joyce8/EMBER2024-capa huggingface dataset:
Function at 0x438ae0
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
push edi
mov edi, dword [ebx + 0xdc]
and dword [ebx + 0xdc], 0
cmp dword [esp + 0x10], 0
jne 0x438b1d
test edi, edi
mov esi, dword [ebx + 0x60]
je 0x438b10
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [ebx + 4]
mov eax, 0xff
je 0x438b12
mov eax, esi
push 5
push eax
call fcn.0043977a
mov dword [ebx + 0x60], esi
mov eax, dword [esp + 0x10]
neg eax
sbb eax, eax
and eax, 5
push eax
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [esp + 0x10], 0
je 0x438b5d
push dword [ebx + 4]
mov esi, dword [ebx + 0x60]
call dword [sym.imp.USER32.dll_BringWindowToTop]
test edi, edi
mov eax, 0xff
jne 0x438b50
mov eax, esi
push eax
push 5
call fcn.0043977a
mov dword [ebx + 0x60], esi
jmp 0x438b67
push 0xffffffffffffffff
push dword [ebx + 0x60]
call fcn.0043977a
mov dword [ebx + 0xdc], edi
pop edi
pop esi
pop ebx
ret 4

Function at 0x43b60a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 2
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
ret

Function at 0x43bf54
Capabilities:
Check if file exists
Get file attributes

Disassembly:
test eax, eax
je 0x43bf74
cmp word [eax], 0
je 0x43bf74
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x43bf74
and al, 0x10
sub al, 0x10
neg al
sbb eax, eax
inc eax
ret
xor eax, eax
ret

Function at 0x43c6f6
Capabilities:
Get graphical window text

Disassembly:
push ebp
lea ebp, [esp - 0x79c]
sub esp, 0x81c
mov eax, dword [0x516ad4]
push ebx
mov dword [ebp + 0x798], eax
push edi
lea eax, [ebp - 0x80]
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetClientRect]
and word [ebp - 0x68], 0
xor eax, eax
mov ecx, 0x1ff
lea edi, [ebp - 0x66]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x400
lea eax, [ebp - 0x68]
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0xfffffffffffffff0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
test al, 2
mov dword [ebp - 0x6c], 0x20
je 0x43c762
mov dword [ebp - 0x6c], 0x22
jmp 0x43c76d
test al, 1
je 0x43c76d
mov dword [ebp - 0x6c], 0x21
test ah, 2
je 0x43c776
or dword [ebp - 0x6c], 4
push dword [esi + 0x24]
mov ebx, dword [ebp + 0x7a4]
mov edi, dword [sym.imp.GDI32.dll_SelectObject]
push ebx
call edi
push 1
push ebx
mov dword [ebp - 0x70], eax
call dword [sym.imp.GDI32.dll_SetBkMode]
push dword [esi + 0x28]
push ebx
call dword [sym.imp.GDI32.dll_SetTextColor]
push dword [ebp - 0x6c]
lea eax, [ebp - 0x80]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x68]
push eax
push ebx
call dword [sym.imp.USER32.dll_DrawTextW]
push dword [ebp - 0x70]
push ebx
call edi
mov ecx, dword [ebp + 0x798]
pop edi
pop ebx
call fcn.004eae3c
add ebp, 0x79c
leave
ret 4
Function at 0x43d078
Capabilities:
Get graphical window text

Disassembly:
push ebp
lea ebp, [esp - 0x79c]
sub esp, 0x81c
mov eax, dword [0x516ad4]
push esi
mov esi, ecx
mov ecx, dword [esi + 0x5c]
test ecx, ecx
push edi
mov dword [ebp + 0x798], eax
lea edi, [ebp - 0x68]
jne 0x43d0b2
push 0x400
mov eax, edi
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x43d0c7
mov eax, dword [esi + 0x40]
test eax, eax
jl 0x43d0fb
cmp eax, ecx
jge 0x43d0fb
lea ecx, [esi + 0x58]
call fcn.0040f3fe
mov edi, dword [eax]
lea eax, [ebp - 0x78]
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetClientRect]
push edi
lea edi, [ebp - 0x80]
mov eax, esi
call fcn.0043d30f
mov ecx, dword [eax]
mov dword [esi + 0x44], ecx
mov eax, dword [eax + 4]
mov dword [esi + 0x48], eax
mov eax, dword [ebp - 0x70]
sub eax, dword [ebp - 0x78]
xor ecx, ecx
cmp dword [esi + 0x44], eax
setg cl
mov dword [esi + 0x3c], ecx
mov ecx, dword [ebp + 0x798]
pop edi
pop esi
call fcn.004eae3c
add ebp, 0x79c
leave
ret

Function at 0x43dad5
Capabilities:
Get graphical window text

Disassembly:
push ebx
xor ebx, ebx
cmp eax, ebx
mov dword [esi + 4], edi
jne 0x43dae1
mov eax, esi
cmp dword [esp + 0x10], ebx
mov dword [esi + 8], eax
mov eax, dword [esp + 8]
mov dword [esi + 0x10], eax
mov eax, dword [esp + 0xc]
mov dword [esi + 0xc], 7
mov dword [esi + 0x14], eax
je 0x43db0f
push 0x40
push dword [esp + 0x14]
lea eax, [esi + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push edi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x43db3f
cmp dword [esi + 0x14], ebx
jne 0x43db2d
push ebx
push ebx
push 0x7f
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [esi + 0x14], eax
lea eax, [esi + 0x18]
cmp word [eax], bx
jne 0x43db3f
push 0x40
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
xor eax, eax
inc eax
pop ebx
ret 0xc

Function at 0x43dcc2
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x118
mov eax, dword [0x516ad4]
push edi
push 0x44
mov dword [ebp + 0x74], eax
pop ecx
xor eax, eax
lea edi, [ebp - 0x9c]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0xa0]
push eax
mov dword [ebp - 0xa0], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
pop edi
je 0x43dd38
xor eax, eax
inc eax
cmp dword [ebp - 0x90], eax
jne 0x43dd1c
cmp dword [ebp - 0x9c], 4
jb 0x43dd38
cmp dword [ebp - 0x98], 0x5a
jmp 0x43dd36
cmp dword [ebp - 0x90], 2
jne 0x43dd38
cmp dword [ebp - 0x9c], 5
ja 0x43dd3a
jne 0x43dd38
cmp dword [ebp - 0x98], eax
jae 0x43dd3a
xor eax, eax
mov ecx, dword [ebp + 0x74]
call fcn.004eae3c
add ebp, 0x78
leave
ret
Function at 0x43f618
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
push edi
mov edi, eax
xor esi, esi
cmp edi, esi
je 0x43f646
cmp word [edi], si
je 0x43f646
mov ebx, dword [ebp + 8]
cmp dword [ebx + 4], esi
jne 0x43f64f
call fcn.0040408d
test eax, eax
je 0x43f646
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
or dword [ebp - 0x40], 0xffffffff
push 0x80
push 2
push 1
push edi
mov eax, 0xc0000000
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x30], 0x1000
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], esi
call fcn.00413af6
test eax, eax
je 0x43f7a7
push 3
lea eax, [ebp - 0x40]
push eax
mov ecx, 0x51a434
call fcn.004245ef
mov eax, ebx
call fcn.0049cae6
cmp eax, esi
mov dword [ebp - 0xc], eax
je 0x43f7a1
mov eax, dword [0x51a438]
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
mov dword [ebp - 0x14], esi
push eax
lea ebx, [ebp - 0x18]
lea esi, [ebp - 0xc]
call fcn.0043af45
push dword [ebp - 0x18]
or eax, 0xffffffff
lea ecx, [ebp - 4]
call fcn.004016ba
pop ecx
mov ecx, dword [ebp - 4]
push dword [ecx - 8]
lea eax, [ebp - 0x40]
push eax
call fcn.004245ef
push dword [ebp - 0x14]
lea eax, [ebp - 4]
push str._d
push eax
call fcn.00410cc3
mov ecx, dword [ebp - 4]
add esp, 0xc
push dword [ecx - 8]
lea eax, [ebp - 0x40]
push eax
call fcn.004245ef
mov ebx, dword [ebp - 8]
push ebx
or eax, 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.004016ba
mov edi, eax
pop ecx
lea eax, [ebp - 4]
call fcn.00410c80
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff4
cmp eax, dword [0x51a43c]
je 0x43f73c
push eax
call fcn.004013aa
mov esi, dword [ebp - 4]
push dword [esi - 8]
lea eax, [ebp - 0x40]
push eax
mov ecx, esi
call fcn.004245ef
push 2
lea eax, [ebp - 0x40]
push eax
mov ecx, 0x4fb9a4
call fcn.004245ef
lea eax, [esi - 0xc]
cmp eax, dword [0x51a43c]
je 0x43f76e
push eax
call fcn.004013aa
lea eax, [ebx - 0xc]
cmp eax, dword [0x51a43c]
je 0x43f77f
push eax
call fcn.004013aa
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff4
cmp eax, dword [0x51a43c]
je 0x43f793
push eax
call fcn.004013aa
xor esi, esi
cmp dword [ebp - 0xc], esi
jne 0x43f6ad
mov ebx, dword [ebp + 8]
mov dword [ebx + 0x30], esi
xor esi, esi
inc esi
lea eax, [ebp - 0x40]
call fcn.00413b4c
mov eax, esi
jmp 0x43f648
Function at 0x442b1a
Capabilities:
Hide graphical window

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
lea esi, [ebx + 0x128]
push dword [esi]
call edi
push dword [esp + 0x10]
mov eax, dword [esp + 0x10]
push ebx
call fcn.00452dcf
push 5
push dword [esi]
call edi
pop edi
pop esi
ret 8

Function at 0x446dbd
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
call fcn.004ae401
test eax, eax
je 0x446e33
lea eax, [ebp - 4]
push eax
xor esi, esi
push 0x28
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x446e2f
push edi
xor eax, eax
mov dword [ebp - 0x14], esi
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x10]
push eax
push str.SeShutdownPrivilege
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push esi
push esi
push esi
lea eax, [ebp - 0x14]
push eax
push esi
push dword [ebp - 4]
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
pop edi
je 0x446e33
xor eax, eax
jmp 0x446e41
push 0x40000
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_ExitWindowsEx]
pop esi
leave
ret

Function at 0x4472c9
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ecx
push ebp
push edi
xor edi, edi
push edi
push 0x80
push 3
push edi
push 1
push SysReAllocStringLen
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebp, eax
cmp ebp, 0xffffffff
mov dword [esp + 8], ebp
jne 0x4472f7
xor eax, eax
jmp 0x447355
push ebx
push esi
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, eax
cmp esi, 0xffffffff
je 0x447349
cmp esi, 0x40
jbe 0x447349
push edi
push esi
push edi
push 2
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ebp, eax
cmp ebp, edi
je 0x447349
push edi
push edi
push edi
push 4
push ebp
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
test edi, edi
je 0x447346
cmp word [edi], 0x5a4d
je 0x447359
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push ebp
call ebx
xor esi, esi
push dword [esp + 0x10]
call ebx
mov eax, esi
pop esi
pop ebx
pop edi
pop ebp
pop ecx
ret
add esi, 0xffffffc0
push esi
lea edx, [edi + 0x40]
call fcn.004acc2b
mov esi, eax
movzx eax, word [edi + 0x26]
pop ecx
movzx ecx, word [edi + 0x24]
shl eax, 0x10
or eax, ecx
sub esi, eax
neg esi
sbb esi, esi
push edi
inc esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push ebp
call ebx
jmp 0x44734b
Function at 0x44bb60
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x516ad4]
push esi
xor esi, esi
mov dword [ebp - 4], eax
inc esi
push 0
lea eax, [esi + 0x7dc8]
push eax
push dword [ebp + 0xc]
call fcn.0043870c
add esp, 0xc
inc esi
cmp esi, 9
jle 0x44bb75
push ebx
push edi
xor esi, esi
push 0xa
inc esi
pop ebx
mov eax, dword [0x51a438]
push ebx
mov dword [ebp - 0x11c], eax
lea eax, [ebp - 0x11c]
push 0x81c7
push eax
call fcn.00406068
add esp, 0xc
cmp ebx, dword [0x521700]
mov eax, 0x400
jne 0x44bbc9
mov eax, 0x608
mov edi, dword [ebp - 0x11c]
push edi
lea ecx, [esi + 0x7dc8]
push ecx
push eax
push esi
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_InsertMenuW]
lea eax, [edi - 0xc]
cmp eax, dword [0x51a43c]
je 0x44bbf3
push eax
call fcn.004013aa
add ebx, 0xa
inc esi
cmp ebx, 0x5a
jle 0x44bb97
cmp dword [0x521700], 0
mov esi, dword [sym.imp.USER32.dll_CheckMenuItem]
jne 0x44bc1a
push 0x208
push 0x7dc8
push dword [ebp + 0xc]
call esi
cmp dword [0x5216fc], 0
je 0x44bc2f
push 8
push 0x7dd2
push dword [ebp + 0xc]
call esi
push 0x44
pop ecx
xor eax, eax
lea edi, [ebp - 0x114]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x108], 2
pop edi
pop ebx
jne 0x44bc8e
cmp dword [ebp - 0x114], 5
ja 0x44bc72
jne 0x44bc8e
cmp dword [ebp - 0x110], 1
jb 0x44bc8e
push dword [ebp + 8]
call fcn.004914ca
neg eax
sbb eax, eax
and eax, 8
push eax
push 0x7dde
push dword [ebp + 0xc]
call esi
jmp 0x44bc9e
push 3
push 0x7dde
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_EnableMenuItem]
mov ecx, dword [ebp - 4]
pop esi
call fcn.004eae3c
leave
ret 8
Function at 0x45119b
Capabilities:
Create process on windows

Disassembly:
movzx eax, ax
sub eax, 0x8070
js 0x4511ce
cmp eax, 4
jae 0x4511ce
push 1
push 0
push 0
push dword [eax*4 + 0x517824]
mov eax, dword [esp + 0x14]
push 0x4fa5a0
push dword [eax + 4]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
call fcn.004af112
xor eax, eax
ret 4

Function at 0x454bdc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [0x52064c]
push edi
push 0xf1
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x454c61
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x454c61
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x454c61
movzx ecx, word [edi + 2]
lea eax, [edi + 8]
mov dword [ebp - 0xc], eax
movzx eax, word [edi + 6]
mov dword [ebp - 8], eax
movzx eax, word [edi + 4]
mov esi, ebx
call fcn.00478912
xor esi, esi
cmp dword [ebx + 0x48], esi
jne 0x454c6a
push dword [ebp + 8]
call fcn.0043b643
pop ecx
shl al, 5
lea ecx, [ebx + 0x85]
xor al, byte [ecx]
mov esi, ebx
and al, 0x20
xor byte [ecx], al
movzx eax, word [edi + 6]
push eax
call fcn.00454993
test eax, eax
jne 0x454c68
xor eax, eax
jmp 0x454d28
xor esi, esi
cmp byte [ebp + 0xc], 0
mov dword [ebp - 4], esi
je 0x454c8e
push dword [ebp + 0x18]
movzx eax, word [ebp + 0x10]
push dword [ebp + 0x14]
push eax
movsx eax, word [ebp + 8]
push eax
lea eax, [ebp - 4]
push eax
call fcn.00458c54
jmp 0x454cc7
test byte [ebx + 0x85], 0x20
je 0x454cb3
push 0x2040
push esi
push esi
push esi
push dword [ebp + 8]
push dword [0x52064c]
call dword [sym.imp.USER32.dll_LoadImageW]
mov dword [ebp - 4], eax
jmp 0x454cc7
push ecx
mov ecx, dword [ebp + 8]
mov eax, esp
mov dword [eax], ecx
lea eax, [ebp - 4]
mov dword [ebp + 0xc], esp
push eax
call fcn.00405f8e
cmp dword [ebp - 4], esi
je 0x454d1e
push dword [ebx + 0xa0]
push dword [ebp - 4]
push dword [ebx + 0x48]
call dword [sym.imp.COMCTL32.dll_ImageList_AddMasked]
cmp eax, 0xffffffff
je 0x454d1e
mov eax, dword [ebp - 8]
cmp eax, esi
jle 0x454d07
mov edi, dword [ebp - 0xc]
mov dword [ebp + 0xc], eax
cmp word [edi], si
je 0x454d00
push edi
lea esi, [ebx + 0x4c]
call fcn.0040d2bb
xor esi, esi
inc edi
inc edi
dec dword [ebp + 0xc]
jne 0x454cf0
push dword [ebx + 0x48]
mov esi, dword [ebx + 0x50]
call dword [sym.imp.COMCTL32.dll_ImageList_GetImageCount]
cmp eax, esi
je 0x454d1b
xor esi, esi
jmp 0x454d1e
xor esi, esi
inc esi
lea ecx, [ebp - 4]
call fcn.00405f75
mov eax, esi
pop edi
pop esi
leave
ret 0x14
Function at 0x455620
Capabilities:
Log keystrokes via polling

Disassembly:
and dword [ebx], 0
push esi
mov esi, eax
mov eax, dword [esi + 0xa8]
cmp eax, 0x12
je 0x45564b
cmp eax, 0x79
jne 0x455642
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test al, al
jns 0x45564b
cmp dword [esi + 0xa8], 0x20
jne 0x4556be
cmp dword [esp + 8], 0xf100
jne 0x4556be
call dword [sym.imp.USER32.dll_GetFocus]
cmp eax, dword [esi + 4]
jne 0x45567b
mov eax, esi
call fcn.0045acc1
push 0
push 0xffffffffffffffff
push 0x448
push dword [esi + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x4556be
mov eax, dword [esi + 0xa8]
cmp eax, 0x20
je 0x4556be
test byte [esi + 0x84], 0x40
jne 0x4556b3
mov al, byte [esi + 0x85]
test al, 2
je 0x4556a8
test al, 4
jne 0x4556a8
test al, 8
je 0x4556a8
mov al, 1
call fcn.00459615
push edi
mov edi, esi
call fcn.004595f0
pop edi
jmp 0x4556b8
cmp eax, 0x20
je 0x4556be
mov dword [ebx], 1
and byte [esi + 0x84], 0xbf
xor eax, eax
pop esi
ret 4

Function at 0x457d5c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push edi
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsWindowVisible]
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
mov ebx, eax
test ebx, ebx
je 0x457d7a
push 0
push dword [esi + 4]
call edi
push 0xffffffffffffffe6
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetClassLongW]
cmp dword [esp + 0xc], 0
je 0x457d93
or eax, 0x20000
jmp 0x457d98
and eax, 0xfffdffff
push eax
push 0xffffffffffffffe6
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetClassLongW]
test ebx, ebx
je 0x457daf
push 5
push dword [esi + 4]
call edi
pop edi
pop ebx
ret 4

Function at 0x458c90
Capabilities:
Capture webcam image

Disassembly:
push 0
push dword [esp + 8]
push 0x419
push dword [eax]
call dword [sym.imp.USER32.dll_SendMessageW]
ret 4
Function at 0x45a290
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, dword [esi + 0xdc]
and dword [esi + 0xdc], 0
cmp dword [esp + 8], 0
push edi
jne 0x45a2cb
test ebx, ebx
mov edi, dword [esi + 0x60]
je 0x45a2bd
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [esi + 4]
mov eax, 0xff
je 0x45a2bf
mov eax, edi
push 5
push eax
push esi
call fcn.0045a1d6
mov dword [esi + 0x60], edi
mov eax, dword [esp + 0xc]
neg eax
sbb eax, eax
and eax, 5
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [esp + 0xc], 0
je 0x45a30c
push dword [esi + 4]
mov edi, dword [esi + 0x60]
call dword [sym.imp.USER32.dll_BringWindowToTop]
test ebx, ebx
mov eax, 0xff
jne 0x45a2fe
mov eax, edi
push eax
push 5
push esi
call fcn.0045a1d6
mov dword [esi + 0x60], edi
jmp 0x45a317
push 0xffffffffffffffff
push dword [esi + 0x60]
push esi
call fcn.0045a1d6
pop edi
mov dword [esi + 0xdc], ebx
pop ebx
ret 4
Function at 0x45add1
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
push esi
push edi
lea esi, [ebx + 0x1c]
call fcn.004c259d
push esi
push 0x45c000
call dword [sym.imp.USER32.dll_EnumWindows]
mov ebp, dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, ebx
neg eax
sbb eax, eax
lea ecx, [ebx - 0xc0]
and eax, ecx
mov ecx, dword [eax + 0xc]
add eax, 8
dec ecx
push 0
pop esi
js 0x45ae1c
mov eax, dword [eax]
mov ecx, dword [eax + ecx*4]
cmp ecx, esi
je 0x45ae1c
push 0x13
push esi
push esi
push esi
push esi
push 0xffffffffffffffff
push ecx
call ebp
lea edi, [ebx + 0x18]
push 8
xor eax, eax
xor ecx, ecx
call fcn.00403f58
push esi
push 1
push 0x401
push dword [edi]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x13
push esi
push esi
push esi
push esi
push 0xffffffffffffffff
push dword [edi]
call ebp
mov eax, dword [esp + 0x10]
pop edi
mov dword [ebx + 0x14], 1
mov dword [eax], esi
pop esi
xor eax, eax
pop ebp
ret 4

Function at 0x45f1ed
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
test ebx, ebx
push edi
jne 0x45f213
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocStringLen
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 0x20], eax
jmp 0x45f25f
push 0x4fdcf8
push dword [ebp + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x45f24e
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
mov dword [ebp + 8], eax
je 0x45f24e
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x45f24e
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
jne 0x45f253
or eax, 0xffffffff
jmp 0x45f262
mov dword [esi + 0x24], eax
mov eax, dword [ebp + 8]
mov dword [esi + 0x2c], eax
mov dword [esi + 0x20], edi
mov eax, dword [esi + 0x20]
pop edi
pop ebp
ret 4
Function at 0x45fa4b
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, 0x4ecfd8
call fcn.004eadec
sub esp, 0x210
mov eax, dword [0x516ad4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
cmp eax, 0xffffffff
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push esi
mov esi, ecx
jne 0x45fa85
push dword [esi]
call ebx
cmp eax, 0xffffffff
jne 0x45fa85
xor eax, eax
jmp 0x45fc44
test al, 0x10
je 0x45fa91
push 6
pop eax
jmp 0x45fc44
mov eax, dword [esi]
push edi
mov edi, dword [sym.imp.MSVCRT.dll_wcsrchr]
push 0x2e
push eax
call edi
test eax, eax
pop ecx
pop ecx
mov dword [ebp - 0x21c], eax
je 0x45fc40
push 0x4fdcdc
push eax
call dword [sym.imp.MSVCRT.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
jne 0x45fb61
and dword [ebp + 8], eax
and dword [ebp - 4], eax
push dword [esi]
lea eax, [ebp + 8]
call fcn.0045e575
test eax, eax
je 0x45fb50
push 2
push 0x104
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp + 8]
push eax
xor ecx, ecx
call fcn.0045e5cc
test eax, eax
je 0x45fb50
lea eax, [ebp - 0x218]
push eax
mov eax, esi
call fcn.00403266
push dword [esi]
call ebx
cmp eax, 0xffffffff
jne 0x45fb24
or dword [ebp - 4], eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x45fb1d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
xor eax, eax
jmp 0x45fc43
test al, 0x10
je 0x45fb41
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 8]
test eax, eax
je 0x45fb39
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push 6
pop eax
jmp 0x45fc43
mov esi, dword [esi]
push 0x2e
push esi
call edi
pop ecx
pop ecx
mov dword [ebp - 0x21c], eax
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 8]
test eax, eax
je 0x45fb61
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp dword [ebp - 0x21c], 0
je 0x45fc40
push dword [ebp - 0x21c]
lea edi, [ebp + 8]
call fcn.004031b3
mov esi, dword [ebp + 8]
mov edi, dword [sym.imp.MSVCRT.dll__wcsicmp]
push 0x4f9864
push esi
call edi
test eax, eax
pop ecx
pop ecx
jne 0x45fba8
lea eax, [esi - 0xc]
cmp eax, dword [0x51a43c]
je 0x45fba4
push eax
call fcn.004013aa
push 3
jmp 0x45fb3b
push 0x4fd158
push esi
call edi
test eax, eax
pop ecx
pop ecx
je 0x45fbc4
push str..rar
push esi
call edi
test eax, eax
pop ecx
pop ecx
jne 0x45fbdc
lea eax, [esi - 0xc]
cmp eax, dword [0x51a43c]
je 0x45fbd5
push eax
call fcn.004013aa
push 4
jmp 0x45fb3b
mov edi, 0x5224b0
push esi
mov eax, edi
call fcn.004b9576
test eax, eax
je 0x45fc05
lea eax, [esi - 0xc]
cmp eax, dword [0x51a43c]
je 0x45fbfe
push eax
call fcn.004013aa
push 5
jmp 0x45fb3b
cmp dword [ebp + 0xc], 0
je 0x45fc2f
push esi
mov eax, edi
call fcn.004b9564
test eax, eax
je 0x45fc2f
lea eax, [esi - 0xc]
cmp eax, dword [0x51a43c]
je 0x45fc28
push eax
call fcn.004013aa
push 2
jmp 0x45fb3b
lea eax, [esi - 0xc]
cmp eax, dword [0x51a43c]
je 0x45fc40
push eax
call fcn.004013aa
xor eax, eax
inc eax
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop ebx
call fcn.004eae3c
leave
ret