joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1009408
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe8
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov dword [0x102cdb8], eax
cmp word [eax], 0x30
push edi
mov edi, dword [sym.imp.USER32.dll_LoadStringW]
jne 0x100944a
push 0x100
mov esi, 0x102cdd0
push esi
push eax
call dword [sym.imp.msvcrt.dll__wtol]
pop ecx
push eax
push dword [0x100c970]
call edi
mov dword [0x102cdb8], esi
mov eax, dword [0x102cfd0]
test eax, eax
jne 0x10095e1
mov ebx, dword [ebp + 8]
push 0x69
push ebx
call fcn.010093b3
test eax, eax
je 0x10095f1
mov esi, dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [ebp - 0x1c]
push eax
push ebx
call esi
push 0x40
lea eax, [ebp - 0xe8]
push eax
push 0x72
push dword [0x100c970]
call edi
call dword [sym.imp.USER32.dll_GetDesktopWindow]
lea ecx, [ebp - 0x2c]
push ecx
push eax
call esi
mov esi, dword [ebp - 0x14]
lea eax, [esi + 0xd2]
cmp eax, dword [ebp - 0x24]
jle 0x10094ae
mov esi, dword [ebp - 0x1c]
add esi, 0xffffff2e
push 0xffffffffffffffec
push ebx
call dword [sym.imp.USER32.dll_GetWindowLongW]
push 0
push dword [0x100c970]
mov ecx, 0xd2
push 0
push ebx
mov ebx, dword [sym.imp.USER32.dll_CreateWindowExW]
push ecx
push ecx
push dword [ebp - 0x18]
lea ecx, [ebp - 0xe8]
push esi
push 0x10c80200
push ecx
and eax, 0x400000
push 0x10016d0
push eax
call ebx
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x20
mov edi, eax
call esi
push 0x21
mov dword [ebp - 0xc], eax
call esi
test edi, edi
mov dword [ebp - 4], eax
je 0x10095ec
lea eax, [ebp - 0x1c]
push eax
push edi
mov dword [0x102cfd0], edi
call dword [sym.imp.USER32.dll_GetClientRect]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetDC]
push dword [0x102cfe4]
mov esi, dword [sym.imp.GDI32.dll_SelectObject]
push eax
mov dword [ebp + 0xc], eax
call esi
mov dword [ebp - 8], eax
lea eax, [ebp - 0x68]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.GDI32.dll_GetTextMetricsW]
push dword [ebp - 8]
push dword [ebp + 0xc]
call esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_ReleaseDC]
mov eax, dword [ebp - 0x68]
mov ecx, dword [ebp - 0x10]
mov esi, dword [ebp - 0x14]
push 0
push dword [0x100c970]
sub ecx, eax
sub ecx, dword [ebp - 4]
push 0x12d
push edi
push ecx
mov ecx, dword [ebp - 0xc]
lea edx, [ecx + ecx]
sub esi, edx
mov edx, dword [ebp - 4]
push esi
add eax, edx
push eax
push ecx
push 0x50300001
push 0x1001424
push 0x1001734
push 0x200
call ebx
push 0x10089bd
push 0xfffffffffffffffc
push eax
mov dword [0x102cfd4], eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 0
push 0
push 0x184
push dword [0x102cfd4]
mov dword [0x102d004], eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 1
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0x102cfd4]
call dword [sym.imp.USER32.dll_SetFocus]
jmp 0x10095ec
push 0
push 0
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
mov eax, dword [0x102cfd0]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x100ab2d
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x70
push 0x10018c0
call fcn.0100ad24
xor ebx, ebx
push ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x100ab6a
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100ab6a
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x100ab82
cmp eax, 0x20b
je 0x100ab6f
mov dword [ebp - 0x1c], ebx
jmp 0x100ab96
cmp dword [ecx + 0x84], 0xe
jbe 0x100ab6a
xor eax, eax
cmp dword [ecx + 0xf8], ebx
jmp 0x100ab90
cmp dword [ecx + 0x74], 0xe
jbe 0x100ab6a
xor eax, eax
cmp dword [ecx + 0xe8], ebx
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], ebx
push 2
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x102d038], 0xffffffff
or dword [0x102d03c], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x102d01c]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x102d018]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x102d040], eax
call fcn.0100ad1e
cmp dword [0x100c0c8], ebx
jne 0x100abf1
push fcn.0100ad1e
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.0100ad0c
push 0x1001348
push 0x1001344
call sub.msvcrt.dll__initterm
mov eax, dword [0x102d014]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
push dword [0x102d010]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.msvcrt.dll___getmainargs]
mov dword [ebp - 0x30], eax
push 0x1001340
push 0x100133c
call sub.msvcrt.dll__initterm
add esp, 0x24
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x34], esi
cmp byte [esi], 0x22
jne 0x100ac87
inc esi
mov dword [ebp - 0x34], esi
mov al, byte [esi]
cmp al, bl
je 0x100ac5b
cmp al, 0x22
jne 0x100ac4d
cmp byte [esi], 0x22
jne 0x100ac64
inc esi
mov dword [ebp - 0x34], esi
mov al, byte [esi]
cmp al, bl
je 0x100ac6e
cmp al, 0x20
jbe 0x100ac60
mov dword [ebp - 0x4c], ebx
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x4c], 1
je 0x100ac92
movzx eax, word [ebp - 0x48]
jmp 0x100ac95
cmp byte [esi], 0x20
jbe 0x100ac64
inc esi
mov dword [ebp - 0x34], esi
jmp 0x100ac87
push 0xa
pop eax
push eax
push esi
push ebx
push ebx
call edi
push eax
call main
mov esi, eax
mov dword [ebp - 0x7c], esi
cmp dword [ebp - 0x1c], ebx
jne 0x100acb2
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
jmp 0x100ace7
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.0100ad5d
ret
Function at 0x100ae13
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
lea eax, [ebp - 4]
push esi
xor esi, esi
push eax
push 0x20019
push esi
push 0x1001920
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100ae6b
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x104
push eax
push dword [ebp + 8]
push esi
push esi
push 0x100195c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x100ae5e
push 1
pop esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x100ae6d
xor eax, eax
pop esi
leave
ret 4
Function at 0x40bae6
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
movzx eax, byte [ebp + 0x24]
test eax, eax
je 0x40bbdc
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 8]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x24], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x40bb7a
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x40bb5f
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x40bb5d
push 0x7b6b
push 0
push 1
call fcn.0042299f
add esp, 0xc
jmp 0x40bb78
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x40bb78
push 0x5b5
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
jmp 0x40bbda
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x40bbb0
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test eax, eax
je 0x40bbae
push 0
call fcn.0040e771
pop ecx
jmp 0x40bbda
mov byte [ebp - 2], 0
movzx eax, byte [ebp - 2]
test eax, eax
je 0x40bbda
push 0x6348
push 0x55b4
push 0x2a4d
push 0x50f2
push 0
call fcn.0041d781
add esp, 0x14
jmp 0x40bc18
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x44], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x48], eax
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
push dword [ebp - 0x44]
push 0x617d
mov eax, dword [ebp - 0x48]
movzx eax, byte [eax]
push eax
push 0x3ebe
push 1
call fcn.004098b0
add esp, 0x1c
mov esp, ebp
pop ebp
ret
Function at 0x411eb8
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
movzx eax, byte [ebp + 0x28]
test eax, eax
je 0x412027
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x28], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x411fa6
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x411f5f
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
push 1
mov ecx, dword [ebp - 0x38]
call fcn.0042bd87
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
jmp 0x411fa4
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x58]
mov ecx, dword [ecx]
cmp dword [eax], ecx
jg 0x411f98
mov dword [ebp - 0x10], 1
jmp 0x411f9c
and dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x10]
mov dword [eax], ecx
jmp 0x412025
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x6c]
movzx eax, byte [eax]
test eax, eax
je 0x411fda
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x411fd8
push 0
push 0
call dword [sym.imp.USER32.dll_EnumWindows]
jmp 0x412025
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0x78]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x80], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x412008
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 2
jge 0x412025
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x80]
call fcn.0042bd87
mov dword [eax], 1
jmp 0x411ffd
jmp 0x412035
push 0
push 0x5b04
call fcn.00416d75
pop ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x4187f0
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x418849
lea eax, [ebp + 0x18]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 8], eax
push 0x16b2
push 0x362d
push 0x46cb
push 0x4e01
push 0xd30
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
push eax
push dword [ebp - 8]
push 0
push 0x57a4
push 0x7ec1
push 1
call fcn.004262b4
add esp, 0x2c
jmp 0x4188fa
lea eax, [ebp + 0x28]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x38], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x4188c8
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x41889d
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
jmp 0x4188c6
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov esi, dword [eax]
push 3
mov ecx, dword [ebp - 0x34]
call fcn.0042bd87
mov dword [eax], esi
jmp 0x4188fa
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
push dword [ebp - 0x40]
push 0x2327
push dword [ebp - 0x44]
push 0x611a
push 0
push 0
push 0x60f3
push 0x616e
call fcn.0040e90d
add esp, 0x20
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x423461
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
movzx eax, byte [ebp + 0x30]
test eax, eax
je 0x42357e
lea eax, [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x38]
mov dword [ebp - 0x24], eax
lea eax, [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x34]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x423500
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x4234e5
mov byte [ebp - 1], 0
push 1
push 1
push 0x6305
push 1
push 0x2478
lea eax, [ebp - 1]
push eax
push 0x45e3
push 0x1836
push 1
call fcn.0041ef8e
add esp, 0x24
jmp 0x4234fe
mov byte [ebp - 2], 0
movzx eax, byte [ebp - 2]
test eax, eax
je 0x4234fe
push 0x5b5
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
jmp 0x42357c
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x423553
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
push 1
mov ecx, dword [ebp - 0x3c]
call fcn.0042bd87
mov ecx, dword [ebp - 0x40]
mov eax, dword [eax]
mov dword [ecx], eax
jmp 0x42357c
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
mov eax, dword [eax]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x58]
mov ecx, dword [ecx]
mov eax, dword [eax + 0x20]
mov dword [ecx], eax
jmp 0x4235c5
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x6c], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x64], eax
push dword [ebp - 0x5c]
push dword [ebp - 0x60]
push 0x238b
push 1
push dword [ebp - 0x64]
push 0x50f0
mov eax, dword [ebp - 0x68]
movzx eax, byte [eax]
push eax
push dword [ebp - 0x6c]
push 1
call fcn.00411e8e
add esp, 0x24
mov esp, ebp
pop ebp
ret
Function at 0x430f7d
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, byte [ebp + 8]
test eax, eax
je 0x431030
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 4], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x430fe4
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x430fc9
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
jmp 0x430fe2
push 0xcfd
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetLayout]
jmp 0x43102e
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x431018
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
push 1
mov ecx, dword [ebp - 0x24]
call fcn.0042bd87
mov dword [eax], 0x689351f2
jmp 0x43102e
push 0
push 0
push 0x2456
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x431048
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x28], eax
push 0x4d13
push 1
push dword [ebp - 0x28]
call fcn.0043081e
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x438aad
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
movzx eax, byte [ebp + 8]
test eax, eax
je 0x438b8c
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0x28]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x438b0b
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
push 1
push dword [ebp - 0x14]
push 0x4b73
push 0x6d7c
push 0x5624
call fcn.00438bdf
add esp, 0x14
jmp 0x438b8a
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x438b42
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x438b40
push 0x5b5
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
jmp 0x438b8a
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x438b70
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 4
jge 0x438b8a
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x38]
call fcn.0042bd87
and dword [eax], 0
jmp 0x438b65
jmp 0x438bdb
lea eax, [ebp + 0x18]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x3c]
movzx eax, byte [eax]
test eax, eax
je 0x438bbc
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
push 1
push dword [ebp - 0x44]
call fcn.004327f2
pop ecx
pop ecx
jmp 0x438bdb
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
push 0
push dword [ebp - 0x4c]
push 0x1a77
push 0
push 0x1c4
call fcn.00432f78
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x43dd10
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 8]
test eax, eax
je 0x43dddf
lea eax, [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x43ddb7
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x43dda8
mov dword [ebp - 0x20], 0x24f01c08
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x43dd8c
push 1
push 1
push 0x65fd
push 1
push 0x623
push 1
push 0x5803
push 0x1ae1
push 0
push 0x3026
call fcn.004432e1
add esp, 0x28
mov byte [ebp - 2], 0
movzx eax, byte [ebp - 2]
test eax, eax
je 0x43dda6
push 0
push 1
push 1
call fcn.00437179
add esp, 0xc
jmp 0x43ddb5
push 0x5b5
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
jmp 0x43dddd
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
push dword [ebp - 0x18]
push 0
push 0
push 0x6cfe
push 1
push 0x317d
push 0x3e6d
call fcn.004342b2
add esp, 0x1c
jmp 0x43de20
lea eax, [ebp + 0x18]
mov dword [ebp - 0x1c], eax
push 1
push 1
push 0x2a2
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
push eax
push 0x350c
push 0x4cc9
push 0x5cac
push 0x3184
push 0x64e9
push 0x3af
push 0x3816
call fcn.00437adb
add esp, 0x2c
mov esp, ebp
pop ebp
ret
Function at 0x440e4a
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
movzx eax, byte [ebp + 0x24]
test eax, eax
je 0x440e94
lea eax, [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
push 0
push dword [ebp - 8]
push 0x1b43
push dword [ebp - 0xc]
push dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
push eax
call fcn.00451fc7
add esp, 0x18
jmp 0x440f80
lea eax, [ebp + 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x50], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x34]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x440f5d
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x440f38
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x440f1c
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 1
jge 0x440f36
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x40]
call fcn.0042bd87
or dword [eax], 0xffffffff
jmp 0x440f11
jmp 0x440f5b
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
movzx eax, byte [eax]
test eax, eax
je 0x440f5b
push 0x5b5
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
jmp 0x440f80
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x58], eax
push dword [ebp - 0x58]
push 0
push dword [ebp - 0x5c]
push 1
push 0x8a7
call fcn.004344ff
add esp, 0x14
mov esp, ebp
pop ebp
ret