joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45d953
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x3c
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov esi, dword [esp + 0x50]
mov byte [esi], 0
push 3
push dword [edi + 4]
call dword [sym.imp.USER32.DLL_GetWindow]
mov ebx, eax
test eax, eax
je 0x45d9b7
push 0xfffffffffffffff0
push ebx
call dword [sym.imp.USER32.DLL_GetWindowLongA]
mov ebp, eax
push 0x3c
lea ecx, [esp + 0x14]
push ecx
push ebx
call dword [sym.imp.USER32.DLL_GetClassNameA]
push 0x4925e2
lea ecx, [esp + 0x14]
push ecx
call fcn.00471780
add esp, 8
mov ecx, ebp
test cl, 1
jne 0x45d9ab
test cl, 2
je 0x45d9b7
push dword [esp + 0x54]
push esi
push ebx
call dword [sym.imp.USER32.DLL_GetWindowTextA]
cmp byte [esi], 0
jne 0x45d9e3
mov ecx, edi
mov edx, dword [edi]
call dword [edx + 0x1c]
dec eax
push eax
push dword [0x489ad0]
call dword [sym.imp.USER32.DLL_GetDlgItem]
mov ebx, eax
test eax, eax
je 0x45d9e3
push dword [esp + 0x54]
push esi
push ebx
call dword [sym.imp.USER32.DLL_GetWindowTextA]
push 0x4925e9
push esi
call fcn.0043dd2c
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret 8

Function at 0x45da9e
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x2c
push ebx
push esi
mov dword [esp + 8], ecx
lea ecx, [esp + 0xc]
mov dword [esp + 0x2c], ecx
xor esi, esi
push 0x20
push ecx
mov ecx, dword [esp + 0x10]
push dword [ecx + 4]
call dword [sym.imp.USER32.DLL_GetWindowTextA]
neg eax
sbb eax, esi
shr eax, 0x1f
mov ebx, eax
mov ecx, 1
cmp bx, cx
jne 0x45db5c
mov eax, dword [esp + 0x2c]
cmp byte [eax], 0x2d
jne 0x45dae9
inc dword [esp + 0x2c]
mov esi, ecx
jmp 0x45daf6
mov eax, dword [esp + 0x2c]
cmp byte [eax], 0x2b
jne 0x45daf6
inc dword [esp + 0x2c]
mov eax, dword [esp + 0x2c]
cmp byte [eax], 0x30
jne 0x45db05
cmp byte [eax + 1], 0x78
je 0x45db0b
cmp byte [eax + 1], 0x58
jne 0x45db26
add dword [esp + 0x2c], 2
lea ecx, [esp + 0x30]
push ecx
lea ecx, [esp + 0x30]
push ecx
call fcn.004339d9
mov ebx, eax
add esp, 8
jmp 0x45db3a
lea ecx, [esp + 0x30]
push ecx
lea ecx, [esp + 0x30]
push ecx
call fcn.00433632
mov ebx, eax
add esp, 8
test bx, bx
je 0x45db51
lea ecx, [esp + 0x2c]
push ecx
call fcn.004345dc
add esp, 4
test ax, ax
je 0x45db55
xor ecx, ecx
jmp 0x45db5a
mov ecx, 1
mov ebx, ecx
test bx, bx
je 0x45db78
test si, si
je 0x45db6e
mov ecx, dword [esp + 0x30]
neg ecx
jmp 0x45db72
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x38]
mov dword [edx], ecx
mov eax, ebx
pop esi
pop ebx
add esp, 0x2c
ret 4
Function at 0x463fc1
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x30
push ebx
mov dword [esp + 4], ecx
push 0x20
lea eax, [esp + 0xc]
push eax
mov ecx, dword [esp + 0xc]
push dword [ecx + 4]
call dword [sym.imp.USER32.DLL_GetWindowTextA]
mov eax, dword [esp + 4]
cmp byte [eax + 0x1c], 0x41
jne 0x463fff
push 0xffffffffffffffb0
lea eax, [esp + 0xc]
push eax
call fcn.00471720
add esp, 8
mov ebx, eax
test eax, eax
je 0x463fff
mov byte [ebx], 0x20
lea eax, [esp + 8]
mov dword [esp + 0x28], eax
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x2c]
push eax
call fcn.00433b1b
add esp, 8
test ax, ax
je 0x464030
lea eax, [esp + 0x28]
push eax
call fcn.004345dc
add esp, 4
test ax, ax
je 0x464034
xor eax, eax
jmp 0x464039
mov eax, 1
mov ebx, eax
cmp ax, 1
jne 0x46404b
fld qword [esp + 0x2c]
mov eax, dword [esp + 0x38]
fstp qword [eax]
mov eax, ebx
pop ebx
add esp, 0x30
ret 4
Function at 0x464e30
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x28
push ebx
push esi
mov ebx, ecx
test byte [ecx + 0x2c], 0x80
je 0x464eb9
push 0
push 0xfffffffffffffff8
lea eax, [ebx + 4]
push dword [eax]
mov dword [esp + 0x14], eax
call dword [sym.imp.USER32.DLL_GetWindowLongA]
push eax
call dword [sym.imp.USER32.DLL_EnableWindow]
push 1
mov eax, dword [esp + 0xc]
push dword [eax]
call dword [sym.imp.USER32.DLL_ShowWindow]
mov eax, dword [esp + 8]
mov ecx, dword [eax]
test ecx, ecx
je 0x464eeb
push ecx
call dword [sym.imp.USER32.DLL_IsWindowVisible]
test eax, eax
je 0x464eeb
mov esi, dword [esp + 8]
push 0
push 0
push 0
lea ecx, [esp + 0x20]
push ecx
call dword [sym.imp.USER32.DLL_GetMessageA]
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.USER32.DLL_TranslateMessage]
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.USER32.DLL_DispatchMessageA]
cmp dword [esi], 0
je 0x464eeb
push dword [ebx + 4]
call dword [sym.imp.USER32.DLL_IsWindowVisible]
test eax, eax
je 0x464eeb
jmp 0x464e7e
lea eax, [ebx + 4]
push dword [eax]
mov dword [esp + 0x14], eax
call dword [sym.imp.USER32.DLL_IsIconic]
cmp eax, 1
sbb eax, eax
and al, 0xfc
add eax, 9
push eax
mov eax, dword [esp + 0x14]
push dword [eax]
call dword [sym.imp.USER32.DLL_ShowWindow]
mov eax, dword [esp + 0x10]
push dword [eax]
call dword [sym.imp.USER32.DLL_SetForegroundWindow]
pop esi
pop ebx
add esp, 0x28
ret

Function at 0x464ef1
Capabilities:
Hide graphical window

Disassembly:
push eax
push ebx
mov ebx, ecx
test byte [ecx + 0x2c], 0x80
je 0x464f3a
push 1
push 0xfffffffffffffff8
lea eax, [ebx + 4]
push dword [eax]
mov dword [esp + 0x10], eax
call dword [sym.imp.USER32.DLL_GetWindowLongA]
push eax
call dword [sym.imp.USER32.DLL_EnableWindow]
push 0
mov eax, dword [esp + 8]
push dword [eax]
call dword [sym.imp.USER32.DLL_ShowWindow]
push 0xfffffffffffffff8
mov eax, dword [esp + 8]
push dword [eax]
call dword [sym.imp.USER32.DLL_GetWindowLongA]
push eax
call dword [sym.imp.USER32.DLL_SetFocus]
jmp 0x464f45
push 0
push dword [ebx + 4]
call dword [sym.imp.USER32.DLL_ShowWindow]
test byte [ebx + 0x2c], 0x10
je 0x464f57
test ebx, ebx
je 0x464f57
push 1
mov ecx, ebx
mov eax, dword [ebx]
call dword [eax]
pop ebx
add esp, 4
ret
Function at 0x467518
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x438
push ebx
push esi
push edi
mov dword [esp + 0x10], ecx
mov ebx, dword [esp + 0x448]
push 0
push 0
push 0x31
mov eax, dword [esp + 0x1c]
add eax, 4
push dword [eax]
mov dword [esp + 0x1c], eax
call dword [sym.imp.USER32.DLL_SendMessageA]
mov dword [esp + 0x14], eax
push eax
push ebx
call dword [sym.imp.GDI32.DLL_SelectObject]
mov dword [esp + 0x18], eax
push 0x400
lea eax, [esp + 0x20]
push eax
mov ecx, dword [esp + 0x14]
push dword [ecx]
call dword [sym.imp.USER32.DLL_GetWindowTextA]
mov dword [esp + 0x41c], eax
mov esi, 0x493314
lea edi, [esp + 0x420]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0x400
lea ecx, [esp + 0x424]
push ecx
push eax
lea eax, [esp + 0x28]
push eax
push ebx
call dword [sym.imp.USER32.DLL_DrawTextA]
push dword [0x491a00]
push ebx
call dword [sym.imp.GDI32.DLL_SetBkColor]
mov eax, dword [esp + 0x10]
mov eax, dword [eax + 0x2c]
cmp eax, 0xffffffff
jne 0x4675bd
push 8
call dword [sym.imp.USER32.DLL_GetSysColor]
push eax
push ebx
call dword [sym.imp.GDI32.DLL_SetTextColor]
push 1
push ebx
call dword [sym.imp.GDI32.DLL_SetBkMode]
lea eax, [esp + 0x430]
push eax
mov ecx, dword [esp + 0x10]
push dword [ecx]
call dword [sym.imp.USER32.DLL_GetClientRect]
push dword [0x49a840]
lea eax, [esp + 0x434]
push eax
push ebx
call dword [sym.imp.USER32.DLL_FillRect]
mov dword [esp + 0x440], 0x104
push 0xa
lea eax, [esp + 0x20]
push eax
call fcn.00471720
add esp, 8
test eax, eax
jne 0x467620
mov dword [esp + 0x440], 0x124
mov eax, dword [esp + 0x10]
push dword [eax + 4]
call dword [sym.imp.USER32.DLL_IsWindowEnabled]
test ax, ax
je 0x46765f
mov eax, dword [esp + 0x10]
movzx eax, word [eax + 0x28]
or eax, dword [esp + 0x440]
push eax
lea eax, [esp + 0x434]
push eax
push dword [esp + 0x424]
lea eax, [esp + 0x28]
push eax
push ebx
call dword [sym.imp.USER32.DLL_DrawTextA]
jmp 0x46769d
mov eax, dword [esp + 0x10]
movzx eax, word [eax + 0x28]
or eax, dword [esp + 0x440]
push eax
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x444]
push dword [esp + 0x444]
push dword [esp + 0x444]
push dword [esp + 0x444]
push dword [esp + 0x2c]
push ebx
call fcn.0045cdf6
add esp, 0x20
push 7
call dword [sym.imp.GDI32.DLL_GetStockObject]
push eax
push ebx
call dword [sym.imp.GDI32.DLL_SelectObject]
push dword [esp + 0x18]
push ebx
call dword [sym.imp.GDI32.DLL_SelectObject]
pop edi
pop esi
pop ebx
add esp, 0x438
ret 4
Function at 0x472efc
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x493ce8
push 0x4726f0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push eax
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
call fcn.0047d590
call fcn.0047b98c
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
mov dword [0x49b424], eax
call fcn.0047d5c4
call fcn.0047d734
call dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
mov dword [0x495cb0], eax
call fcn.0047ae70
call fcn.0047d76c
call fcn.0047d184
call fcn.0047c460
push 0xa
push dword [0x495cb0]
push 0
push dword [0x49b424]
call fcn.00413d44
push eax
call fcn.00477870
mov dword [ebp - 4], 0xffffffff
add esp, 4
jmp 0x472fb1
mov eax, dword [ebp - 0x10]
mov dword fs:[0], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4752c0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47531c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push eax
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x18]
call fcn.00478840
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x18]
mov dword [eax], 0x4944bc
xor ecx, ecx
mov dword [eax + 0x28], ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x34], ecx
mov ecx, dword [eax + 0xc]
mov dword [eax + 0x38], ecx
mov word [eax + 0x30], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x4766c4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push dword [esp + 8]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x4766dd
call fcn.0047e780
jmp 0x4766f9
test byte [esp + 0xc], 2
je 0x4766f7
test bl, 1
je 0x4766f7
push 0xd
call fcn.0047dc58
mov ebx, 0xffffffff
jmp 0x4766f9
xor ebx, ebx
mov eax, ebx
pop ebx
ret
Function at 0x477d30
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 8]
cmp ebx, 0x3c
jae 0x477d7a
mov ecx, dword [ebp + 0x10]
or ecx, ecx
je 0x477d76
test byte [ebx + 0x4946bc], 0x10
jne 0x477d8b
mov edx, dword [ebp + 0xc]
push ecx
push edx
push 0
lea eax, [ebp - 8]
push eax
push ecx
push edx
push dword [ebx*4 + 0x4946f8]
call sub.KERNEL32.DLL_ReadFile
pop edx
pop ecx
or eax, eax
je 0x477d7a
mov eax, dword [ebp - 8]
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
jmp 0x477d71
push 9
call fcn.0047dc58
mov eax, 0xffffffff
jmp 0x477d71
push esi
push edi
mov edi, dword [ebp + 0xc]
and byte [ebx + 0x4946bc], 0xfe
cld
push ds
pop es
mov edx, edi
push ecx
push edx
push 0
lea eax, [ebp - 8]
push eax
push ecx
push edx
push dword [ebx*4 + 0x4946f8]
call sub.KERNEL32.DLL_ReadFile
pop edx
pop ecx
or eax, eax
je 0x477e69
mov eax, dword [ebp - 8]
add edx, eax
cmp eax, ecx
je 0x477dce
or byte [ebx + 0x4946bc], 1
mov ecx, eax
or ecx, ecx
je 0x477f10
push edi
mov al, 0x1a
repne scasb al, byte es:[edi]
je 0x477e38
pop edi
mov ecx, edx
sub ecx, edi
mov al, 0xd
xor esi, esi
repne scasb al, byte es:[edi]
jne 0x477f10
cmp edi, edx
jae 0x477e7d
cmp byte [edi], 0xa
jne 0x477de6
mov esi, edi
mov dword [ebp - 4], edi
dec dword [ebp - 4]
mov ecx, edx
sub ecx, edi
mov al, 0xd
repne scasb al, byte es:[edi]
jne 0x477eda
cmp edi, edx
jae 0x477e7d
cmp byte [edi], 0xa
jne 0x477e09
mov ecx, edi
dec ecx
sub ecx, esi
mov eax, edi
mov edi, dword [ebp - 4]
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 4], edi
mov edi, eax
inc esi
jmp 0x477e03
dec edi
test byte [ebx + 0x4946bc], 8
jne 0x477e5b
sub edx, edi
push 1
push 0
push edx
push dword [ebx*4 + 0x4946f8]
call sub.KERNEL32.DLL_SetFilePointer
cmp ax, 0xffff
je 0x477e69
or byte [ebx + 0x4946bc], 1
mov edx, edi
jmp 0x477ddd
push 9
call fcn.0047dc58
mov eax, 0xffffffff
jmp 0x477f15
test byte [ebx + 0x4946bc], 1
jne 0x477eda
dec edx
mov ecx, 1
push ecx
push edx
push 0
lea eax, [ebp - 8]
push eax
push ecx
push edx
push dword [ebx*4 + 0x4946f8]
call sub.KERNEL32.DLL_ReadFile
pop edx
pop ecx
or eax, eax
je 0x477e69
mov eax, dword [ebp - 8]
or eax, eax
je 0x477ed3
cmp byte [edi - 1], 0xa
je 0x477eda
mov byte [edi - 1], 0xd
push 1
push 0
push 0xffffffffffffffff
push dword [ebx*4 + 0x4946f8]
call sub.KERNEL32.DLL_SetFilePointer
cmp ax, 0xffff
je 0x477e69
jmp 0x477eda
or byte [ebx + 0x4946bc], 1
cmp esi, 0
je 0x477f10
mov ecx, edi
sub ecx, esi
mov edi, dword [ebp - 4]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
test byte [ebx + 0x4946bc], 8
jne 0x477f10
mov ecx, esi
sub ecx, edi
je 0x477f10
test byte [ebx + 0x4946bc], 1
je 0x477d9a
mov eax, edi
sub eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x479454
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
mov esi, dword [esp + 0x10]
xor ebx, ebx
test esi, esi
je 0x4794af
push ebx
push ebx
push esi
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableA]
mov edi, eax
test eax, eax
je 0x4794af
lea ecx, [edi + 1]
push ecx
call fcn.00472fc4
add esp, 4
mov ebx, eax
test eax, eax
je 0x4794af
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableA]
test eax, eax
jne 0x47949c
push ebx
call fcn.00472694
xor ebx, ebx
add esp, 4
jmp 0x4794af
push ebx
push esi
call fcn.004724a8
add esp, 4
push eax
call fcn.00479340
add esp, 8
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x47d5dc
Capabilities:
Get common file path
Read .ini file

Disassembly:
sub esp, 0x8c
push ebx
push ebp
push esi
push edi
xor ebx, ebx
mov ecx, 0x80
xor eax, eax
lea edi, [esp + 0x10]
rep stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.DLL_GetVersion]
mov dword [esp + 0x94], eax
test byte [esp + 0x97], 0x80
je 0x47d616
cmp byte [esp + 0x94], 4
jb 0x47d620
mov esi, 0x10f
jmp 0x47d718
push 1
call fcn.00472fc4
add esp, 4
mov ebx, eax
test eax, eax
je 0x47d65c
push 0
push ebx
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
mov edi, eax
push 0x495bf8
call fcn.004716c0
add esp, 4
lea ecx, [edi + eax + 1]
push ecx
push ebx
call fcn.004768f8
add esp, 8
mov ebx, eax
test eax, eax
jne 0x47d663
xor esi, esi
jmp 0x47d725
push edi
push ebx
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
push ebx
call fcn.004716c0
add esp, 4
test eax, eax
mov dword [esp + 0x98], eax
je 0x47d6a7
mov ecx, ebx
add ecx, dword [esp + 0x98]
push ecx
push ebx
call fcn.00483a68
mov edi, eax
add esp, 8
cmp byte [edi], 0x5c
je 0x47d6a7
push 0x495c04
push ebx
call fcn.00474420
add esp, 8
push 0x495c1b
push ebx
call fcn.00474420
push ebx
push 0x80
lea ecx, [esp + 0x20]
push ecx
push 0x495c15
push 0x495c0d
push 0x495c06
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringA]
lea ecx, [esp + 0x18]
mov dword [esp + 0x98], ecx
push 0xa
lea edx, [esp + 0x9c]
push edx
push ecx
call fcn.00476d74
mov ebp, eax
inc dword [esp + 0xa4]
push 0xa
lea ecx, [esp + 0xa8]
push ecx
push dword [esp + 0xac]
call fcn.00476d74
mov esi, eax
mov ecx, ebp
shl ecx, 8
add esi, ecx
add esp, 0x20
test ebx, ebx
je 0x47d725
push ebx
call fcn.00472694
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x8c
ret
Function at 0x48467d
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x58
push ebx
push esi
push edi
mov esi, dword [esp + 0x68]
push 0x44
push 0
lea eax, [esp + 0x14]
push eax
call fcn.004714e0
mov dword [esp + 0x18], 0x44
add esp, 0xc
mov ebx, dword [esp + 0x74]
cmp ebx, 5
ja case.0x484664.12
jmp dword [ebx*4 + 0x496fe4]
xor edi, edi
jmp 0x484682
mov edi, 1
jmp 0x484682
mov edi, 8
jmp 0x484682
mov edi, 4
push esi
call fcn.004716c0
add esp, 4
push eax
push dword [esp + 0x70]
call fcn.004716c0
add esp, 4
mov ecx, eax
pop eax
lea edx, [ecx + eax + 4]
push edx
call fcn.00472fc4
add esp, 4
mov ebx, eax
test eax, eax
je 0x4847af
push 0x20
push esi
call fcn.004839f8
add esp, 8
test eax, eax
je 0x4846e1
push 0x22
push esi
call fcn.004839f8
add esp, 8
test eax, eax
jne 0x4846e1
push esi
push 0x496fdc
push ebx
call fcn.0047182c
add esp, 0xc
jmp 0x4846eb
push esi
push ebx
call fcn.0047165c
add esp, 8
push 0x496fe1
push ebx
call fcn.00474420
push dword [esp + 0x74]
push ebx
call fcn.00474420
add esp, 0x10
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
push ecx
push 0
push dword [esp + 0x7c]
push edi
push 1
push 0
push 0
push ebx
push 0
call dword [sym.imp.KERNEL32.DLL_CreateProcessA]
test eax, eax
jne 0x484741
call fcn.0047e780
push ebx
call fcn.00472694
add esp, 4
mov eax, 0xffffffff
pop edi
pop esi
pop ebx
add esp, 0x58
ret
push ebx
call fcn.00472694
push dword [esp + 0x58]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
add esp, 4
cmp dword [esp + 0x74], 0
je 0x48476f
push dword [esp + 0x50]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push 0
call fcn.00477870
add esp, 4
cmp dword [esp + 0x50], 0
jne 0x48477f
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x58
ret
push 0xffffffffffffffff
push dword [esp + 0x54]
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
lea eax, [esp + 0x60]
push eax
push dword [esp + 0x54]
call dword [sym.imp.KERNEL32.DLL_GetExitCodeProcess]
push dword [esp + 0x50]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [esp + 0x60]
pop edi
pop esi
pop ebx
add esp, 0x58
ret
push 0xc
call fcn.0047dc58
mov eax, 0xffffffff
pop edi
pop esi
pop ebx
add esp, 0x58
ret
Function at 0x103b370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0x1a
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x103b38e
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x14]
push 0x1064074
push ecx
mov edi, eax
call fcn.0104f198
mov esi, eax
add esp, 8
test esi, esi
jne 0x103b3cb
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push ebx
push 1
push edi
call fcn.0104f02e
push esi
call fcn.0104efb1
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebx
ret
Function at 0x103e850
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x218
lea eax, [esp]
push ebp
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push eax
push 0x20019
push 0
push ecx
push SysReAllocString
call edi
test eax, eax
jne 0x103e8ae
mov ecx, dword [esp + 0xc]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
lea edx, [esp + 0x10]
lea eax, [esp + 0x1c]
push edx
push eax
push 0x1069720
push ecx
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0x103e8ba
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 0x218
ret
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call esi
lea ecx, [esp + 0x1c]
push str.DefaultIcon
push ecx
call fcn.0104f1e1
add esp, 8
lea edx, [esp + 0xc]
lea eax, [esp + 0x1c]
push edx
push 0x20019
push 0
push eax
push SysReAllocString
call edi
test eax, eax
jne 0x103e8ae
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x1c]
push ecx
push edx
push 0x1069720
push eax
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0x103e92a
mov ecx, dword [esp + 0xc]
push ecx
call esi
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x218
ret
mov edx, dword [esp + 0xc]
push edx
call esi
lea eax, [esp + 0x1c]
push 0x2c
push eax
call fcn.01050082
xor esi, esi
add esp, 8
cmp eax, esi
je 0x103e957
mov word [eax], si
add eax, 2
push eax
call fcn.01050030
add esp, 4
jmp 0x103e959
xor eax, eax
lea ecx, [esp + 0x18]
push 1
lea edx, [esp + 0x18]
push ecx
push edx
push eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x24], esi
push eax
mov dword [esp + 0x2c], esi
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
test eax, eax
je 0x103e8ae
mov al, byte [esp + 0x22c]
test al, al
mov eax, dword [esp + 0x14]
jne 0x103e8b0
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
add esp, 0x218
ret

Function at 0x103eff0
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
lea edx, [ebp + 0xc]
int 0x2e
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x103f080
Capabilities:
Get common file path

Disassembly:
sub esp, 0x43c
push esi
mov esi, dword [esp + 0x444]
cmp word [esi + 2], 0x3a
je 0x103f0c4
lea eax, [esp + 0x30]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea ecx, [esp + 0x30]
push 0x1064458
push ecx
call fcn.0104f1e1
lea edx, [esp + 0x38]
push esi
push edx
call fcn.0104f1e1
add esp, 0x10
jmp 0x103f0d2
lea eax, [esp + 0x30]
push esi
push eax
call fcn.0104f20b
add esp, 8
lea ecx, [esp + 0x30]
lea edx, [esp + 0x238]
push ecx
push str.___s
push edx
call fcn.0104edff
lea eax, [esp + 0x244]
lea ecx, [esp + 0x2c]
push eax
push ecx
call fcn.0103f050
mov eax, dword [0x1069728]
xor esi, esi
add esp, 0x14
lea edx, [esp + 0x20]
cmp eax, esi
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], esi
mov dword [esp + 0x14], 0x40
mov dword [esp + 0x10], edx
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
jne 0x103f13b
push esi
call fcn.0103efb0
add esp, 4
mov dword [0x1069728], eax
mov ecx, dword [esp + 0x454]
cmp ecx, 3
jne 0x103f14c
mov ecx, 1
mov edx, dword [esp + 0x458]
push esi
push esi
push 0x20
push ecx
mov ecx, dword [esp + 0x45c]
push ecx
push edx
lea ecx, [esp + 0x40]
push esi
push ecx
mov ecx, dword [esp + 0x468]
lea edx, [esp + 0x28]
or ecx, 0x100000
push edx
lea edx, [esp + 0x28]
push ecx
push edx
push eax
call fcn.0103eff0
mov ecx, dword [esp + 0x34]
add esp, 0x30
neg eax
sbb eax, eax
pop esi
not eax
and eax, ecx
add esp, 0x43c
ret

Function at 0x1042440
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push ebx
mov ebx, dword [ecx + 0x88]
test ebx, ebx
je 0x10424b7
push esi
xor eax, eax
mov ax, word [ecx + 0x14]
xor esi, esi
mov si, word [ecx + 6]
push edi
xor edi, edi
lea eax, [eax + ecx + 0x18]
test esi, esi
jbe 0x104248e
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x1042471
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x104247e
add edx, ecx
cmp ebx, edx
jb 0x104248a
inc edi
add eax, 0x28
cmp edi, esi
jb 0x1042467
xor ecx, ecx
jmp 0x10424a2
test eax, eax
jne 0x1042492
xor ecx, ecx
jmp 0x10424a2
mov ecx, dword [eax + 0x14]
mov esi, dword [eax + 0xc]
mov eax, dword [esp + 0x10]
sub ecx, esi
add ecx, ebx
add ecx, eax
mov edx, dword [esp + 0x18]
push edx
push 0
push 0
push ecx
push ecx
call fcn.010423c0
add esp, 0x14
pop edi
pop esi
pop ebx
ret
Function at 0x10428f0
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebx
mov eax, dword [esp + 8]
push ebp
push esi
push edi
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push eax
xor bl, bl
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x1042921
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
push 0
push 0
push 0
push 2
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ebp, eax
test ebp, ebp
jne 0x1042946
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
push 0
push 0
push 0
push 4
push ebp
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
test esi, esi
jne 0x104296e
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
call esi
push edi
call esi
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [esp + 0x18]
mov dword [ecx], esi
mov dword [ecx + 4], eax
cmp word [esi], 0x5a4d
jne 0x1042993
push ecx
push esi
call fcn.010424c0
add esp, 8
mov bl, al
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
call esi
push edi
call esi
pop edi
pop esi
mov al, bl
pop ebp
pop ebx
ret