joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4151d0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
push 0xf00021
mov edx, dword [esi + 4]
mov ecx, dword [esi]
mov eax, dword [esi + 0xc]
sub eax, edx
push eax
mov eax, dword [esi + 8]
sub eax, ecx
push eax
push edx
push ecx
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.GDI32.dll_PatBlt]
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov ebx, eax
lea eax, [eax + 5]
add eax, 3
and eax, 0xfffffffc
call fcn.0040a560
mov dword [ebp - 4], esp
cmp dword [ebp - 4], 0
je 0x41529b
add ebx, 2
mov eax, dword [ebp - 4]
push ebx
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
je 0x41529b
mov bx, 0x140
mov edi, dword [ebp + 0x14]
mov eax, edi
and al, 0xf
cmp al, 0xc
je 0x41524e
mov ebx, edi
and bx, 0xf
or bx, 0x150
test edi, 0x80
je 0x415259
or bh, 8
and edi, 0x8000000
je 0x415274
mov eax, dword [0x43289c]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
movzx eax, bx
push eax
push esi
push 0xffffffffffffffff
push ecx
push edx
call dword [sym.imp.USER32.dll_DrawTextA]
test edi, edi
je 0x41529b
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x415670
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
sub esp, 4
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
push ebp
push 2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x41569b
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
jne 0x4156bf
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push ebx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
test ebp, ebp
jne 0x4156da
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
mov edi, ebp
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x20]
xor ecx, ecx
mov cl, ah
mov edx, eax
mov dword [esp + 0x10], 0
shl ecx, 8
shr edx, 0x10
mov byte [esp + 0x10], dl
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x28]
or ecx, edx
mov edx, eax
shr edx, 0x10
mov dword [ebp + 0x28], ecx
mov dword [esp + 0x10], 0
xor ecx, ecx
mov byte [esp + 0x10], dl
mov cl, ah
xor edx, edx
shl ecx, 8
mov dl, al
shl edx, 0x10
or ecx, dword [esp + 0x10]
or ecx, edx
mov eax, dword [esp + 0x24]
mov edx, eax
mov dword [ebp + 0x44], ecx
shr edx, 0x10
xor ecx, ecx
mov dword [esp + 0x10], 0
mov cl, ah
mov byte [esp + 0x10], dl
shl ecx, 8
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x2c]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x48], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x30]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x64], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x34]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x54], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
push 0
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
or ecx, edx
mov dword [ebp + 0x50], ecx
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
push 0
push ebp
lea ecx, [ebp + 0x68]
push ecx
push 4
push ebp
push edi
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
mov esi, eax
push edi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
Function at 0x419a30
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x419a72
call fcn.0041e5ac
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x419a72
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x419a69
xor eax, eax
jmp 0x419a7a
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00419a80
pop edi
pop esi
pop ebx
ret 4

Function at 0x41b61a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x421a08
call fcn.004096b4
sub esp, 0x18
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], esi
mov eax, dword [esi + 0x48]
mov edi, dword [esi + 0x44]
mov dword [ebp - 0x18], eax
call fcn.0041e5ac
cmp dword [esi + 0x40], 0
mov ebx, dword [eax + 0xc]
je 0x41b659
call fcn.0041e5ac
mov ebx, dword [eax + 0xc]
push 5
push dword [esi + 0x40]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x41b667
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x41b675
or eax, 0xffffffff
jmp 0x41b75d
mov ecx, esi
call fcn.0041b590
mov dword [ebp - 0x14], eax
call fcn.00418077
xor edi, edi
cmp dword [ebp - 0x14], edi
mov dword [ebp - 0x20], edi
je 0x41b6ac
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x41b6ac
push edi
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [ebp - 0x20], 1
push esi
mov dword [ebp - 4], edi
call fcn.0041802b
push dword [ebp - 0x14]
call fcn.00417b5d
push ebx
push eax
push dword [ebp - 0x18]
mov ecx, esi
call fcn.0041b328
cmp eax, edi
je 0x41b71f
test byte [esi + 0x24], 0x10
je 0x41b6ed
push 4
mov ecx, esi
pop ebx
call fcn.004173b1
test ah, 1
je 0x41b6e5
push 5
pop ebx
push ebx
mov ecx, esi
call fcn.00419b82
cmp dword [esi + 0x1c], edi
je 0x41b71f
push 0x97
push edi
push edi
push edi
push edi
push edi
mov ecx, esi
call fcn.00417497
jmp 0x41b71f
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x20], edi
je 0x41b733
push 1
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
cmp dword [ebp - 0x14], edi
je 0x41b74c
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [esi + 0x1c]
jne 0x41b74c
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x58]
mov ecx, esi
call fcn.0041b5ca
mov eax, dword [esi + 0x2c]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x41e125
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x41e153
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x41e171
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0041e08b
jmp 0x41e171
mov eax, dword [esi + 0x14]
test eax, eax
je 0x41e171
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0041e08b
test edi, edi
mov eax, edi
jne 0x41e15b
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x44d698
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push edi
mov edi, ecx
shr edi, 0x10
and ecx, 0xffff
cmp ebx, 1
jne 0x44d6e4
mov eax, dword [ebp + 0xc]
movzx edx, byte [eax]
add ecx, edx
cmp ecx, 0xfff1
jb 0x44d6c9
sub ecx, 0xfff1
add edi, ecx
cmp edi, 0xfff1
jb 0x44d6d9
sub edi, 0xfff1
mov eax, edi
shl eax, 0x10
pop edi
or eax, ecx
pop ebx
pop ebp
ret
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
jne 0x44d6f4
lea eax, [esi + 1]
pop esi
pop edi
pop ebx
pop ebp
ret
cmp ebx, 0x10
jae 0x44d733
test ebx, ebx
je 0x44d708
movzx eax, byte [esi]
add ecx, eax
inc esi
add edi, ecx
dec ebx
jne 0x44d6fd
cmp ecx, 0xfff1
jb 0x44d716
sub ecx, 0xfff1
mov eax, 0x80078071
mul edi
shr edx, 0xf
mov eax, edx
shl eax, 4
sub eax, edx
add eax, edi
pop esi
shl eax, 0x10
pop edi
or eax, ecx
pop ebx
pop ebp
ret
cmp ebx, 0x15b0
jb 0x44d81e
mov eax, 0x5e6ea9af
mul ebx
shr edx, 0xb
mov dword [ebp + 8], edx
jmp 0x44d758
Function at 0x4b64c8
Capabilities:
Encode data using xor

Disassembly:
ja 0x4b6546
and eax, 0x85149d37
add al, 0x27
call 0x8e76fd16
pop ebx
mov edx, 0xa4f3eb8a
in al, 0x8c
rcl dl, cl
sbb al, 0x80
outsb dx, byte [esi]
xor byte [esi + 0x53], 0xa
mov edi, dword [edi]
shr esp, cl
xchg ebx, eax
add eax, 0xc088ae14
vmulpd ymm4, ymm6, ymmword [0x17a7f7c1]
mov eax, dword [0xb31da9b8]
push 0x63
pop ebx
jae 0x4b64ca
imul esp, ebx, 0xa401ea29
stosd dword es:[edi], eax
enter 0xffffffffffff91b9, 0xffffffffffffffbc
cmpsd dword [esi], dword es:[edi]
ffreep st(2)
jnp 0x4b6585
fcmove st(0), st(4)
add al, 0xed
les ebx, [esi + 0x59ed9e1b]
add eax, 0x53fb7263
mov ebx, dword [ebp + 0x61]
outsd dx, dword [esi]
mov ecx, 0x8bd603a3
pop ecx
sub eax, 0x8f0f4e7c
cmp cl, byte [0x4533b241]
inc ecx
mov dl, 0x33
inc ebp
ja 0x4b6533
scasd eax, dword es:[edi]
or dword [eax], ecx
int3
pop ds
add dword [ebp - 0xa], esp
aad 0x97
scasb al, byte es:[edi]
das
movsd dword es:[edi], dword [esi]
sahf
and eax, 0x3a432d3a
cmp al, 0x84
cdq
or dword [esi - 0x53aaa63f], ebp
push ecx
xor al, 0x87
push 0x7d
and ecx, dword fs:[esi + edx*2 - 0x5ab0f2c7]
fist dword [edx - 1]
int 0x9d
push edx
dec ebp
popfd
inc ebx
mov dl, 0x87
mov ebp, 0xa308ef17
push ebx
add eax, dword [edi + 0xa]
stosd dword es:[edi], eax
int3
js 0x4b65fa
btr ebp, edi
pop eax
jl 0x4b65ba
jo 0x4b6572
and byte [ecx - 0x166694e1], bh
jl 0x4b656e
pop esp
push ebp
test dword [esi], esi
mov byte [ebx - 0x7b], al
pop es
clc
xor bh, byte [edi - 0x5f8fcd83]
pop eax
cmp dl, ch
inc edx
leave
mov eax, 0x3cdcdc42
test eax, 0x838f0ad
cmp al, 0xa5
ret 0xc583
js 0x4b65bc
call 0x15f43bf1
or al, 0xac
dec ebx
retf 0x982f
mov esi, 0xb038ed9c
inc esp
mov dl, 0xbc
xor dword [edi + 0x1f], ecx
ret 0x5b8f

Function at 0x4e26d8
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push edi
mov edi, ecx
shr edi, 0x10
and ecx, 0xffff
cmp ebx, 1
jne 0x4e2724
mov eax, dword [ebp + 0xc]
movzx edx, byte [eax]
add ecx, edx
cmp ecx, 0xfff1
jb 0x4e2709
sub ecx, 0xfff1
add edi, ecx
cmp edi, 0xfff1
jb 0x4e2719
sub edi, 0xfff1
mov eax, edi
shl eax, 0x10
pop edi
or eax, ecx
pop ebx
pop ebp
ret
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
jne 0x4e2734
lea eax, [esi + 1]
pop esi
pop edi
pop ebx
pop ebp
ret
cmp ebx, 0x10
jae 0x4e2773
test ebx, ebx
je 0x4e2748
movzx eax, byte [esi]
add ecx, eax
inc esi
add edi, ecx
dec ebx
jne 0x4e273d
cmp ecx, 0xfff1
jb 0x4e2756
sub ecx, 0xfff1
mov eax, 0x80078071
mul edi
shr edx, 0xf
mov eax, edx
shl eax, 4
sub eax, edx
add eax, edi
pop esi
shl eax, 0x10
pop edi
or eax, ecx
pop ebx
pop ebp
ret
cmp ebx, 0x15b0
jb 0x4e285e
mov eax, 0x5e6ea9af
mul ebx
shr edx, 0xb
mov dword [ebp + 8], edx
jmp 0x4e2798
Function at 0x4ed4f8
Capabilities:
Encode data using xor

Disassembly:
iretd
push 0xffffffffffffffbd
inc ebx
imul byte [ecx - 0xcbd6556]
clc
aaa
salc
pop edx
pushal
mov bh, 0x98
pushfd
scasd eax, dword es:[edi]
push es
mov bh, 0x5b
xchg edx, eax
mov edi, 0xfdc1d744
std
jne 0x4ed43a
add al, byte [edi + 0x43]
sbb dword [ecx*4 + 0x191785e6], esp
pop esi
mov eax, 0xd04873b0
leave
xlatb
movsd dword es:[edi], dword [esi]
outsd dx, dword [esi]
shr byte [edx + 0x6f947721], cl
or byte [ebx], cl
je 0x4ed52c
out 0x63, al
add eax, 0x12311624
daa
js 0x4ed4a7
aaa
invalid
sub ecx, ebp
inc ecx
inc esi
enter 0xffffffffffffe367, 0x77
xchg al, bl
cmc
inc ebx
xor al, 7
adc al, 0x76
mov dword [0x3435e6c7], eax
cmpsd dword [esi], dword es:[edi]
daa
push ecx
ja 0x4ed4b6
fld qword [bx - 0x4459]
jne 0x4ed49c
xchg edi, eax
movsd dword es:[edi], dword [esi]
pop esi
inc ebp
sbb eax, 0x4f16c136
pop es
push ss
and dword [edi], ebx
invalid
xor dword [edi - 0x6552a087], ebp
add dh, dh
xor byte [ebp + 0x16], ah
jno 0x4ed501
enter 0x6ff6, 0x7e
imul byte [edi + 0x7e]
add ah, byte [edx + 0x5e]
fsub st(2)
xor byte [edx + 0x1abea290], 0xa3
mov dl, 0xc5
mov dl, 0xc3
xor al, 0x1f
mov dl, 0xa2
loop 0x4ed5b4
xor edx, ebp
inc esi
cmpsb byte [esi], byte es:[edi]
or eax, 0x49151f9b
fadd qword [ebx + 0x3b]
dec ebx
ja 0x4ed538
add dword [eax + 0x11dfba22], ecx
cwde
jl 0x4ed4f0
sbb al, byte [bx]
cwde
cmc
add dword [0xa5194177], eax
push ds
add esi, dword [edi + 0x1327f94c]
dec esp
stc
daa
adc eax, dword [edx + 0x27]
sbb bh, dl
cmp eax, 0x18db2daf
out 0x5f, al
div ah
inc eax
mov ebx, 0x87055f97
xchg esi, eax
mov cl, 0x40
push es
adc dword [ebp - 0x72], ebx
inc edi
aaa
jbe 0x4ed56e
in al, 0xb
push esp
cmp al, 0xc7
test al, 0x23
rol dword [ebp - 0x3f], 0x9f
xchg dword [edi - 0x700feea8], esi
shl byte [bp + di + 0x713a], 0xda
inc edi
fdivr dword [edx + 0x51]
jp 0x4ed607
or edx, dword [esi + 0x365db536]
adc dl, bl
cli
std
mov edx, 0x93d686f5
daa
lodsb al, byte [esi]
sal ch, 0x70
push esp
inc edx
not byte fs:[edi + 0x6d8822a9]
cmpsb byte [esi], byte es:[edi]
lcall 0xe123, 0xe2d72096
or byte [ebx], dh
in eax, 0x1f
push ss
cmpsb byte [esi], byte es:[edi]
inc edi
stc
wait
push 0xffffffffffffffc7
or ebp, eax
or bl, byte [eax - 0x8989591]
mov esi, dword [edx + 0x6b964c84]
add eax, 0x2befc0d3
xor al, 0x77
invalid
hlt
Function at 0x5458b8
Capabilities:
Encode data using xor

Disassembly:
mov word [0x5fbdd9e2], fs
push 0x6fd73142
invalid
Function at 0x58e618
Capabilities:
Encode data using xor

Disassembly:
inc esp
sti
push ebx
aad 0xdf
pushfd
ja 0x58e690
or byte [edx - 0x3b5c6a78], al
xchg edi, eax
mov eax, dword [0x7de774ab]
mov al, byte [0x6a522781]
stosd dword es:[edi], eax
dec edi
outsd dx, dword [si]
jno 0x58e6a0
aaa
cwde
in eax, 0x36
xor ebx, dword [esi + ecx*4 - 0x1b]
xchg esi, eax
or al, 0x86
mov esp, 0x67d15261
and al, 0x59
retf 0x521f
push es
xchg byte [edi], al
Function at 0x65783d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x65f3b8
cmp edx, dword [eax]
je 0x65785f
add eax, 8
inc ecx
cmp eax, 0x65f448
jl 0x657850
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x65f3b8]
jne 0x65798d
mov eax, dword [0xa64d28]
cmp eax, 1
je 0x657967
test eax, eax
jne 0x657890
cmp dword [0x65f2e4], 1
je 0x657967
cmp edx, 0xfc
je 0x65798d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x6578c7
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00658220
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.006586b0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x65790a
lea eax, [ebp - 0x1a4]
push eax
call fcn.006586b0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x65c9bc
push edi
call fcn.0065a580
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00658220
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00658230
lea eax, [ebp - 0xa0]
push 0x65c99c
push eax
call fcn.00658230
push dword [esi + 0x65f3bc]
lea eax, [ebp - 0xa0]
push eax
call fcn.00658230
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0065a4f4
add esp, 0x2c
pop edi
jmp 0x65798d
lea eax, [ebp + 8]
lea esi, [esi + 0x65f3bc]
push 0
push eax
push dword [esi]
call fcn.006586b0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x401110
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x401a75
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x114
push ebx
push ebp
push esi
push edi
xor ebx, ebx
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerCLSID_
lea ecx, [esp + 0x14]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x20], ebx
call sub.MFC42.DLL_CString::CString_2
mov ebp, dword [esp + 0x138]
mov esi, 1
cmp ebp, 4
mov dword [esp + 0x12c], esi
ja case.default.0x40115f
jmp dword [ebp*4 + 0x40130c]
push str.20D04FE0_3AEA_1069_A2D8_08002B30309D
lea ecx, [esp + 0x14]
call fcn.0040171a
jmp 0x4011c4
push str.450D8FBA_AD25_11D0_98A8_0800361B1103
lea ecx, [esp + 0x14]
call fcn.0040171a
jmp 0x4011c4
push str.208D2C60_3AEA_1069_A2D7_08002B30309D
lea ecx, [esp + 0x14]
call fcn.0040171a
jmp 0x4011c4
push str.645FF040_5081_101B_9F08_00AA002F954E
lea ecx, [esp + 0x14]
call fcn.0040171a
jmp 0x4011c4
push str.871C5380_42A0_1069_A2EA_08002B30309D
lea ecx, [esp + 0x14]
call fcn.0040171a
jmp 0x4011c4
push 0x40323c
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::operator_1
mov eax, dword [esp + 0x10]
cmp dword [eax - 8], ebx
je 0x4012c9
lea ecx, [esp + 0x1c]
push ecx
push 0x20019
push ebx
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x24]
lea edx, [esp + 0x18]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x24]
push edx
mov edx, dword [esp + 0x20]
lea ecx, [esp + 0x24]
push eax
push ecx
push ebx
push 0x40323c
push edx
mov dword [esp + 0x30], 0x100
mov dword [esp + 0x38], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call sub.MFC42.DLL_AfxGetEmptyString
mov ecx, dword [eax]
lea edx, [esp + 0x24]
mov dword [esp + 0x18], ecx
push edx
lea ecx, [esp + 0x1c]
call sub.MFC42.DLL_CString::operator_1
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x18]
mov edi, dword [eax - 8]
call sub.MFC42.DLL_CString::CString
cmp edi, ebx
je 0x40127e
call sub.MFC42.DLL_AfxGetEmptyString
mov edi, dword [esp + 0x134]
mov ecx, dword [eax]
lea edx, [esp + 0x24]
mov dword [edi], ecx
push edx
mov ecx, edi
call sub.MFC42.DLL_CString::operator_1
mov dword [esp + 0x14], esi
jmp 0x4012e0
cmp ebp, 4
ja case.default.0x401283
jmp dword [ebp*4 + 0x401320]
push ebx
jmp 0x40129a
push esi
jmp 0x40129a
push 2
jmp 0x40129a
push 3
jmp 0x40129a
push 4
mov edi, dword [esp + 0x138]
push edi
call fcn.00401000
add esp, 8
mov dword [esp + 0x14], esi
jmp 0x4012e0
mov edi, dword [esp + 0x134]
push 0x40323c
mov ecx, edi
call sub.MFC42.DLL_CString::CString_2
mov dword [esp + 0x14], esi
jmp 0x4012e0
mov edi, dword [esp + 0x134]
push str.Invalid_Folder_Request
mov ecx, edi
call sub.MFC42.DLL_CString::CString_2
mov dword [esp + 0x14], esi
lea ecx, [esp + 0x10]
mov byte [esp + 0x12c], bl
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x124]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x120
ret
Function at 0x401340
Capabilities:
Get common file path
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x401a90
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerCLSID_
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0
mov dword [esp + 8], 0
call sub.MFC42.DLL_CString::CString_2
mov eax, dword [esp + 0x18]
mov byte [esp + 0x10], 1
cmp eax, 4
ja case.default.0x401384
jmp dword [eax*4 + 0x40149c]
push str.20D04FE0_3AEA_1069_A2D8_08002B30309D
lea ecx, [esp + 4]
call fcn.0040171a
jmp 0x4013e9
push str.450D8FBA_AD25_11D0_98A8_0800361B1103
lea ecx, [esp + 4]
call fcn.0040171a
jmp 0x4013e9
push str.208D2C60_3AEA_1069_A2D7_08002B30309D
lea ecx, [esp + 4]
call fcn.0040171a
jmp 0x4013e9
push str.645FF040_5081_101B_9F08_00AA002F954E
lea ecx, [esp + 4]
call fcn.0040171a
jmp 0x4013e9
push str.871C5380_42A0_1069_A2EA_08002B30309D
lea ecx, [esp + 4]
call fcn.0040171a
jmp 0x4013e9
push 0x40323c
lea ecx, [esp + 4]
call sub.MFC42.DLL_CString::operator_1
mov eax, dword [esp]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x40146d
lea ecx, [esp + 4]
push ecx
push 0x20006
push 0
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x1c]
mov eax, dword [edx - 8]
push eax
push 0
call sub.MFC42.DLL_CString::GetBuffer
push eax
mov eax, dword [esp + 0xc]
push 1
push 0
push 0x40323c
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 0xffffffffffffffff
lea ecx, [esp + 0x20]
call sub.MFC42.DLL_CString::ReleaseBuffer
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [esp + 0x18]
push edx
push 0
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov eax, dword [esp + 0x18]
push 0
push eax
push 0
push 0x8000000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
lea ecx, [esp]
mov byte [esp + 0x10], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x1c]
mov dword [esp + 0x10], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x401280
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ecx
push esi
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4012a7
xor eax, eax
pop esi
pop ecx
ret
push ebx
push edi
lea ecx, [esp + 0xc]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0
push 0
push 0
push 2
push 0
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, eax
call esi
cmp edi, 0xffffffff
jne 0x4012df
pop edi
pop ebx
xor eax, eax
pop esi
pop ecx
ret
push ebp
push 0
push 0
push 0
push 4
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
push edi
mov ebp, eax
call esi
mov eax, dword [esp + 0x18]
test eax, eax
je 0x4012fe
mov dword [eax], ebx
mov eax, ebp
pop ebp
pop edi
pop ebx
pop esi
pop ecx
ret

Function at 0x401310
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 0x308
cmp byte [0x406420], 0
push esi
mov esi, dword [esp + 0x310]
jne 0x401330
push esi
call fcn.004010b0
add esp, 4
push 0x4050c8
push 1
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x401385
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
push 0x4050d8
call fcn.00401c90
add esp, 8
test eax, eax
jne 0x401430
push str.Could_not_load_python_dll
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call section..text
add esp, 8
xor eax, eax
pop esi
add esp, 0x308
ret
lea eax, [esp + 4]
push eax
mov eax, 0x405de0
call fcn.00401280
mov esi, eax
add esp, 4
test esi, esi
je 0x4013d4
push edi
push 0xb
push 0x405104
push esi
xor edi, edi
call dword [sym.imp.MSVCR90.dll_strncmp]
add esp, 0xc
test eax, eax
jne 0x4013c8
lea ecx, [esi + 0xf]
push ecx
push 0x405110
call fcn.00401c90
add esp, 8
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
test edi, edi
pop edi
jne 0x401430
push str.PYTHON26.DLL
push 0x406420
push 0x405130
lea edx, [esp + 0x14]
push 0x304
push edx
call dword [sym.imp.MSVCR90.dll__snprintf]
lea eax, [esp + 0x1c]
push 0
push eax
call fcn.00401c90
add esp, 0x1c
test eax, eax
jne 0x401430
push str.LoadLibrary_pythondll__failed
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call section..text
lea ecx, [esp + 0x10]
push ecx
push 0
call section..text
add esp, 0x10
xor eax, eax
pop esi
add esp, 0x308
ret
mov eax, 1
pop esi
add esp, 0x308
ret