lea eax, [ebp - 0x24]
push eax
xor ecx, ecx
mov edx, 1
mov eax, esi
call fcn.0061c588
mov edx, dword [ebp - 0x24]
lea eax, [ebx + 0x14]
call fcn.0040a414
lea ecx, [ebp - 0x28]
mov eax, dword [esi + 0xc]
add eax, 4
mov dl, 1
call fcn.0061c6c8
mov edx, dword [ebp - 0x28]
lea eax, [ebx + 0x28]
mov ecx, 0
call fcn.0040ab78
mov eax, dword [esi + 0xc]
add eax, 0x20
lea edx, [ebp - 8]
push edx
push eax
call sub.kernel32.dll_FileTimeToLocalFileTime
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 8]
push eax
call sub.kernel32.dll_FileTimeToSystemTime
lea eax, [ebp - 0x18]
call fcn.0042a238
fstp qword [ebx + 0x18]
wait
mov eax, dword [esi + 0xc]
add eax, 0x28
lea edx, [ebp - 8]
push edx
push eax
call sub.kernel32.dll_FileTimeToLocalFileTime
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 8]
push eax
call sub.kernel32.dll_FileTimeToSystemTime
lea eax, [ebp - 0x18]
call fcn.0042a238
fstp qword [ebx + 0x20]
wait
lea eax, [ebx + 0x30]
mov edx, dword [esi + 0xc]
mov edx, dword [edx + 0xc]
mov ecx, 0
call fcn.0040a714
lea ecx, [ebp - 0x2c]
mov eax, dword [esi + 0xc]
add eax, 0x44
xor edx, edx
call fcn.0061c6c8
mov edx, dword [ebp - 0x2c]
lea eax, [ebx + 0x34]
mov ecx, 0
call fcn.0040ab78
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61d468
lea eax, [ebp - 0x2c]
mov edx, 2
call fcn.00409ff0
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.0040a020
ret

Function at 0x61e73c
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x61e7e2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00409f90
mov eax, ebx
mov edx, 0x104
call fcn.0040b05c
mov eax, dword [ebx]
mov edx, 0x208
call fcn.005e9d38
push 0
push 0x26
mov eax, dword [ebx]
call fcn.0040aec8
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathW
test eax, eax
je 0x61e7ae
lea edx, [ebp - 8]
mov eax, dword [ebx]
call fcn.00425c48
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.0042e27c
mov edx, dword [ebp - 4]
mov eax, ebx
mov ecx, 0x61e7fc
call fcn.0040b134
cmp dword [ebx], 0
jne 0x61e7c7
mov ecx, 0x17c
mov edx, 0x61e82c
mov eax, 0x61e8f8
call fcn.00409ddc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61e7e9
lea eax, [ebp - 8]
mov edx, 2
call fcn.00409ff0
ret
Function at 0x61ea30
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x61eaf5
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
call sub.kernel32.dll_GetWindowsDirectoryW_1
mov esi, eax
test esi, esi
jbe 0x61ea7e
mov edx, esi
dec edx
lea eax, [ebp - 4]
call fcn.0040b05c
push esi
mov eax, dword [ebp - 4]
call fcn.0040aec8
push eax
call sub.kernel32.dll_GetWindowsDirectoryW_1
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.0040a370
jmp 0x61eac6
mov dl, 1
mov eax, 0x61eb10
call fcn.00427280
test al, al
je 0x61ea9c
mov eax, ebx
mov edx, 0x61eb10
call fcn.0040a370
jmp 0x61eac6
mov dl, 1
mov eax, 0x61eb34
call fcn.00427280
test al, al
je 0x61eaba
mov eax, ebx
mov edx, 0x61eb34
call fcn.0040a370
jmp 0x61eac6
mov eax, ebx
mov edx, 0x61eb54
call fcn.0040a370
lea edx, [ebp - 8]
mov eax, dword [ebx]
call fcn.0042e27c
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.0040a370
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61eafc
lea eax, [ebp - 8]
mov edx, 2
call fcn.00409ff0
ret

Function at 0x61eb5c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x61ec60
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
call sub.kernel32.dll_GetSystemDirectoryW_1
mov esi, eax
test esi, esi
jbe 0x61ebad
mov edx, esi
dec edx
lea eax, [ebp - 4]
call fcn.0040b05c
push esi
mov eax, dword [ebp - 4]
call fcn.0040aec8
push eax
call sub.kernel32.dll_GetSystemDirectoryW_1
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.0040a370
jmp 0x61ec31
mov dl, 1
mov eax, 0x61ec7c
call fcn.00427280
test al, al
je 0x61ebcb
mov eax, ebx
mov edx, 0x61ec7c
call fcn.0040a370
jmp 0x61ec31
mov dl, 1
mov eax, 0x61ecac
call fcn.00427280
test al, al
je 0x61ebe9
mov eax, ebx
mov edx, 0x61ecac
call fcn.0040a370
jmp 0x61ec31
mov dl, 1
mov eax, 0x61ece0
call fcn.00427280
test al, al
je 0x61ec07
mov eax, ebx
mov edx, 0x61ece0
call fcn.0040a370
jmp 0x61ec31
mov dl, 1
mov eax, 0x61ed10
call fcn.00427280
test al, al
je 0x61ec25
mov eax, ebx
mov edx, 0x61ed10
call fcn.0040a370
jmp 0x61ec31
mov eax, ebx
mov edx, 0x61ed3c
call fcn.0040a370
lea edx, [ebp - 8]
mov eax, dword [ebx]
call fcn.0042e27c
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.0040a370
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61ec67
lea eax, [ebp - 8]
mov edx, 2
call fcn.00409ff0
ret
Function at 0x61f528
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf0
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00409fd8
xor edx, edx
push ebp
push 0x61f59e
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 4]
push eax
push esi
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
test eax, 0x80000000
sete al
test al, al
je 0x61f594
lea eax, [ebp - 0x20e]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListW
test eax, eax
je 0x61f58b
mov eax, ebx
lea edx, [ebp - 0x20e]
mov ecx, 0x105
call fcn.0040ac34
mov eax, dword [ebp - 4]
push eax
call sub.ole32.dll_CoTaskMemFree
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x61f5a8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x61f5b0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040a074
xor eax, eax
push ebp
push 0x61f6d0
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x61f5e6
sub eax, 4
mov eax, dword [eax]
inc eax
add eax, eax
call fcn.004066c0
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x61f6b3
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
push ebp
push 0x61f668
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
call fcn.00428244
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_ExpandEnvironmentStringsW
mov ebx, eax
inc ebx
mov eax, ebx
add eax, eax
call fcn.004066c0
mov dword [ebp - 0x10], eax
push ebx
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_ExpandEnvironmentStringsW
test eax, eax
jbe 0x61f653
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
call fcn.004284dc
jmp 0x61f65e
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.0040a370
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x61f689
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61f6ba
cmp dword [ebp - 0xc], 0
je 0x61f6a4
mov eax, dword [ebp - 0xc]
call fcn.004066dc
cmp dword [ebp - 0x10], 0
je 0x61f6b2
mov eax, dword [ebp - 0x10]
call fcn.004066dc
ret
Function at 0x61fd40
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 4], ebx
mov byte [ebp - 5], cl
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x61fe2e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [esi]
mov edx, dword [eax]
call dword [edx + 0x48]
cmp byte [ebp - 5], 0
je 0x61fd7c
mov di, 0x41
jmp 0x61fd80
mov di, 0x43
push esi
push edi
mov esi, 0x61fe3c
lea edi, [ebp - 0x25]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
test bl, bl
je 0x61fd9b
or byte [ebp - 0x25], 0x10
mov ebx, edi
cmp bx, 0x5a
ja 0x61fe0b
lea eax, [ebp - 0x2c]
mov edx, ebx
call fcn.0040aef0
mov edx, dword [ebp - 0x2c]
lea eax, [ebp - 4]
mov ecx, 0x61fe68
call fcn.0040b134
lea eax, [ebp - 0x30]
mov edx, ebx
call fcn.0040aef0
lea eax, [ebp - 0x30]
mov edx, 0x61fe68
call fcn.0040b0dc
mov eax, dword [ebp - 0x30]
call fcn.0040aec8
push eax
call sub.kernel32.dll_GetDriveTypeW_1
cmp eax, 0xff
ja 0x61fded
bt dword [ebp - 0x25], eax
jae 0x61fe04
mov eax, ebx
call fcn.0061fc8c
test al, al
je 0x61fe04
mov eax, dword [esi]
mov edx, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
inc ebx
cmp bx, 0x5b
jne 0x61fda3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61fe35
lea eax, [ebp - 0x30]
mov edx, 2
call fcn.00409ff0
lea eax, [ebp - 4]
call fcn.00409f90
ret

Function at 0x6233ec
Capabilities:
Parse pe header

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffedc
mov ebp, ecx
mov esi, edx
mov edi, eax
xor ebx, ebx
push 0x1c
lea eax, [esp + 4]
push eax
push edi
call sub.kernel32.dll_VirtualQuery_1
cmp eax, 0x1c
jne 0x623468
cmp dword [esp + 0x10], 0x1000
jne 0x623468
cmp dword [esp + 4], 0
je 0x623468
push 0x104
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0xc]
push eax
call sub.kernel32.dll_GetModuleFileNameA
test eax, eax
je 0x623468
mov eax, dword [esp + 4]
mov dword [esi], eax
mov eax, dword [esi]
cmp word [eax], 0x5a4d
jne 0x623468
mov eax, dword [esi]
mov edx, dword [esi]
add edx, 0x3c
add eax, dword [edx]
cmp dword [eax], 0x4550
jne 0x623468
mov edx, dword [esi]
add edx, dword [eax + 0x78]
mov dword [ebp], edx
cmp dword [ebp], 0
setne bl
mov eax, ebx
add esp, 0x124
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x626b5c
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x218], ebx
mov dword [ebp - 0x21c], ebx
mov esi, ecx
mov edi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x626cbd
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
cmp dword [edi + 0x10], 0
je 0x626c9f
cmp word [edi + 0x1e], 2
jb 0x626c9f
movzx edx, word [edi + 0x1e]
sub edx, 2
sar edx, 1
jns 0x626bb0
adc edx, 0
mov eax, esi
call fcn.0040b05c
lea eax, [ebp - 8]
push eax
movzx eax, word [edi + 0x1e]
sub eax, 2
push eax
mov eax, dword [esi]
push eax
mov eax, dword [edi + 0x20]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_ReadProcessMemory
test eax, eax
je 0x626be5
mov eax, dword [ebp - 8]
add eax, 2
movzx edx, word [edi + 0x1e]
cmp eax, edx
je 0x626be9
xor ebx, ebx
jmp 0x626beb
mov bl, 1
test bl, bl
je 0x626c9f
mov eax, dword [esi]
call fcn.0040aec8
mov edx, eax
mov eax, esi
call fcn.0040af30
mov edx, dword [esi]
mov eax, 0x626cdc
call fcn.005d0144
test al, al
je 0x626c26
mov eax, esi
mov ecx, 4
mov edx, 1
call fcn.0040b34c
jmp 0x626c9f
mov edx, dword [esi]
mov eax, 0x626cf4
call fcn.005d01b4
test al, al
je 0x626c8c
push 0x104
lea eax, [ebp - 0x212]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
lea eax, [ebp - 0x218]
push eax
mov eax, dword [esi]
mov ecx, 0x7fffffff
mov edx, 0x15
call fcn.0040b304
mov eax, dword [ebp - 0x218]
push eax
lea eax, [ebp - 0x21c]
lea edx, [ebp - 0x212]
mov ecx, 0x105
call fcn.0040af84
mov edx, dword [ebp - 0x21c]
mov eax, esi
pop ecx
call fcn.0040b134
jmp 0x626c9f
mov eax, dword [esi]
call fcn.0040aec8
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
setne bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x626cc4
lea eax, [ebp - 0x21c]
mov edx, 2
call fcn.00409ff0
ret
Function at 0x626d20
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe84
push ebx
xor edx, edx
mov dword [ebp - 0x178], edx
mov dword [ebp - 0x17c], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040a084
xor eax, eax
push ebp
push 0x626ea0
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x2000
push 0x160
lea eax, [ebp - 0x168]
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.0040aa3c
push eax
call sub.shell32.dll_SHGetFileInfoA
mov ebx, eax
lea eax, [ebp - 0x16c]
mov edx, ebx
and dl, 0xff
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x16c]
lea eax, [ebp - 0x170]
call fcn.0040a668
lea eax, [ebp - 0x174]
mov edx, 0xff00
and edx, ebx
shr edx, 8
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x174]
lea eax, [ebp - 0x170]
mov cl, 2
call fcn.0040a690
lea edx, [ebp - 0x170]
lea eax, [ebp - 8]
mov ecx, 0
call fcn.0040a788
mov eax, dword [ebp - 8]
mov edx, 0x626ebc
call fcn.0040a9bc
jne 0x626deb
mov bl, 1
jmp 0x626e75
mov eax, dword [ebp - 8]
mov edx, 0x626ecc
call fcn.0040a9bc
jne 0x626dfe
mov bl, 2
jmp 0x626e75
mov eax, dword [ebp - 8]
mov edx, 0x626edc
call fcn.0040a9bc
jne 0x626e1d
mov eax, ebx
call fcn.00414964
test ax, ax
jne 0x626e1d
mov bl, 3
jmp 0x626e75
mov eax, dword [ebp - 8]
mov edx, 0x626edc
call fcn.0040a9bc
jne 0x626e3c
mov eax, ebx
call fcn.00414964
test ax, ax
jbe 0x626e3c
mov bl, 4
jmp 0x626e75
lea eax, [ebp - 0x17c]
mov edx, dword [ebp - 4]
call fcn.0040afa0
mov eax, dword [ebp - 0x17c]
lea edx, [ebp - 0x178]
call fcn.00427ac8
mov eax, dword [ebp - 0x178]
mov edx, 0x626eec
call fcn.005cfa8c
test al, al
je 0x626e73
mov bl, 1
jmp 0x626e75
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x626ea7
lea eax, [ebp - 0x17c]
mov edx, 2
call fcn.00409ff0
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040a020
ret
Function at 0x626f08
Capabilities:
Get file attributes
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe8c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x170], ebx
mov dword [ebp - 0x174], ebx
mov dword [ebp - 8], ebx
mov ebx, ecx
mov byte [ebp - 9], dl
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040a084
xor eax, eax
push ebp
push 0x62703a
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, 0x4010
cmp byte [ebp - 9], 0
je 0x626f53
or esi, 1
jmp 0x626f56
or esi, 0
test bl, bl
je 0x626fc4
lea eax, [ebp - 0x174]
mov edx, dword [ebp - 4]
call fcn.0040afa0
mov eax, dword [ebp - 0x174]
lea edx, [ebp - 0x170]
call fcn.00427b04
mov edx, dword [ebp - 0x170]
lea eax, [ebp - 8]
mov ecx, 0
call fcn.0040ab78
mov edx, 0x627058
mov eax, dword [ebp - 8]
call fcn.005cfa2c
test al, al
jne 0x626fb2
mov edx, 0x62706c
mov eax, dword [ebp - 8]
call fcn.005cfa2c
test al, al
jne 0x626fb2
xor ebx, ebx
jmp 0x626fb4
mov bl, 1
test bl, bl
je 0x626fc4
or esi, 0x100
or esi, 0x8000
push esi
push 0x160
lea eax, [ebp - 0x169]
push eax
mov eax, dword [ebp - 4]
call fcn.0040aa3c
mov edi, eax
push edi
call sub.kernel32.dll_GetFileAttributesA
push eax
push edi
call sub.shell32.dll_SHGetFileInfoA
mov esi, eax
test esi, esi
jne 0x626ff2
xor ebx, ebx
jmp 0x62700f
test bl, bl
je 0x626ffe
mov ebx, dword [ebp - 0x169]
jmp 0x62700f
push 0
mov eax, dword [ebp - 0x165]
push eax
push esi
call sub.comctl32.dll_ImageList_GetIcon
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x627041
lea eax, [ebp - 0x174]
mov edx, 2
call fcn.00409ff0
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040a020
ret
Function at 0x636050
Capabilities:
Find taskbar

Disassembly:
push ebx
push esi
mov esi, eax
push 0x6360c4
push 0x6360c8
push 0
push 0x6360c4
push 0x6360e4
call sub.user32.dll_FindWindowW
push eax
call sub.user32.dll_FindWindowExW
mov ebx, eax
test ebx, ebx
je 0x636095
mov eax, ebx
call fcn.006340d4
mov edx, eax
test edx, edx
je 0x63608b
sub edx, 0xffffff9c
mov eax, esi
call fcn.0040dc10
pop esi
pop ebx
ret
call sub.kernel32.dll_GetLastError_2
push eax
push 0
push 0
push 0
push 0
xor ecx, ecx
mov dl, 1
mov eax, dword [0x6329ec]
call fcn.0063432c
mov edx, eax
test edx, edx
je 0x6360ba
sub edx, 0xffffff9c
mov eax, esi
call fcn.0040dc10
pop esi
pop ebx
ret

Function at 0x637058
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x637171
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
call fcn.005d4758
test al, al
je 0x637153
mov eax, dword [ebp - 4]
cmp byte [eax + 0x81], 0
jne 0x637125
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x54]
xor eax, eax
push ebp
push 0x63711e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x78], 0
je 0x6370fa
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x78]
mov edx, dword [eax]
call dword [edx + 0x18]
test al, al
je 0x6370fa
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x78]
mov edx, dword [eax]
call dword [edx + 0x94]
test eax, eax
je 0x637108
mov eax, dword [ebp - 4]
push eax
push 0x636f4c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x78]
mov edx, dword [eax]
call dword [edx + 0x94]
push eax
call sub.user32.dll_EnumThreadWindows
jmp 0x637108
mov eax, dword [ebp - 4]
push eax
push 0x636f4c
call sub.user32.dll_EnumWindows
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x637153
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x58]
ret
lea eax, [ebp - 0x10]
mov edx, dword [0x78bf5c]
mov ecx, 0
call fcn.0040a714
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
call fcn.0040afa0
mov ecx, dword [ebp - 0xc]
mov edx, 0x30000
mov eax, dword [ebp - 4]
call fcn.005d4098
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x637178
lea eax, [ebp - 0x10]
call fcn.00409fb4
lea eax, [ebp - 0xc]
call fcn.00409f90
ret
Function at 0x63e16c
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x63e174
push ecx
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x63e2e3
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebx + 0x54], 0
jne 0x63e2ac
mov eax, ebx
call fcn.005d4758
test al, al
je 0x63e2ac
mov eax, dword [ebx + 0x38]
mov edx, dword [eax]
call dword [edx + 0x94]
mov esi, eax
call sub.kernel32.dll_GetCurrentProcessId
cmp esi, eax
je 0x63e1d4
lea eax, [ebp - 0x30]
call fcn.005d6da0
cmp byte [ebp - 0x20], 0
je 0x63e1e4
cmp dword [ebx + 0x3c], 0x80000000
jb 0x63e1e4
mov eax, dword [ebx + 0x3c]
call fcn.005d7aa4
mov dword [ebx + 0x54], eax
jmp 0x63e298
lea eax, [ebp - 4]
mov edx, dword [ebx + 0x38]
call fcn.0040dc10
lea ecx, [ebp - 8]
mov edx, 0x10
mov eax, dword [ebp - 4]
mov esi, dword [eax]
call dword [esi + 0xbc]
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x18]
test al, al
je 0x63e277
push 2
lea ecx, [ebp - 0xa]
mov edx, dword [ebx + 0x3c]
mov eax, dword [ebp - 4]
mov esi, dword [eax]
call dword [esi + 0x120]
test al, al
je 0x63e298
cmp word [ebp - 0xa], 0x5a4d
jne 0x63e298
push 4
lea ecx, [ebp - 0x10]
mov edx, dword [ebx + 0x3c]
add edx, 0x3c
mov eax, dword [ebp - 4]
mov esi, dword [eax]
call dword [esi + 0x120]
test al, al
je 0x63e298
mov eax, dword [ebx + 0x3c]
add eax, dword [ebp - 0x10]
mov dword [ebx + 0x54], eax
push 4
lea ecx, [ebp - 0x10]
mov edx, dword [ebx + 0x54]
mov eax, dword [ebp - 4]
mov esi, dword [eax]
call dword [esi + 0x120]
test al, al
je 0x63e270
cmp dword [ebp - 0x10], 0x4550
je 0x63e298
xor eax, eax
mov dword [ebx + 0x54], eax
jmp 0x63e298
lea edx, [ebp - 0x34]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x24]
mov eax, dword [ebp - 0x34]
push eax
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x20]
mov edx, eax
mov eax, ebx
pop ecx
call fcn.005d4098
cmp dword [ebx + 0x54], 0
jne 0x63e2ac
xor ecx, ecx
mov edx, 2
mov eax, ebx
call fcn.005d4098
mov ebx, dword [ebx + 0x54]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x63e2ea
lea eax, [ebp - 0x34]
call fcn.00409f90
lea eax, [ebp - 0x30]
mov edx, dword [0x5d680c]
call fcn.0040b900
lea eax, [ebp - 8]
call fcn.0040dbf8
lea eax, [ebp - 4]
call fcn.0040dbf8
ret
Function at 0x641980
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov edi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x641a7d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x79b868]
mov byte [eax], 1
mov eax, 8
call fcn.004066c0
mov ebx, eax
mov dword [ebx], esi
mov eax, dword [ebp - 4]
mov dword [ebx + 4], eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
push ebx
push 0x6418f8
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
call sub.kernel32.dll_CreateThread_1
mov esi, eax
test esi, esi
jne 0x641a1a
mov eax, ebx
call fcn.004066dc
call sub.kernel32.dll_GetLastError_2
push eax
push 0
push 0
push 0
xor ecx, ecx
mov dl, 1
mov eax, dword [0x6294b4]
call fcn.0062e554
mov edx, eax
test edx, edx
je 0x641a11
sub edx, 0xffffff90
mov eax, edi
call fcn.0040dc10
jmp 0x641a5f
lea ecx, [ebp - 0x10]
mov dl, 1
mov eax, esi
call fcn.0063082c
mov edx, dword [ebp - 0x10]
mov al, 5
call fcn.0062dd8c
mov ebx, eax
mov byte [ebx + 0x4c], 1
mov eax, dword [ebp - 0xc]
mov dword [ebx + 0x50], eax
lea eax, [ebp - 0x14]
call fcn.006480c8
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x6c]
call fcn.0040dc10
mov eax, edi
mov edx, ebx
test edx, edx
je 0x641a5a
sub edx, 0xffffff90
call fcn.0040dc10
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x641a84
lea eax, [ebp - 0x14]
call fcn.0040dbf8
lea eax, [ebp - 0x10]
call fcn.0040dbf8
ret

Function at 0x64bfa8
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov byte [ebp - 5], al
xor eax, eax
push ebp
push 0x64c068
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea edx, [ebp - 0xc]
mov eax, dword [0x78c214]
call fcn.005d1348
push dword [ebp - 0xc]
push 0x64c084
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp + 8]
mov edx, dword [eax - 4]
mov edx, dword [edx]
movzx ecx, byte [ebp - 5]
mov eax, dword [0x78c218]
call fcn.0064be90
push dword [ebp - 0x10]
lea eax, [ebp - 4]
mov edx, 3
call fcn.0040a8f4
push 0xffffffffffffffff
mov eax, dword [ebp - 4]
call fcn.0040aa3c
push eax
call fcn.0064be7c
mov esi, eax
test esi, esi
je 0x64c045
push 0
push 0
push 0
push 4
push esi
call sub.kernel32.dll_MapViewOfFile
test eax, eax
je 0x64c03f
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
mov ecx, dword [eax]
mov dword [edx], ecx
push eax
call sub.kernel32.dll_UnmapViewOfFile
mov bl, 1
push esi
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x64c06f
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.0040a020
lea eax, [ebp - 4]
call fcn.00409fb4
ret

Function at 0x64c2c0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
mov ebx, eax
call sub.kernel32.dll_GetVersion_1
test eax, 0x80000000
je 0x64c2e0
push 0x40
push 0x1000
push ebx
push 0
call sub.kernel32.dll_VirtualAlloc_1
pop ebx
ret
push 0
push ebx
call fcn.00624700
pop ebx
ret