joyce8/EMBER2024-capa huggingface dataset:
Function at 0x470408
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
push ebx
push esi
push edi
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0xc]
call fcn.00470149
xor ebx, ebx
cmp eax, ebx
pop ecx
pop ecx
mov dword [ebp - 4], eax
je 0x47051f
cmp byte [ebp + 0x18], bl
je 0x47043c
xor edi, edi
inc edi
jmp 0x4704e0
push dword [ebp + 0xc]
lea eax, [ebp - 0x218]
push dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push ebx
push ebx
push 3
push ebx
push 1
push SysReAllocString
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
mov dword [ebp - 8], esi
je 0x47050e
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push ebx
push ebx
push ebx
push 2
push ebx
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
cmp eax, ebx
mov dword [ebp - 0x10], eax
je 0x470505
push ebx
push ebx
push ebx
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
cmp esi, ebx
je 0x4704fc
mov ecx, dword [ebp - 4]
push edi
push esi
call fcn.00428d5a
test eax, eax
je 0x4704f5
push dword [ebp + 0x1c]
mov ecx, dword [ebp - 4]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push edi
push esi
call fcn.00428d71
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [ebp - 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 8]
call esi
push dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
push ebx
push 0x136
call fcn.00475aa3
mov eax, edi
jmp 0x470521
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
push ebx
push 0x136
call fcn.00475aa3
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x470526
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x458
push esi
push edi
push dword [ebp + 0xc]
lea eax, [ebp - 0x458]
push dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x250]
push eax
lea eax, [ebp - 0x458]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x47059c
push dword [ebp + 0x1c]
lea eax, [ebp - 0x224]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push dword [ebp + 8]
call fcn.00470408
mov esi, eax
add esp, 0x18
test esi, esi
jne 0x4705a2
lea eax, [ebp - 0x250]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x47055f
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
pop edi
pop esi
leave
ret
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, esi
jmp 0x47059e
Function at 0x4705ad
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x668
push ebx
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
push edi
push dword [ebp + 0xc]
lea eax, [ebp - 0x460]
push dword [ebp + 8]
push eax
call esi
lea eax, [ebp - 0x258]
push eax
lea eax, [ebp - 0x460]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x470626
push 0
push 0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x22c]
push eax
push dword [ebp + 8]
call fcn.00470408
mov edi, eax
add esp, 0x18
test edi, edi
jne 0x47062d
lea eax, [ebp - 0x258]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4705e9
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
xor al, al
pop edi
pop esi
pop ebx
leave
ret
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [0x4ac3dc]
push edi
push 0xa
call fcn.00402ed9
lea eax, [ebp - 0x22c]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x668]
push eax
call esi
lea eax, [ebp - 0x668]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov al, 1
jmp 0x470628

Function at 0x470d40
Capabilities:
Copy file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x86c
push ebx
push esi
push dword [ebp + 0x10]
mov esi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
push dword [ebp + 8]
lea eax, [ebp - 0x86c]
push eax
call esi
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x86c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x470e02
push edi
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x228]
push eax
call fcn.00470149
mov edi, eax
test edi, edi
pop ecx
pop ecx
je 0x470de8
lea eax, [ebp - 0x228]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x664]
push eax
call esi
lea eax, [ebp - 0x228]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x45c]
push eax
call esi
push 1
lea eax, [ebp - 0x45c]
push eax
lea eax, [ebp - 0x664]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov ecx, dword [ebp - 4]
push edi
push 0
push 0x136
call fcn.00475aa3
lea eax, [ebp - 0x254]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x470d80
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4728e3
Capabilities:
Copy file
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x828
push ebx
push esi
push edi
xor esi, esi
push esi
push 0x487d08
call dword [sym.imp.USER32.dll_FindWindowA]
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x472924
cmp dword [0x4aeb64], esi
jne 0x472924
push esi
push 1
push 0x410
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SendMessageA]
push esi
push 0x4a08b8
call fcn.00402cab
mov edi, eax
push edi
push str._swinampa.lng
mov ebx, 0x104
lea eax, [ebp - 0x418]
push ebx
push eax
call fcn.00402fc5
push edi
call dword [sym.imp.NSCRT.dll_free]
add esp, 0x1c
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
call fcn.0040622a
cmp dword [0x4aeb64], esi
jne 0x472988
push esi
mov dword [0x4aeb64], 1
call fcn.004721dc
mov edi, eax
pop ecx
mov dword [0x4aeb68], edi
jmp 0x472991
mov edi, dword [0x4aeb68]
mov dword [ebp - 4], esi
push ebx
lea eax, [ebp - 0x620]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push esi
lea eax, [ebp - 0x620]
push 0x48a2fc
push eax
call fcn.00418a7d
add esp, 0xc
cmp eax, esi
mov dword [ebp - 8], eax
je 0x4729c8
push eax
call dword [sym.imp.USER32.dll_CharNextW]
mov dword [ebp - 8], eax
cmp word [0x49f858], si
je 0x472a95
cmp edi, esi
je 0x472a95
mov ecx, dword [0x4ac3fc]
sub esp, 0x10
mov edi, esp
lea esi, [ebp + 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.00472785
mov esi, eax
xor edi, edi
cmp esi, edi
jne 0x472a45
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpynW]
push ebx
push dword [ebp - 8]
lea eax, [ebp - 0x210]
push eax
call esi
push edi
lea eax, [ebp - 0x210]
push 0x48844c
push eax
call fcn.00418a7d
add esp, 0xc
push ebx
push str..lng
push eax
call esi
mov ecx, dword [0x4ac3fc]
lea eax, [ebp - 0x210]
push eax
call fcn.00472862
mov esi, eax
cmp esi, edi
je 0x472a95
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x472a91
push 0x49ee10
push str._swinampa.lng
lea eax, [ebp - 0x828]
push ebx
push eax
call fcn.00402fc5
add esp, 0x10
push edi
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x828]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push edi
push edi
push 0x410
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, esi
jmp 0x472a98
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
leave
ret 0x14
Function at 0x473521
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push edi
xor edi, edi
push edi
push 0x8000000
push 3
push edi
push 1
push SysReAllocString
push dword [ebp + 8]
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
mov dword [esi], edi
je 0x4735a9
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [esi], eax
je 0x4735a0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
cmp ebx, edi
je 0x4735a0
push edi
lea eax, [ebp - 8]
push eax
push dword [esi]
push ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x47358f
mov eax, dword [esi]
cmp eax, dword [ebp - 8]
je 0x4735a0
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor ebx, ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 0xc]
mov dword [eax], ebx
pop edi
mov eax, ebx
pop ebx
leave
ret

Function at 0x473940
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
push edi
push 0x28
pop esi
push esi
xor ebx, ebx
lea eax, [ebp - 0x30]
push ebx
push eax
call sub.NSCRT.dll_memset
mov edi, dword [ebp + 8]
add esp, 0xc
cmp edi, ebx
mov word [ebp - 0x22], 0x20
mov word [ebp - 0x24], 1
mov dword [ebp - 0x30], esi
jne 0x473985
lea eax, [ebp + 8]
push eax
push dword [ebp + 0x10]
lea esi, [ebp - 4]
call fcn.00473521
pop ecx
pop ecx
jmp 0x4739be
push dword [ebp + 0xc]
mov dword [ebp - 4], ebx
push dword [ebp + 0x10]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
cmp esi, ebx
je 0x4739bc
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push edi
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp + 8]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_LockResource]
jmp 0x4739be
xor eax, eax
mov esi, eax
cmp esi, ebx
je 0x4739dd
push dword [ebp + 0x14]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 4]
push esi
call fcn.00473882
add esp, 0x14
mov esi, eax
cmp dword [ebp + 8], ebx
je 0x4739ff
cmp edi, ebx
push dword [ebp + 8]
je 0x4739f1
call dword [sym.imp.KERNEL32.dll_FreeResource]
jmp 0x4739ff
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp esi, ebx
je 0x473a4b
neg dword [ebp - 0x28]
push ebx
push ebx
lea eax, [ebp - 8]
push eax
push ebx
lea eax, [ebp - 0x30]
push eax
push ebx
call dword [sym.imp.GDI32.dll_CreateDIBSection]
mov edi, eax
cmp edi, ebx
je 0x473a3b
mov eax, dword [ebp - 0x28]
cmp eax, ebx
jg 0x473a27
neg eax
imul eax, dword [ebp - 0x2c]
shl eax, 2
push eax
push esi
push dword [ebp - 8]
call sub.NSCRT.dll_memcpy
add esp, 0xc
mov ecx, dword [0x4ac3dc]
push esi
push 0xa
call fcn.00402ed9
jmp 0x473a4d
xor edi, edi
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x473a54
Capabilities:
Create process on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x860
lea eax, [ebp - 8]
push eax
push str.SoftwareOrb_NetworksOrb
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x473a79
xor eax, eax
leave
ret
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
xor esi, esi
push esi
push esi
push str.FirstTime
push dword [ebp - 8]
mov dword [ebp - 4], 4
call edi
test eax, eax
je 0x473aa5
mov dword [ebp - 0xc], esi
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x860]
push eax
push esi
push esi
push str.InstallName
push dword [ebp - 8]
mov dword [ebp - 4], 0x800
call edi
test eax, eax
je 0x473ace
mov word [ebp - 0x860], si
cmp word [ebp - 0x860], si
je 0x473b22
push 0xffffffffffffffff
push str.us_winamp
push 0xffffffffffffffff
lea eax, [ebp - 0x860]
push eax
push 1
push 0x409
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
jne 0x473b22
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x860]
push eax
push esi
push esi
push str.InstallDir
push dword [ebp - 8]
mov dword [ebp - 4], 0x800
call edi
test eax, eax
je 0x473b22
mov word [ebp - 0x860], si
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0xc], esi
je 0x473b81
cmp word [ebp - 0x860], si
je 0x473b81
push 0x10
pop ecx
xor eax, eax
mov dword [ebp - 0x60], 0x44
lea edi, [ebp - 0x5c]
rep stosd dword es:[edi], eax
push str.binorbtray.exe
lea eax, [ebp - 0x860]
push eax
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x60]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x860]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
neg eax
sbb eax, eax
neg eax
jmp 0x473b83
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x473b87
Capabilities:
Check for time delay via gettickcount
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x268
push ebx
push esi
push edi
xor eax, eax
mov ecx, 0x81
lea edi, [ebp - 0x264]
mov dword [ebp - 0x268], 0x22
rep stosd dword es:[edi], eax
push 0x10
pop ecx
lea edi, [ebp - 0x5c]
mov dword [ebp - 0x60], 0x44
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0xc]
xor ebx, ebx
cmp eax, ebx
je 0x473bc6
mov dword [eax], ebx
mov esi, 0x103
push esi
lea eax, [ebp - 0x266]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push str.___NEW
push 0x104
lea eax, [ebp - 0x268]
push eax
call fcn.0047ac6c
mov eax, dword [ebp + 0x10]
cmp byte [eax], bl
je 0x473c45
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x473c45
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [ebp - 0x268]
push eax
call edi
push ebx
push ebx
push 0xffffffffffffffff
push dword [ebp + 0x10]
sub esi, eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, esi
jge 0x473c45
push esi
lea eax, [ebp - 0x268]
push eax
call edi
lea eax, [ebp + eax*2 - 0x268]
push eax
push 0xffffffffffffffff
push dword [ebp + 0x10]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x60]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x268]
push eax
push ebx
mov dword [ebp - 0x34], 0x41
mov word [ebp - 0x30], 4
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x473d2f
cmp dword [ebp + 8], ebx
mov dword [ebp + 0x10], ebx
je 0x473d20
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 4], ebx
mov edi, 0xfa
cmp dword [ebp + 0x10], ebx
jne 0x473cca
push ebx
push 0x4b0460
push ebx
jmp 0x473cbc
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x10]
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
je 0x473cca
push ebx
push 0x4b0460
push dword [ebp + 0x10]
push ebx
call dword [sym.imp.USER32.dll_FindWindowExW]
cmp eax, ebx
mov dword [ebp + 0x10], eax
jne 0x473c9e
call esi
mov dword [ebp - 8], eax
jmp 0x473cf8
push 5
push 0xff
mov ecx, edi
sub ecx, eax
push ecx
push ebx
push ebx
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjectsEx]
test eax, eax
jne 0x473cf8
mov ecx, dword [0x4ac3ec]
call fcn.0045ceaf
test eax, eax
jne 0x473ce9
call esi
sub eax, dword [ebp - 8]
cmp eax, edi
jb 0x473cd1
cmp dword [ebp + 0x10], ebx
je 0x473d13
push dword [ebp + 0x10]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x473d20
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x14
jl 0x473c90
mov eax, dword [ebp + 0xc]
cmp eax, ebx
je 0x473d2c
mov ecx, dword [ebp + 0x10]
mov dword [eax], ecx
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x474401
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x484dc9
call fcn.00483a50
push ecx
push esi
mov esi, ecx
and dword [esi + 8], 0
push edi
lea edi, [esi + 0xc]
mov ecx, edi
mov dword [ebp - 0x10], esi
mov dword [esi], 0x494070
mov dword [esi + 4], 1
call fcn.00412820
mov dword [edi], 0x494020
and dword [ebp - 4], 0
lea edi, [esi + 0x1c]
mov ecx, edi
call fcn.00412820
mov ecx, dword [ebp - 0xc]
mov dword [edi], 0x494024
and dword [esi + 0x2c], 0
or dword [esi + 0x30], 0xffffffff
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x47440c
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x484dc9
call fcn.00483a50
push ecx
push esi
mov esi, ecx
and dword [esi + 8], 0
push edi
lea edi, [esi + 0xc]
mov ecx, edi
mov dword [ebp - 0x10], esi
mov dword [esi], 0x494070
mov dword [esi + 4], 1
call fcn.00412820
mov dword [edi], 0x494020
and dword [ebp - 4], 0
lea edi, [esi + 0x1c]
mov ecx, edi
call fcn.00412820
mov ecx, dword [ebp - 0xc]
mov dword [edi], 0x494024
and dword [esi + 0x2c], 0
or dword [esi + 0x30], 0xffffffff
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x474b29
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
push ebx
push esi
push edi
mov esi, ecx
xor ebx, ebx
xor edi, edi
cmp dword [esi + 0x14], ebx
jbe 0x474b65
test edi, edi
jne 0x474b65
mov eax, dword [esi + 0x10]
mov ecx, dword [eax + ebx*4]
push 0x80004001
push 0x28
call fcn.00402e90
mov edi, eax
dec edi
neg edi
sbb edi, edi
neg edi
inc ebx
cmp ebx, dword [esi + 0x14]
jb 0x474b40
push 0x80
lea eax, [ebp - 0x100]
push eax
push dword [esi + 8]
call dword [sym.imp.USER32.dll_GetWindowTextW]
xor ebx, ebx
cmp edi, ebx
lea eax, [ebp - 0x100]
je 0x474bc1
push 0x33
push eax
push ebx
push ebx
push 0x7d6
call fcn.00472111
add esp, 0xc
push eax
push dword [esi + 8]
call dword [sym.imp.USER32.dll_MessageBoxW]
dec eax
dec eax
je 0x474bf3
sub eax, 4
jne 0x474be2
push ebx
push 0x9c4d
push 0x111
push dword [esi + 8]
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x474be2
push 0x34
push eax
push ebx
push ebx
push 0x7db
call fcn.00472111
add esp, 0xc
push eax
push dword [esi + 8]
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 7
je 0x474bf3
push dword [esi + 8]
call dword [sym.imp.USER32.dll_DestroyWindow]
push 2
call dword [sym.imp.USER32.dll_PostQuitMessage]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x474eec
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x300
push esi
mov esi, ecx
mov ecx, dword [ebp + 8]
mov eax, 0x9c48
cmp ecx, eax
jg 0x474fda
je 0x474fc1
mov eax, ecx
dec eax
je 0x474f78
dec eax
je 0x474f72
sub eax, 0x3e7
je 0x474f59
dec eax
je 0x474f40
dec eax
jne 0x475079
mov eax, dword [ebp + 0xc]
dec eax
jne 0x475079
push dword [ebp + 0x10]
mov ecx, esi
call fcn.00474bf8
jmp 0x475079
cmp dword [ebp + 0xc], 0
jne 0x475079
push dword [ebp + 0x10]
mov ecx, esi
call fcn.00473e44
jmp 0x475079
cmp dword [ebp + 0xc], 0
jne 0x475079
push dword [ebp + 0x10]
mov ecx, esi
call fcn.00473df2
jmp 0x475079
cmp dword [ebp + 0xc], 0
jmp 0x474fec
cmp dword [ebp + 0xc], 0
jne 0x475079
mov eax, dword [esi + 0x30]
cmp eax, 0xffffffff
je 0x475079
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx + eax*4]
push 0x80004001
push 0x3c
mov ecx, eax
call fcn.00402e90
cmp eax, 1
je 0x475079
push dword [esi + 8]
call dword [sym.imp.USER32.dll_DestroyWindow]
push 1
call dword [sym.imp.USER32.dll_PostQuitMessage]
jmp 0x475079
push 0
push 0x473f02
push dword [esi + 8]
push 0x69
call fcn.00473456
add esp, 0x10
jmp 0x475079
mov eax, ecx
sub eax, 0x9c4b
je 0x47505b
dec eax
je 0x47504b
dec eax
je 0x474ffb
sub eax, 3
jne 0x475079
mov ecx, esi
call fcn.00474b29
jmp 0x475079
push 0
mov ecx, esi
call fcn.00474643
test eax, eax
je 0x475079
push 0x80
lea eax, [ebp - 0x100]
push eax
push dword [esi + 8]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0x10
lea eax, [ebp - 0x100]
push eax
push 0x100
lea eax, [ebp - 0x300]
push eax
push 0x7d8
call fcn.00472111
add esp, 0xc
push eax
push dword [esi + 8]
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x475079
push 0
push 0
push 0xf5
push 0x3e9
jmp 0x475069
push 0
push 0
push 0xf5
push 0x3ea
push dword [esi + 8]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
pop esi
leave
ret 0xc
Function at 0x47566a
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0xa8
mov eax, dword [ebp + 0x7c]
push esi
push edi
xor edi, edi
cmp eax, edi
mov esi, ecx
je 0x4756d9
cmp dword [0x49c9e0], 0xffffffff
mov dword [eax], edi
jne 0x4756c1
lea eax, [ebp - 0x34]
push eax
mov dword [ebp - 0x34], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x4756bb
cmp dword [ebp - 0x30], 5
ja 0x4756af
jne 0x4756bb
cmp dword [ebp - 0x2c], edi
jbe 0x4756bb
mov dword [0x49c9e0], 1
jmp 0x4756c1
mov dword [0x49c9e0], edi
push edi
push 0x4755b5
push edi
push 0x6d
call fcn.0047349b
add esp, 0x10
cmp eax, edi
mov dword [ebp + 0x70], eax
jne 0x4756e1
xor eax, eax
inc eax
jmp 0x4757b7
mov ecx, dword [esi + 0x40]
cmp ecx, dword [esi + 0x38]
push ebx
je 0x47572f
lea ecx, [ebp + 0x60]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov ecx, dword [esi + 0x3c]
mov eax, dword [esi + 0x44]
mov ebx, dword [esi + 0x38]
sub eax, ecx
sub eax, dword [ebp + 0x6c]
push 0x15
add eax, dword [ebp + 0x64]
push edi
cdq
sub eax, edx
sar eax, 1
add eax, ecx
push edi
push eax
mov eax, dword [ebp + 0x60]
sub eax, ebx
sub eax, dword [ebp + 0x68]
add eax, dword [esi + 0x40]
cdq
sub eax, edx
sar eax, 1
add eax, ebx
push eax
push edi
push dword [ebp + 0x70]
call dword [sym.imp.USER32.dll_SetWindowPos]
push 0x3fa
push dword [ebp + 0x70]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ebx, eax
cmp ebx, edi
je 0x4757ac
cmp dword [0x49c9e0], edi
je 0x475776
push 0xfffffffffffffff0
push ebx
call dword [sym.imp.USER32.dll_GetWindowLongW]
or eax, 8
push eax
push 0xfffffffffffffff0
push ebx
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 0xc8
push 1
push 0x40a
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x4757ac
xor eax, eax
mov ax, word [esi + 0x24]
add ax, word [esi + 0x14]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
inc eax
movzx eax, ax
shl eax, 0x10
push eax
push edi
push 0x401
push ebx
call esi
push edi
push edi
push 0x402
push ebx
call esi
push edi
push 1
push 0x404
push ebx
call esi
mov eax, dword [ebp + 0x70]
mov ecx, dword [ebp + 0x7c]
mov dword [ecx], eax
xor eax, eax
pop ebx
pop edi
pop esi
add ebp, 0x74
leave
ret 4
Function at 0x475991
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x664
and dword [ebp - 0x254], 0
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
push edi
xor eax, eax
mov ecx, 0x93
lea edi, [ebp - 0x250]
rep stosd dword es:[edi], eax
push str.GEN_.DLL
mov edi, 0x49f020
push edi
lea eax, [ebp - 0x45c]
push eax
call esi
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x45c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
je 0x475a51
push ebx
lea eax, [ebp - 0x228]
push eax
push edi
lea eax, [ebp - 0x664]
push eax
call esi
lea eax, [ebp - 0x664]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x475a33
push str.RegisterSetup
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x475a2c
push dword [0x4ac3c8]
push ebx
call eax
test eax, eax
pop ecx
pop ecx
jne 0x475a33
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x254]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4759e9
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindClose]
pop ebx
xor eax, eax
pop edi
inc eax
pop esi
leave
ret