joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41ef30
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4adfe3
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4e96d0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov esi, dword [ebp + 8]
movzx eax, byte [esi]
mov byte [edi], al
movzx eax, byte [esi + 1]
mov byte [edi + 1], al
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 8]
sub eax, 0x10
push eax
call fcn.0041a940
add eax, 0x10
mov dword [edi + 8], eax
mov dword [ebp - 4], 0
mov eax, dword [esi + 0xc]
sub eax, 0x10
push eax
call fcn.0041a940
add eax, 0x10
mov dword [edi + 0xc], eax
mov byte [ebp - 4], 1
mov eax, dword [esi + 0x10]
sub eax, 0x10
push eax
call fcn.0041a940
add eax, 0x10
mov dword [edi + 0x10], eax
mov byte [ebp - 4], 2
mov eax, dword [esi + 0x14]
sub eax, 0x10
push eax
call fcn.0041a940
add eax, 0x10
mov dword [edi + 0x14], eax
mov byte [ebp - 4], 3
mov eax, dword [esi + 0x18]
mov dword [edi + 0x18], eax
mov eax, dword [esi + 0x1c]
sub eax, 0x10
push eax
call fcn.0041a940
add eax, 0x10
mov dword [edi + 0x1c], eax
mov byte [ebp - 4], 4
mov eax, dword [esi + 0x20]
sub eax, 0x10
push eax
call fcn.0041a940
add eax, 0x10
mov dword [edi + 0x20], eax
mov byte [ebp - 4], 5
mov eax, dword [esi + 0x24]
sub eax, 0x10
push eax
call fcn.0041a940
add eax, 0x10
mov dword [edi + 0x24], eax
mov byte [ebp - 4], 6
mov eax, dword [esi + 0x28]
sub eax, 0x10
push eax
call fcn.0041a940
add eax, 0x10
mov dword [edi + 0x28], eax
mov byte [ebp - 4], 7
mov eax, dword [esi + 0x2c]
sub eax, 0x10
push eax
call fcn.0041a940
add eax, 0x10
mov dword [edi + 0x2c], eax
mov byte [ebp - 4], 8
mov eax, dword [esi + 0x30]
mov dword [edi + 0x30], eax
mov eax, dword [esi + 0x34]
sub eax, 0x10
push eax
call fcn.0041a940
add esp, 0x28
add eax, 0x10
mov dword [edi + 0x34], eax
call fcn.0040d990
mov ecx, eax
test ecx, ecx
jne 0x41f06e
push 0x80004005
call fcn.0040abe0
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi + 0x38], eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x41f090
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ae058
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x4e96d0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [ebp + 8]
mov dword [esi + 4], eax
mov eax, dword [ebp + 0xc]
mov word [esi], 1
mov eax, dword [eax]
sub eax, 0x10
push eax
call fcn.0041a940
add eax, 0x10
mov dword [esi + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], 0
mov eax, dword [eax]
sub eax, 0x10
push eax
call fcn.0041a940
add eax, 0x10
mov dword [esi + 0xc], eax
mov eax, dword [ebp + 0x14]
mov byte [ebp - 4], 1
mov eax, dword [eax]
sub eax, 0x10
push eax
call fcn.0041a940
add eax, 0x10
mov dword [esi + 0x10], eax
mov eax, dword [ebp + 0x18]
mov byte [ebp - 4], 2
mov eax, dword [eax]
sub eax, 0x10
push eax
call fcn.0041a940
add eax, 0x10
mov dword [esi + 0x14], eax
mov eax, dword [ebp + 0x30]
mov byte [ebp - 4], 3
mov dword [esi + 0x18], 0
mov eax, dword [eax]
sub eax, 0x10
push eax
call fcn.0041a940
add eax, 0x10
mov dword [esi + 0x1c], eax
mov eax, dword [ebp + 0x1c]
mov byte [ebp - 4], 4
mov eax, dword [eax]
sub eax, 0x10
push eax
call fcn.0041a940
add eax, 0x10
mov dword [esi + 0x20], eax
mov eax, dword [ebp + 0x20]
mov byte [ebp - 4], 5
mov eax, dword [eax]
sub eax, 0x10
push eax
call fcn.0041a940
add eax, 0x10
mov dword [esi + 0x24], eax
mov eax, dword [ebp + 0x24]
mov byte [ebp - 4], 6
mov eax, dword [eax]
sub eax, 0x10
push eax
call fcn.0041a940
add eax, 0x10
mov dword [esi + 0x28], eax
mov eax, dword [ebp + 0x28]
mov byte [ebp - 4], 7
mov eax, dword [eax]
sub eax, 0x10
push eax
call fcn.0041a940
add eax, 0x10
add esp, 0x24
mov dword [esi + 0x2c], eax
mov eax, dword [ebp + 0x34]
mov dword [esi + 0x30], eax
call fcn.0040d990
mov ecx, eax
test ecx, ecx
jne 0x41f1c0
push 0x80004005
call fcn.0040abe0
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x34], eax
call fcn.0040d990
mov ecx, eax
test ecx, ecx
jne 0x41f1e0
push 0x80004005
call fcn.0040abe0
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x38], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x38
Function at 0x41f540
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ae0e8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x4e96d0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x14], esi
push 0x4f3ce8
mov dword [ebp - 0x20], 0x4f3ce8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 0x1c], 1
push 0
push 0
push esi
push 0x41f4d0
push 0
mov dword [ebp - 4], 0
push 0
mov byte [ebp - 4], 1
call fcn.00474d3d
mov edi, eax
add esp, 0x18
xor ebx, ebx
test edi, edi
setne bl
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x41f5c5
movzx esi, si
or esi, 0x80070000
test ebx, ebx
jne 0x41f622
push ebx
push str.ATLASSERT
lea edx, [ebx + 0x29]
mov ecx, str.SecC::__CObjThreadHelper::CreateThread
call fcn.0041df40
add esp, 8
push esi
call fcn.0040abe0
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x41f5f2
mov eax, dword [ecx]
push 1
call dword [eax]
movzx eax, word [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, 0x41f603
ret
push 0x4f3ce8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x423f20
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push 0
mov edi, ecx
call fcn.00426530
push 0
push dword [edi + 0xfc]
call dword [sym.imp.USER32.dll_EnableWindow]
push ecx
push dword [edi + 0xfc]
lea ecx, [edi + 0x188]
call fcn.0042f950
mov eax, dword [ebp + 8]
lea ecx, [edi + 0x188]
inc eax
push eax
call fcn.00442fa0
push 5
push dword [edi + 0x18c]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ecx
pop ebp
ret 4
Function at 0x426b50
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push 0
mov edi, ecx
call fcn.00426530
push ecx
push dword [edi + 0xfc]
lea ecx, [edi + 0x188]
mov byte [edi + 0x104], 0
call fcn.0042f950
mov eax, dword [ebp + 8]
lea ecx, [edi + 0x188]
inc eax
push eax
call fcn.00442fa0
push 5
push dword [edi + 0x18c]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ecx
pop ebp
ret 4
Function at 0x4301b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4af818
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x4e96d0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esi + 0x28], connect
mov dword [esi + 0x2c], str.SoftwareASMainWindowSize
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
push 0x20019
push str.SoftwareASMainWindowSize
push connect
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0
call fcn.0040b490
mov edi, dword [ebp - 0x2c]
test eax, eax
jne 0x4302f1
lea eax, [ebp - 0x20]
push eax
call fcn.00431bc0
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], 4
push ecx
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x1c]
push ecx
push 0
push dword [eax]
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, 0xd
test eax, eax
jne 0x43025f
cmp dword [ebp - 0x1c], 4
cmovne eax, ecx
test eax, eax
mov edx, dword [ebp - 0x20]
sete byte [ebp - 0xd]
add edx, 0xfffffff0
or ebx, 0xffffffff
mov eax, ebx
lea ecx, [edx + 0xc]
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x430282
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp byte [ebp - 0xd], 0
je 0x43028e
mov eax, dword [ebp - 0x14]
mov dword [esi + 0x20], eax
lea eax, [ebp - 0x18]
push eax
call fcn.00431c50
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x20], 4
push ecx
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x1c]
push ecx
push 0
push dword [eax]
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4302c7
cmp dword [ebp - 0x1c], 4
mov ecx, 0xd
cmovne eax, ecx
test eax, eax
mov edx, dword [ebp - 0x18]
sete byte [ebp - 0xd]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ebx
dec ebx
test ebx, ebx
jg 0x4302e5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp byte [ebp - 0xd], 0
je 0x4302f1
mov eax, dword [ebp - 0x14]
mov dword [esi + 0x24], eax
test edi, edi
je 0x4302fc
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x432770
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4afab0
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x4e96d0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
mov dword [ebp - 4], 0
cmp dword [edi], 0
je 0x432817
push 1
lea eax, [edi + 0xac]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push ecx
mov ecx, edi
call fcn.00433c10
lea ebx, [edi + 4]
mov ecx, ebx
call fcn.00435430
mov esi, eax
mov dword [ebp - 0x14], esi
nop
test esi, esi
je 0x4327fd
mov ebx, dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [esi], eax
je 0x4327ea
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
lea eax, [ebp - 0x14]
lea ebx, [edi + 4]
push eax
mov ecx, ebx
call fcn.00435460
mov esi, dword [ebp - 0x14]
jmp 0x4327d0
mov ecx, ebx
call fcn.004353b0
mov eax, dword [edi]
test eax, eax
je 0x432817
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4332f0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4afbd8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x4e96d0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
push 0
push 0x2001f
push 0
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4333f7
mov esi, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 8]
push eax
mov dword [ebp - 0x20], esi
call fcn.00431bc0
mov ecx, dword [ebx + 0x20]
push 4
mov dword [ebp + 0xc], ecx
lea ecx, [ebp + 0xc]
push ecx
push 4
push 0
push dword [eax]
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [ebp + 8]
or edi, 0xffffffff
add edx, 0xfffffff0
mov eax, edi
lea ecx, [edx + 0xc]
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x4333b0
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp + 8]
push eax
call fcn.00431c50
mov ecx, dword [ebx + 0x24]
push 4
mov dword [ebp + 0xc], ecx
lea ecx, [ebp + 0xc]
push ecx
push 4
push 0
push dword [eax]
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [ebp + 8]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], edi
dec edi
test edi, edi
jg 0x4333ec
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test esi, esi
je 0x4333f7
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x433410
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
test ecx, ecx
je 0x433421
lea edi, [ecx - 0xa0]
jmp 0x433423
xor edi, edi
cmp byte [ecx + 0x1c], 0
mov esi, dword [ebp + 0xc]
je 0x433459
push 0xe801
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
cmp esi, 2
jne 0x43344a
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x43345e
test esi, esi
jne 0x433459
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x43345e
cmp esi, 1
je 0x433477
mov ecx, dword [ebp + 0x10]
mov eax, ecx
shr eax, 0x10
cwde
push eax
movsx eax, cx
lea ecx, [edi + 0xa0]
push eax
call fcn.004320b0
pop edi
xor eax, eax
pop esi
pop ebp
ret 0x10
Function at 0x433c10
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4afc40
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push ebx
push esi
push edi
mov eax, dword [0x4e96d0]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 0x14], eax
lea eax, [esi + 0x64]
push eax
mov dword [esp + 0x38], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [esp + 0x38], 1
mov dword [esp + 0x48], 0
mov eax, dword [esi + 8]
mov dword [esp + 0x24], eax
mov dword [esp + 0x18], 0
test eax, eax
jle 0x433dcd
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0xffffffffffffffff
push 0
push 0
push dword [esi]
call dword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
neg eax
sbb eax, eax
neg eax
je 0x433e0f
push 0x8ca0
push dword [esi + 0x94]
call ebx
xor ecx, ecx
mov edi, eax
cmp edi, 0xffffffff
setne cl
test ecx, ecx
je 0x433dec
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esp + 0x14]
cmp eax, 0x8ca0
jae 0x433dcd
cmp edi, 0x102
je 0x433dba
push dword [esi + 0x98]
lea ecx, [esi + 4]
call fcn.00435340
mov edi, eax
test edi, edi
je 0x433dba
lea ebx, [esi + 0x7c]
push ebx
mov dword [esp + 0x30], ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [esp + 0x30], 1
lea ecx, [esp + 0x28]
mov byte [esp + 0x48], 1
push ecx
lea ecx, [esp + 0x20]
push ecx
lea ecx, [esp + 0x28]
push ecx
push dword [edi]
lea ecx, [esi + 0x34]
call fcn.00436820
test eax, eax
jne 0x433d39
push dword [esp + 0x1c]
lea ecx, [esi + 0x34]
push dword [esp + 0x24]
push dword [edi]
call fcn.00436880
cmp dword [eax + 4], 0
push ebx
je 0x433d58
mov byte [esp + 0x4c], 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov byte [esp + 0x30], 0
jmp 0x433dba
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ebx, dword [edi + 4]
lea eax, [esp + 0x10]
push eax
push ebx
mov byte [esp + 0x38], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [esp + 0x10], 0x103
jne 0x433d94
push 0x8ca0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call ebx
jmp 0x433d9a
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esp + 0x14]
cmp eax, 0x8ca0
jae 0x433dcd
push dword [edi]
lea ecx, [esi + 4]
call fcn.00435360
mov byte [esp + 0x48], 0
mov edi, dword [esp + 0x18]
inc edi
mov dword [esp + 0x18], edi
cmp edi, dword [esp + 0x24]
jl 0x433c80
push dword [esp + 0x34]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0
push str.ATLASSERT
mov edx, 0x26a
mov ecx, str.SecC::CIOCPThreadPool_class_SecC::TThreadPool2_void__void_class_SecC::CBindCallback_void_::StopAllThreads
call fcn.0041df40
add esp, 8
push 0x80004005
call fcn.0040abe0
push 0
push str.ATLASSERT
mov edx, 0x267
jmp 0x433df8
Function at 0x43d5f0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b057d
mov eax, dword fs:[0]
push eax
sub esp, 0x2a4
mov eax, dword [0x4e96d0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 0
mov dword [ebp - 0x2b0], esi
mov dword [ebp - 0x2ac], 0
call fcn.0040d990
mov ecx, eax
xor eax, eax
test ecx, ecx
setne al
test eax, eax
jne 0x43d653
push 0x80004005
call fcn.0040abe0
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
push 0x104
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
push eax
push 0
mov dword [ebp - 0x2ac], 1
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x2a4]
mov dword [ebp - 0x2a4], 0
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov edi, eax
test edi, edi
je 0x43d7e0
xor eax, eax
mov dword [ebp - 0x29c], 0
ja 0x43d7d6
cmp edi, 0xffffffff
ja 0x43d7d6
cmp edi, 0x80
jbe 0x43d6e1
push edi
lea ecx, [ebp - 0x29c]
call fcn.0041a7a0
mov eax, dword [ebp - 0x29c]
jmp 0x43d6ed
lea eax, [ebp - 0x298]
mov dword [ebp - 0x29c], eax
push eax
push edi
mov dword [ebp - 4], 1
lea eax, [ebp - 0x218]
push dword [ebp - 0x2a4]
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x43d7ad
lea eax, [ebp - 0x2a8]
mov dword [ebp - 0x2a0], 0
push eax
lea eax, [ebp - 0x2a0]
mov dword [ebp - 0x2a8], 0
push eax
push 0x4ce6c0
push dword [ebp - 0x29c]
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x43d79f
cmp dword [ebp - 0x2a8], 0
jbe 0x43d791
mov ecx, dword [ebp - 0x2a0]
cmp dword [ecx], 0xfeef04bd
jne 0x43d783
movzx eax, word [ecx + 0xc]
push eax
movzx eax, word [ecx + 0xe]
push eax
movzx eax, word [ecx + 8]
push eax
movzx eax, word [ecx + 0xa]
push eax
push str._hu._hu._hu._hu
push esi
call fcn.0041b160
add esp, 0x18
jmp 0x43d7bb
push 0x4d28dc
mov ecx, esi
call fcn.00418fb0
jmp 0x43d7bb
push 0x4d28f0
mov ecx, esi
call fcn.00418fb0
jmp 0x43d7bb
push 0x4d2904
mov ecx, esi
call fcn.00418fb0
jmp 0x43d7bb
push 8
push 0x4d2918
mov ecx, esi
call fcn.00419800
lea eax, [ebp - 0x298]
cmp dword [ebp - 0x29c], eax
je 0x43d7ee
lea ecx, [ebp - 0x29c]
call fcn.00419f10
jmp 0x43d7ee
push 0x80070216
call fcn.0040abe0
push 8
push 0x4d292c
mov ecx, esi
call fcn.00419800
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004712e4
mov esp, ebp
pop ebp
ret 4
Function at 0x43e110
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
test ecx, ecx
je 0x43e122
lea ebx, [ecx - 0x20]
jmp 0x43e124
xor ebx, ebx
cmp dword [ebp + 0x14], 0
mov dword [ebp - 4], 1
je 0x43e1e4
push dword [ebp + 8]
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
mov dword [ebp - 8], eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov esi, eax
mov dword [ebp + 0x14], 0xffffffff
test esi, esi
js 0x43e230
mov edi, dword [ebp + 0xc]
mov ecx, 1
mov eax, dword [edi]
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, esi
or ecx, eax
jge 0x43e17a
push esi
mov ecx, edi
call fcn.0041a8d0
mov ecx, dword [edi]
cmp esi, dword [ecx - 8]
jg 0x43e230
mov dword [ecx - 0xc], esi
xor edx, edx
mov eax, dword [edi]
mov word [eax + esi*2], dx
test ecx, ecx
je 0x43e1d3
lea eax, [esi + 1]
push eax
push ecx
push dword [ebp - 8]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov dword [ebp + 0x14], eax
mov eax, dword [edi]
test eax, eax
jne 0x43e1af
xor ecx, ecx
jmp 0x43e1c1
push dword [eax - 8]
push eax
call fcn.004721a5
mov ecx, eax
add esp, 8
test ecx, ecx
js 0x43e230
mov eax, dword [edi]
cmp ecx, dword [eax - 8]
jg 0x43e230
mov dword [eax - 0xc], ecx
xor edx, edx
mov eax, dword [edi]
mov word [eax + ecx*2], dx
cmp dword [ebp + 0x14], esi
jge 0x43e224
mov edi, dword [ebp + 8]
mov dword [ebp - 4], 0
jmp 0x43e1ff
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
push dword [eax]
push edi
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
mov esi, eax
mov dword [ebp - 4], esi
test esi, esi
jne 0x43e224
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_MessageBeep]
add ebx, 0x20
je 0x43e211
lea eax, [ebx - 0x20]
jmp 0x43e213
xor eax, eax
push edi
push dword [eax + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
push 0x80070057
call fcn.0040abe0
int3
Function at 0x4430c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
lea esi, [ecx + 0x20]
mov ecx, dword [esi]
mov dword [esi], 0
push edi
test ecx, ecx
je 0x4430dc
mov eax, dword [ecx]
push 1
call dword [eax]
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
push 0x4d03e4
movzx eax, ax
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
jne 0x443103
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp + 0xc], eax
test eax, eax
je 0x4430f8
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4430f8
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp + 8], eax
test eax, eax
je 0x4430f8
lea eax, [ebp + 0xc]
push eax
lea edx, [ebp + 8]
lea ecx, [ebp - 4]
call fcn.00443c80
add esp, 4
cmp esi, eax
je 0x443158
mov edx, dword [eax]
mov dword [eax], 0
mov ecx, dword [esi]
mov dword [esi], edx
test ecx, ecx
je 0x443158
mov eax, dword [ecx]
push 1
call dword [eax]
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x443165
mov eax, dword [ecx]
push 1
call dword [eax]
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 0xc