joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41fdbd
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x44eed4
call fcn.0044061c
mov eax, 0x101c
call fcn.00441060
push ebx
push esi
push edi
lea ecx, [ebp - 0x18]
call section..text
and dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
call section..text
mov ecx, dword [ebp + 8]
mov byte [ebp - 4], 1
call fcn.0040313f
mov edi, eax
xor bl, bl
push 1
mov al, byte [edi]
pop esi
test al, al
mov byte [ebp - 0x1c], al
je 0x41fef3
cmp al, 0x25
jne 0x41feae
cmp byte [edi + esi], al
jne 0x41fe27
push 0x25
lea ecx, [ebp - 0x18]
mov bl, 1
call fcn.004012c8
inc esi
jmp 0x41feb9
push 0x45bba0
lea ecx, [ebp - 0x28]
call fcn.00401132
mov al, byte [edi + esi]
cmp al, 0x25
je 0x41fe4b
test al, al
je 0x41fe4b
push eax
lea ecx, [ebp - 0x28]
inc esi
call fcn.004012c8
jmp 0x41fe34
cmp byte [edi + esi], 0
je 0x41feca
and byte [ebp - 0x1028], 0
lea eax, [ebp - 0x1028]
push 0xfff
push eax
push dword [ebp - 0x28]
inc esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x41fe85
lea eax, [ebp - 0x1028]
lea ecx, [ebp - 0x18]
push eax
call fcn.0040125c
mov bl, 1
jmp 0x41feb9
push 0x456e9c
lea ecx, [ebp - 0x18]
mov bl, 1
call fcn.0040125c
push dword [ebp - 0x28]
lea ecx, [ebp - 0x18]
call fcn.0040125c
push 0x456e9c
lea ecx, [ebp - 0x18]
call fcn.0040125c
jmp 0x41feb9
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x18]
call fcn.004012c8
mov al, byte [edi + esi]
inc esi
test al, al
mov byte [ebp - 0x1c], al
jne 0x41fe08
jmp 0x41fee4
push 0x456e9c
lea ecx, [ebp - 0x18]
mov bl, 1
call fcn.0040125c
push dword [ebp - 0x28]
lea ecx, [ebp - 0x18]
call fcn.0040125c
test bl, bl
je 0x41fef3
push dword [ebp - 0x18]
mov ecx, dword [ebp + 8]
call fcn.00403877
push dword [ebp - 0x28]
and byte [ebp - 4], 0
call fcn.0044023b
push dword [ebp - 0x18]
or dword [ebp - 4], 0xffffffff
call fcn.0044023b
pop ecx
pop ecx
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x425461
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push ebx
push esi
lea eax, [ebp - 0x14]
push edi
xor ebx, ebx
push eax
push ebx
push ebx
lea eax, [ebp - 8]
push ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
push eax
lea eax, [ebp - 0x114]
mov dword [ebp - 8], 0xff
push eax
push ebx
push dword [ebp + 8]
call esi
mov edi, 0x103
cmp eax, edi
je 0x425521
xor eax, eax
cmp byte [0x463b00], bl
je 0x4254b0
mov eax, 0x100
lea ecx, [ebp - 0xc]
or eax, 0x20019
push ecx
push eax
lea eax, [ebp - 0x114]
push ebx
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x425525
push dword [ebp - 0xc]
call fcn.00425461
pop ecx
mov byte [ebp - 1], al
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 1], bl
je 0x425525
lea eax, [ebp - 0x114]
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x425525
lea eax, [ebp - 0x14]
mov dword [ebp - 8], 0xff
push eax
push ebx
push ebx
lea eax, [ebp - 8]
push ebx
push eax
lea eax, [ebp - 0x114]
push eax
push ebx
push dword [ebp + 8]
call esi
jmp 0x425499
mov al, 1
jmp 0x425527
xor al, al
pop edi
pop esi
pop ebx
leave
ret
Function at 0x427f2e
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, 0x44f31c
call fcn.0044061c
sub esp, 0xc
mov al, byte [ebp + 8]
push ebx
push esi
mov esi, ecx
mov byte [esi + 0x318a], al
call fcn.00427eba
lea ebx, [esi + 0x3118]
mov ecx, ebx
call fcn.004046cc
test al, al
je 0x427f90
mov ecx, ebx
call fcn.004032ff
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4280f6
mov ecx, ebx
call fcn.004032ff
mov dword [esi + 0x3170], eax
push eax
mov ecx, esi
call fcn.00427ef0
mov al, 1
jmp 0x4280f8
cmp dword [esi + 0x3174], 4
mov ecx, ebx
jne 0x428089
call fcn.0040313f
cmp byte [eax], 0
je 0x42807a
push str.last
mov ecx, ebx
call fcn.0040313f
push eax
call fcn.00441860
pop ecx
test eax, eax
pop ecx
je 0x42807a
push str.active
mov ecx, ebx
call fcn.0040313f
push eax
call fcn.00441860
pop ecx
test eax, eax
pop ecx
je 0x4280a3
push 7
push str.handle
mov ecx, ebx
call fcn.0040313f
push eax
call fcn.0044c1a0
add esp, 0xc
test eax, eax
jne 0x428016
push str.Use_directly_Windows_handle
push 0xb8
mov ecx, esi
call fcn.0040af82
jmp 0x4280f6
push 7
push str.regexp
mov ecx, ebx
call fcn.0040313f
push eax
call fcn.0044c1a0
add esp, 0xc
test eax, eax
jne 0x4280ae
push edi
lea edi, [esi + 0x3148]
mov ecx, edi
call fcn.004382eb
mov ecx, ebx
call fcn.0040313f
add eax, 7
lea ecx, [ebp - 0x18]
push eax
call fcn.0040101d
and dword [ebp - 4], 0
lea eax, [ebp - 0x18]
push eax
mov ecx, edi
call fcn.00437ee7
push dword [ebp - 0x18]
test eax, eax
setl bl
or dword [ebp - 4], 0xffffffff
call fcn.0044023b
pop ecx
pop edi
test bl, bl
je 0x4280ae
jmp 0x4280f6
mov eax, dword [esi + 0x3170]
test eax, eax
je 0x4280f6
jmp 0x427f81
call fcn.0040313f
cmp byte [eax], 0
jne 0x4280ae
lea ecx, [esi + 0x3130]
call fcn.0040313f
cmp byte [eax], 0
jne 0x4280ae
call dword [sym.imp.USER32.dll_GetForegroundWindow]
jmp 0x427f7b
cmp byte [esi + 0x3189], 0
push 0
push 0x428108
jne 0x4280c6
call dword [sym.imp.USER32.dll_EnumWindows]
jmp 0x4280d3
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EnumChildWindows]
cmp dword [esi + 0x3184], 0
je 0x4280ef
mov eax, dword [esi + 0x317c]
mov eax, dword [eax]
mov dword [esi + 0x3170], eax
jmp 0x427f89
and dword [esi + 0x3170], 0
xor al, al
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x42811d
Capabilities:
Get graphical window text

Disassembly:
mov eax, 0x44f330
call fcn.0044061c
sub esp, 0x410
mov al, byte [0x45bba0]
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push edi
mov byte [ebp - 0x41c], al
mov ecx, 0x100
xor eax, eax
lea edi, [ebp - 0x41b]
rep stosd dword es:[edi], eax
mov edi, 0x400
lea eax, [ebp - 0x41c]
push edi
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov eax, dword [esi + 0x3174]
mov dword [esi + 0x3170], ebx
dec eax
je 0x4282bf
dec eax
je 0x4282a1
dec eax
je 0x428291
dec eax
jne 0x4282ef
lea ebx, [esi + 0x3118]
push 0xa
push str.classname
mov ecx, ebx
call fcn.0040313f
push eax
call fcn.0044c1a0
add esp, 0xc
test eax, eax
jne 0x4281db
lea eax, [ebp - 0x41c]
push edi
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetClassNameA]
mov ecx, ebx
call fcn.0040313f
add eax, 0xa
push eax
lea eax, [ebp - 0x41c]
push eax
call fcn.00440b60
pop ecx
pop ecx
jmp 0x4282eb
push 0x455b64
mov ecx, ebx
call fcn.0040313f
push eax
call fcn.00441860
pop ecx
test eax, eax
pop ecx
je 0x42827a
mov ecx, ebx
call fcn.0040313f
push eax
call fcn.004401c0
pop ecx
push eax
lea eax, [ebp - 0x41c]
push eax
mov ecx, ebx
call fcn.0040313f
push eax
call fcn.004426a0
add esp, 0xc
test eax, eax
je 0x42827a
push 7
push str.regexp
mov ecx, ebx
call fcn.0040313f
push eax
call fcn.0044c1a0
add esp, 0xc
test eax, eax
jne 0x4282ef
lea eax, [ebp - 0x41c]
lea ecx, [ebp - 0x18]
push eax
call fcn.0040101d
xor ebx, ebx
lea eax, [ebp - 0x18]
push ebx
push ebx
push eax
lea ecx, [esi + 0x3148]
mov dword [ebp - 4], ebx
call fcn.00437fb1
push dword [ebp - 0x18]
or dword [ebp - 4], 0xffffffff
mov byte [ebp + 0xb], al
call fcn.0044023b
cmp byte [ebp + 0xb], bl
pop ecx
je 0x4282ef
mov ecx, esi
call fcn.00428303
cmp al, 1
jne 0x4282ef
cmp byte [esi + 0x318a], al
jne 0x4282ef
xor eax, eax
jmp 0x4282f2
lea ecx, [esi + 0x3118]
call fcn.0040313f
jmp 0x4281c7
lea ecx, [esi + 0x3118]
call fcn.0040313f
push eax
lea eax, [ebp - 0x41c]
push eax
call fcn.00441930
pop ecx
pop ecx
test eax, eax
jmp 0x428278
lea edi, [esi + 0x3118]
mov ecx, edi
call fcn.0040313f
push eax
call fcn.004401c0
pop ecx
push eax
lea eax, [ebp - 0x41c]
push eax
mov ecx, edi
call fcn.0040313f
push eax
call fcn.004426a0
add esp, 0xc
test eax, eax
je 0x42827a
push 1
pop eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8
Function at 0x428389
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x8000
call fcn.00441060
and byte [ebp - 0x8000], 0
push esi
push dword [ebp + 8]
mov esi, ecx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x4283b6
cmp byte [esi + 0x3188], 1
jne 0x428424
cmp dword [esi + 0x3178], 2
jne 0x4283d6
lea eax, [ebp - 0x8000]
push 0x7fff
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x4283ed
lea eax, [ebp - 0x8000]
push eax
push 0x7fff
push 0xd
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendMessageA]
and byte [ebp - 1], 0
test eax, eax
je 0x428424
lea ecx, [esi + 0x3130]
call fcn.0040313f
push eax
lea eax, [ebp - 0x8000]
push eax
call fcn.00441930
pop ecx
test eax, eax
pop ecx
je 0x428424
push dword [esi + 0x3170]
mov ecx, esi
call fcn.00427ef0
xor eax, eax
jmp 0x428427
push 1
pop eax
pop esi
leave
ret 8

Function at 0x4289f4
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
push ebx
push esi
mov esi, ecx
push edi
push 1
mov eax, dword [esi + 0x3198]
pop ebx
cmp eax, 2
jne 0x428a2d
lea ecx, [esi + 0x31a0]
call fcn.004031f5
push dword [ebp + 8]
mov edi, eax
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
cmp edi, eax
jmp 0x428aeb
test eax, eax
jne 0x428aba
lea eax, [ebp - 0x404]
push 0x100
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetClassNameA]
lea eax, [ebp - 0x404]
lea edi, [esi + 0x31a0]
push eax
call fcn.004401c0
pop ecx
push eax
lea eax, [ebp - 0x404]
push eax
mov ecx, edi
call fcn.0040313f
push eax
call fcn.004426a0
add esp, 0xc
test eax, eax
jne 0x428aff
inc dword [esi + 0x31b8]
push dword [esi + 0x31b8]
lea eax, [esi + 0x31b8]
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x404]
push str._s_u
push eax
call fcn.00440db3
add esp, 0x10
mov ecx, edi
call fcn.0040313f
push eax
lea eax, [ebp - 0x404]
jmp 0x428ae1
lea eax, [ebp - 0x404]
push 0x400
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea eax, [ebp - 0x404]
lea ecx, [esi + 0x31a0]
push eax
call fcn.0040313f
push eax
call fcn.00440b60
pop ecx
pop ecx
test eax, eax
jne 0x428aff
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [esi + 0x31c0], eax
mov byte [esi + 0x31bc], 1
pop edi
mov eax, ebx
pop esi
pop ebx
leave
ret 8
Function at 0x42b07c
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
and dword [ebp - 4], 0
push ebx
push esi
lea eax, [ebp - 0x10c]
push edi
mov ebx, 0x104
push eax
mov esi, ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov ecx, esi
call fcn.0042b2d7
cmp byte [esi + 0x10], 1
jne 0x42b0c3
push 0xffffffffffffffff
mov edi, 0x45f0c0
push dword [esi + 0x14]
mov ecx, edi
push 1
call fcn.004385bf
jmp 0x42b100
lea ecx, [ebp - 4]
lea eax, [esi + 0x20]
mov edi, 0x45f0c0
push ecx
push eax
mov ecx, edi
call fcn.00438a50
test al, al
jne 0x42b0ea
mov dword [0x463b0c], 1
jmp 0x42b16f
lea eax, [esi + 0xc]
push eax
lea eax, [ebp - 0x214]
push eax
lea eax, [esi + 0x20]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
mov ecx, edi
call fcn.00438a1b
push dword [ebp - 4]
lea eax, [esi + 0x20]
mov ebx, 0x4605b8
push eax
mov ecx, ebx
call fcn.0040b14b
test eax, eax
je 0x42b13e
mov ecx, edi
call fcn.00438785
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov dword [0x463b0c], 1
jmp 0x42b17c
mov ecx, esi
call fcn.0042b181
mov ecx, esi
call fcn.0042b266
cmp byte [0x45f0b9], 1
jne 0x42b15f
mov ecx, 0x45f410
call fcn.0043ad1a
push 1
mov ecx, ebx
call fcn.0040b293
mov ecx, edi
call fcn.00438785
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x42c407
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
push edi
xor ebx, ebx
push 0x44
mov edi, 0x4654d0
push ebx
push edi
call fcn.00441760
push 0x10
mov esi, 0x4654c0
push ebx
push esi
call fcn.00441760
add esp, 0x18
mov dword [0x4654d0], 0x44
push 1
pop eax
push esi
push edi
push ebx
push ebx
push 0x20
push ebx
push ebx
push ebx
push dword [esp + 0x30]
mov dword [0x4654fc], eax
mov word [0x465500], ax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
pop edi
pop esi
test eax, eax
pop ebx
je 0x42c46a
push dword [0x4654c0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
ret 4
Function at 0x42d780
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0xc]
push edi
mov edi, dword [esi]
mov dword [ebp - 4], ecx
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [ebp - 0xc]
mov dword [esi + 0x4120], eax
mov eax, dword [ebp - 8]
mov dword [esi + 0x4124], eax
lea eax, [ebp - 0xc]
push eax
push edi
call dword [sym.imp.USER32.dll_ScreenToClient]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
cmp ecx, dword [esi + 0x4128]
lea eax, [esi + 0x4128]
jne 0x42d7d3
cmp edx, dword [esi + 0x412c]
je 0x42d7ee
cmp byte [ebp + 0xc], 0
mov dword [eax], ecx
mov dword [esi + 0x412c], edx
je 0x42d7ee
push edx
push ecx
mov ecx, dword [ebp - 4]
push esi
push 0xfffffffffffffff5
call fcn.0042c27c
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push ebx
push 1
call edi
xor ebx, ebx
push 2
test ax, ax
setl bl
call edi
xor ecx, ecx
test ax, ax
setl cl
cmp ebx, dword [esi + 0x4130]
mov edi, ecx
mov dword [ebp + 8], edi
je 0x42d867
cmp byte [ebp + 0xc], 0
je 0x42d867
push dword [ebp - 8]
test ebx, ebx
push dword [ebp - 0xc]
push esi
je 0x42d837
mov ecx, dword [ebp - 4]
push 0xfffffffffffffff9
call fcn.0042c27c
jmp 0x42d867
mov ecx, dword [ebp - 4]
push 0xfffffffffffffff8
call fcn.0042c27c
cmp byte [esi + 0x4138], 0
lea edi, [esi + 0x4138]
je 0x42d861
push dword [ebp - 8]
mov ecx, dword [ebp - 4]
push dword [ebp - 0xc]
push esi
push 0xfffffffffffffff4
call fcn.0042c27c
and byte [edi], 0
mov edi, dword [ebp + 8]
cmp edi, dword [esi + 0x4134]
mov dword [esi + 0x4130], ebx
pop ebx
je 0x42d895
cmp byte [ebp + 0xc], 0
je 0x42d895
push dword [ebp - 8]
test edi, edi
push dword [ebp - 0xc]
push esi
je 0x42d88b
push 0xfffffffffffffff7
jmp 0x42d88d
push 0xfffffffffffffff6
mov ecx, dword [ebp - 4]
call fcn.0042c27c
mov dword [esi + 0x4134], edi
pop edi
pop esi
leave
ret 8
Function at 0x42e731
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
push edi
mov edi, ecx
je 0x42e74e
push dword [ebp + 0xc]
call fcn.0042bc6b
mov dword [edi + 0x1c], eax
mov eax, dword [edi + 0x1c]
cmp eax, 0xffffffff
je 0x42e8dd
mov esi, dword [edi + eax*4 + 0x848]
mov ecx, dword [esi]
cmp byte [esi + 0x2d], 0
mov dword [ebp + 0xc], ecx
je 0x42e7f7
and byte [esi + 0x2d], 0
cmp dword [esi + 0x4140], ebx
jl 0x42e79c
cmp byte [esi + 0x414c], 0
lea ebx, [esi + 0x414c]
je 0x42e79c
push dword [esi + 0x4148]
mov ecx, edi
push esi
call fcn.00432e2e
and byte [ebx], 0
lea eax, [ebp - 0x10]
push eax
push dword [esi]
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
sub eax, dword [ebp - 0x10]
sub ecx, dword [ebp - 0xc]
xor ebx, ebx
movsx eax, ax
cmp eax, ebx
movsx ecx, cx
je 0x42e831
cmp ecx, ebx
je 0x42e831
mov word [esi + 0x36], ax
mov word [esi + 0x32], ax
lea eax, [ebp - 0x10]
mov word [esi + 0x38], cx
push eax
mov word [esi + 0x34], cx
push dword [esi]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
sub eax, dword [ebp - 0x10]
mov word [esi + 0x3a], ax
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 0xc]
mov word [esi + 0x3c], ax
mov edi, dword [ebp + 8]
cmp edi, 8
jg 0x42e88e
je 0x42e863
cmp edi, ebx
je 0x42e855
cmp edi, 1
je 0x42e863
cmp edi, 2
je 0x42e839
cmp edi, 3
je 0x42e8bd
jle 0x42e8d8
cmp edi, 5
jle 0x42e863
cmp edi, 6
je 0x42e83d
jmp 0x42e8d8
or eax, 0xffffffff
jmp 0x42e8df
mov byte [esi + 0x2c], 1
cmp byte [esi + 0x2c], 0
je 0x42e8dd
push 6
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x42e8d8
push ebx
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
and byte [esi + 0x2c], 0
jmp 0x42e8d8
cmp byte [esi + 0x2c], 0
jne 0x42e8dd
push edi
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
cmp edi, 8
je 0x42e888
cmp edi, 4
je 0x42e888
push dword [ebp + 0xc]
mov ecx, 0x45f2f0
call fcn.0043a592
mov byte [esi + 0x2c], 1
jmp 0x42e8d8
mov eax, edi
sub eax, 9
je 0x42e8bd
sub eax, 0x37
je 0x42e8b2
dec eax
je 0x42e8af
dec eax
je 0x42e8ac
dec eax
jne 0x42e8d8
push ebx
call dword [sym.imp.USER32.dll_LockWindowUpdate]
jmp 0x42e8d8
push ecx
jmp 0x42e8a4
push ebx
jmp 0x42e8b4
push 1
push ecx
call dword [sym.imp.USER32.dll_EnableWindow]
jmp 0x42e8d8
cmp byte [esi + 0x2c], 0
je 0x42e8dd
push edi
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [ebp + 0xc]
mov ecx, 0x45f2f0
call fcn.0043a592
push 1
pop eax
jmp 0x42e8df
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x4326c9
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 0xc]
push ebx
xor ebx, ebx
push esi
cmp byte [eax], bl
push edi
mov dword [ebp - 4], ebx
je 0x4327d3
push ebx
push ebx
push 3
push ebx
push ebx
push connect
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x43276e
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push eax
push 2
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
lea ecx, [ebp - 0x10]
push ebx
push ecx
push dword [ebp - 0xc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 8]
push eax
push 1
push esi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
lea eax, [ebp - 4]
push eax
push 0x450270
push ebx
push ebx
push dword [ebp - 8]
call dword [sym.imp.OLEAUT32.dll_OleCreatePictureIndirect]
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 4]
cmp eax, ebx
jne 0x432775
xor eax, eax
jmp 0x432800
mov ecx, dword [eax]
lea edx, [ebp + 0xc]
push edx
push eax
call dword [ecx + 0xc]
lea eax, [ebp - 0x28]
push eax
push 0x18
push dword [ebp + 0xc]
call dword [sym.imp.GDI32.dll_GetObjectA]
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x18]
mov edx, dword [ecx]
cmp edx, ebx
jne 0x4327aa
cmp dword [eax], ebx
jne 0x4327aa
mov edx, dword [ebp - 0x24]
mov dword [ecx], edx
mov edx, dword [ebp - 0x20]
mov dword [eax], edx
jmp 0x4327b2
mov dword [ebp - 0x24], edx
mov edx, dword [eax]
mov dword [ebp - 0x20], edx
push 0x2000
push dword [eax]
push dword [ecx]
push ebx
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_CopyImage]
mov dword [ebp + 0xc], eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
jmp 0x4327d6
mov dword [ebp + 0xc], ebx
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x44]
cmp eax, ebx
je 0x4327e7
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [ebp + 0xc]
push eax
push ebx
push 0x172
mov dword [esi + 0x44], eax
push dword [ebp + 0x10]
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [ebp + 0x10]
pop edi
pop esi
pop ebx
leave
ret 0x14
Function at 0x432e2e
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi + 0x4144]
cmp eax, dword [ebp + 0xc]
je 0x432eb9
push 3
pop eax
cmp dword [esi + 0x14], eax
mov dword [ebp + 8], eax
jl 0x432eb0
lea edi, [esi + 0x50]
mov eax, dword [edi]
test eax, eax
je 0x432ea2
cmp byte [eax + 0x78], 0xb
je 0x432ea2
mov cl, byte [eax + 0x7a]
movzx edx, cl
cmp edx, dword [esi + 0x4144]
je 0x432e84
cmp byte [esi + 0x414c], 0
je 0x432ea2
cmp cl, 0xff
je 0x432ea2
cmp byte [eax + 0x78], 0xa
je 0x432ea2
push 0
push dword [eax]
call ebx
mov eax, dword [edi]
test byte [eax + 0x79], 0x40
je 0x432ea2
cmp byte [eax + 0x78], 0x1a
jne 0x432ea2
push 0
push dword [eax]
call dword [sym.imp.USER32.dll_EnableWindow]
inc dword [ebp + 8]
add edi, 4
mov eax, dword [ebp + 8]
cmp eax, dword [esi + 0x14]
jle 0x432e56
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x4144], eax
push 3
pop eax
cmp dword [esi + 0x14], eax
mov dword [ebp + 8], eax
jl 0x432f19
lea edi, [esi + 0x50]
mov eax, dword [edi]
test eax, eax
je 0x432f0b
cmp byte [eax + 0x78], 0xb
je 0x432f0b
movzx ecx, byte [eax + 0x7a]
cmp ecx, dword [esi + 0x4144]
jne 0x432f0b
test byte [eax + 0x79], 0x20
jne 0x432f0b
push 0
push dword [eax]
call ebx
mov eax, dword [edi]
push 4
push dword [eax]
call ebx
mov eax, dword [edi]
test byte [eax + 0x79], 0x40
je 0x432f0b
cmp byte [eax + 0x78], 0x1a
jne 0x432f0b
push 1
push dword [eax]
call dword [sym.imp.USER32.dll_EnableWindow]
inc dword [ebp + 8]
add edi, 4
mov eax, dword [ebp + 8]
cmp eax, dword [esi + 0x14]
jle 0x432ec7
push dword [esi + 0x413c]
add esi, 0x413c
call dword [sym.imp.USER32.dll_SetFocus]
push 0
push dword [ebp + 0xc]
push 0x1330
push dword [esi]
call dword [sym.imp.USER32.dll_SendMessageA]
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x435681
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x44f5a5
call fcn.0044061c
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
lea ecx, [esi + 0x24]
call section..text
xor ebx, ebx
lea ecx, [esi + 0x30]
mov dword [ebp - 4], ebx
call section..text
lea ecx, [esi + 0x3c]
mov byte [ebp - 4], 1
call section..text
mov edi, 0x45bba0
lea ecx, [esi + 0x24]
push edi
mov byte [ebp - 4], 2
mov dword [esi + 0x48], ebx
mov byte [esi + 0x20], bl
call fcn.00401132
fld qword [0x450080]
or eax, 0xffffffff
push edi
fstp qword [esi + 0x18]
lea ecx, [esi + 0x30]
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x10], ebx
call fcn.00401132
push edi
lea ecx, [esi + 0x3c]
call fcn.00401132
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret