joyce8/EMBER2024-capa huggingface dataset:
Function at 0x454bce
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0x48]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + 0x44]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x24]
cmp dword [ecx + 0x40], 0
je 0x454c21
call fcn.004b4ba2
mov dword [ebp - 0x10], eax
push 5
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + 0x40]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x454c34
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 1
cmp dword [ebp - 0xc], 0
je 0x454cc8
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0xc]
xor edx, edx
mov dx, word [ecx + 2]
cmp edx, 0xffff
jne 0x454c7f
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0xc]
mov ax, word [edx + 0x12]
mov word [ebp - 0x18], ax
mov ecx, dword [ebp - 0xc]
mov dx, word [ecx + 0x14]
mov word [ebp - 0x1c], dx
jmp 0x454c95
mov eax, dword [ebp - 0xc]
mov cx, word [eax + 0xa]
mov word [ebp - 0x18], cx
mov edx, dword [ebp - 0xc]
mov ax, word [edx + 0xc]
mov word [ebp - 0x1c], ax
mov ecx, dword [ebp - 0x20]
and ecx, 0x1801
test ecx, ecx
jne 0x454cbb
movsx edx, word [ebp - 0x18]
test edx, edx
jne 0x454cbb
movsx eax, word [ebp - 0x1c]
test eax, eax
jne 0x454cbb
mov dword [ebp - 0x28], 1
jmp 0x454cc2
mov dword [ebp - 0x28], 0
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x24]
cmp dword [edx + 0x40], 0
jne 0x454cda
mov eax, dword [ebp - 0x24]
cmp dword [eax + 0x44], 0
je 0x454ce3
mov ecx, dword [ebp - 4]
push ecx
call fcn.004028f0
mov edx, dword [ebp - 0x24]
cmp dword [edx + 0x40], 0
je 0x454cf6
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x454e8f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
cmp dword [ebp + 8], 0
jne 0x454eb2
push 0x339
push str.dlgcore.cpp
call fcn.004aba00
test eax, eax
je 0x454eb2
int3
xor eax, eax
test eax, eax
jne 0x454e98
call fcn.004b4ba2
mov dword [ebp - 8], eax
push 5
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x454f1e
mov eax, dword [ebp + 8]
shr eax, 0x10
and eax, 0xffff
and eax, 0xffff
test eax, eax
je 0x454f00
mov ecx, dword [ebp + 8]
push ecx
push str.ERROR:_Cannot_find_dialog_template_named__s._n
call fcn.0042ca55
add esp, 8
jmp 0x454f17
mov edx, dword [ebp + 8]
and edx, 0xffff
push edx
push str.ERROR:_Cannot_find_dialog_template_with_IDD_0x_04X._n
call fcn.0042ca55
add esp, 8
xor eax, eax
jmp 0x455048
cmp dword [ebp + 0xc], 0
jne 0x454f2e
mov eax, 1
jmp 0x455048
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x454f61
push str.Warning:_LoadResource_failed_for_dialog_template._n
push 0x531f54
call fcn.0042ca55
add esp, 8
mov eax, 1
jmp 0x455048
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
xor ecx, ecx
mov cx, word [eax + 2]
cmp ecx, 0xffff
jne 0x454f8a
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0x14], eax
jmp 0x454f92
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0xc]
push eax
call fcn.004028f0
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov edx, dword [ebp - 0x14]
and edx, 0x10000000
test edx, edx
je 0x454ff4
mov eax, dword [ebp + 8]
shr eax, 0x10
and eax, 0xffff
and eax, 0xffff
test eax, eax
je 0x454fd9
mov ecx, dword [ebp + 8]
push ecx
push str.ERROR:_Dialog_named__s_must_be_invisible._n
call fcn.0042ca55
add esp, 8
jmp 0x454ff0
mov edx, dword [ebp + 8]
and edx, 0xffff
push edx
push str.ERROR:_Dialog_with_IDD_0x_04X_must_be_invisible._n
call fcn.0042ca55
add esp, 8
xor eax, eax
jmp 0x455048
mov eax, dword [ebp - 0x14]
and eax, 0x40000000
test eax, eax
jne 0x455043
mov ecx, dword [ebp + 8]
shr ecx, 0x10
and ecx, 0xffff
and ecx, 0xffff
test ecx, ecx
je 0x455029
mov edx, dword [ebp + 8]
push edx
push str.ERROR:_Dialog_named__s_must_have_the_child_style._n
call fcn.0042ca55
add esp, 8
jmp 0x45503f
mov eax, dword [ebp + 8]
and eax, 0xffff
push eax
push str.ERROR:_Dialog_with_IDD_0x_04X_must_have_the_child_style._n
call fcn.0042ca55
add esp, 8
xor eax, eax
jmp 0x455048
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4582e1
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x1c]
push ecx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x458312
push 0x432
push str.wincore.cpp
call fcn.004aba00
test eax, eax
je 0x458312
int3
xor edx, edx
test edx, edx
jne 0x4582ed
mov eax, dword [ebp - 8]
cmp dword [eax + 0x38], 0
jne 0x45835e
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
add eax, 1
push eax
mov ecx, dword [ebp - 4]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00455dc7
push eax
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x1c]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0xffffffffffffffff
mov ecx, dword [ebp + 8]
call fcn.00455d53
jmp 0x458376
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
mov ecx, dword [edx + 0x38]
mov eax, dword [ebp - 8]
mov edx, dword [eax + 0x38]
mov eax, dword [edx]
call dword [eax + 0x90]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x45bbd0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
cmp dword [ebp + 8], 0
je 0x45bc5c
call fcn.004b4ba2
mov dword [ebp - 0x10], eax
push 0xf0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x45bc5c
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x45bc2f
xor eax, eax
jmp 0x45bc8d
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x45bc56
push 0xcba
push str.wincore.cpp
call fcn.004aba00
test eax, eax
je 0x45bc56
int3
xor edx, edx
test edx, edx
jne 0x45bc3c
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0x18]
call fcn.0045bc96
mov dword [ebp - 0xc], eax
cmp dword [ebp - 4], 0
je 0x45bc8a
cmp dword [ebp - 8], 0
je 0x45bc8a
mov ecx, dword [ebp - 8]
push ecx
call fcn.004028f0
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4623a7
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
push 0xed
push str.filecore.cpp
mov eax, dword [ebp - 8]
push eax
call fcn.0045e120
mov ecx, dword [ebp - 8]
cmp dword [ecx + 4], 0xffffffff
jne 0x4623e3
push 0xee
push str.filecore.cpp
call fcn.004aba00
test eax, eax
je 0x4623e3
int3
xor edx, edx
test edx, edx
jne 0x4623c6
cmp dword [ebp + 0xc], 0
jne 0x4623f4
jmp 0x462495
cmp dword [ebp + 8], 0
jne 0x46240e
push 0xf3
push str.filecore.cpp
call fcn.004aba00
test eax, eax
je 0x46240e
int3
xor eax, eax
test eax, eax
jne 0x4623f4
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0042cc96
test eax, eax
jne 0x46243b
push 0xf4
push str.filecore.cpp
call fcn.004aba00
test eax, eax
je 0x46243b
int3
xor eax, eax
test eax, eax
jne 0x462414
push 0
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x462478
mov ecx, dword [ebp - 8]
add ecx, 0xc
call fcn.004a7faa
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00460400
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0xc]
je 0x462495
mov ecx, dword [ebp - 8]
add ecx, 0xc
call fcn.004a7faa
push eax
push 0xffffffffffffffff
push 0xd
call fcn.004605e0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x462bdc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
lea eax, [ebp - 8]
push eax
push str.CLSID
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x462cb2
mov dword [ebp - 0xc], 0
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x462ca8
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x10]
push ecx
push str.InProcServer32
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x462c9e
push 0x104
mov ecx, dword [ebp + 0xc]
call fcn.00455c18
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x20], 0x104
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
lea edx, [ebp - 0x1c]
push edx
push 0
push 0x53cb20
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x18], eax
push 0xffffffffffffffff
mov ecx, dword [ebp + 0xc]
call fcn.00455d53
xor ecx, ecx
cmp dword [ebp - 0x18], 0
sete cl
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8
Function at 0x462cbb
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x184
mov dword [ebp - 0x17c], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x178], 0
mov eax, dword [ebp + 0x10]
mov byte [eax], 0
push 0x800
push 0x160
lea ecx, [ebp - 0x174]
push ecx
push 0
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
test eax, eax
je 0x462d1c
mov eax, dword [ebp - 0x16c]
and eax, 0x10000
test eax, eax
jne 0x462d23
xor eax, eax
jmp 0x462e53
lea ecx, [ebp - 0x14]
push ecx
push 0x523c50
push 0
push 0x523c60
lea ecx, [ebp - 4]
call fcn.00462957
test eax, eax
jge 0x462d46
xor eax, eax
jmp 0x462e53
lea edx, [ebp - 0x10]
push edx
push 0x5269d0
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x14]
push edx
call dword [ecx]
test eax, eax
jl 0x462e45
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 0
jne 0x462d80
mov dword [ebp - 0x180], 0
jmp 0x462dce
mov ecx, dword [ebp - 0x178]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
mov dword [ebp - 0x17c], eax
mov eax, dword [ebp - 0x17c]
shl eax, 1
add eax, 3
and al, 0xfc
call fcn.00408f70
mov dword [ebp - 0x184], esp
mov edx, dword [ebp - 0x17c]
push edx
mov eax, dword [ebp - 0x178]
push eax
mov ecx, dword [ebp - 0x184]
push ecx
call fcn.004032e0
mov dword [ebp - 0x180], eax
push 0
mov edx, dword [ebp - 0x180]
push edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x10]
push edx
call dword [ecx + 0x14]
test eax, eax
jl 0x462e39
push 2
mov ecx, dword [ebp + 8]
call fcn.004ae7ac
push eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x14]
push edx
call dword [ecx + 0x4c]
test eax, eax
jl 0x462e39
push 0
push 0
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x14]
push ecx
call dword [eax + 0xc]
mov edx, dword [ebp - 0x10]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x10]
push ecx
call dword [eax + 8]
mov edx, dword [ebp - 0x14]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x14]
push ecx
call dword [eax + 8]
mov eax, 1
jmp 0x462e53
mov edx, dword [ebp - 0x10]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x10]
push ecx
call dword [eax + 8]
mov edx, dword [ebp - 0x14]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x14]
push ecx
call dword [eax + 8]
xor eax, eax
lea esp, [ebp - 0x184]
mov esp, ebp
pop ebp
ret 0x10
Function at 0x462e5f
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cdded
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x15c
push ebx
push esi
push edi
push 1
push 0x104
mov eax, dword [ebp + 8]
push eax
call fcn.0042cc96
test eax, eax
jne 0x462ea8
push 0x216
push str.filecore.cpp
call fcn.004aba00
test eax, eax
je 0x462ea8
int3
xor ecx, ecx
test ecx, ecx
jne 0x462e80
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ebp + 8]
push eax
push 0x104
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
test eax, eax
jne 0x462efe
mov edx, dword [ebp + 0xc]
movsx eax, byte [edx]
test eax, eax
je 0x462ee4
mov ecx, dword [ebp + 0xc]
push ecx
push str.Warning:_could_not_parse_the_path__s._n
call fcn.0042ca55
add esp, 8
push 0x104
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
xor eax, eax
jmp 0x462ff1
lea ecx, [ebp - 0x1c]
call fcn.004a7f07
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00463004
push 0
push 0
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x10]
push ecx
push 0
push 0
push 0
lea ecx, [ebp - 0x1c]
call fcn.004a7faa
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
jne 0x462f76
lea ecx, [ebp - 0x1c]
call fcn.004a7faa
push eax
push str.Warning:_could_not_get_volume_information__s._n
call fcn.0042ca55
add esp, 8
mov dword [ebp - 0x164], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.0045546c
mov eax, dword [ebp - 0x164]
jmp 0x462ff1
mov edx, dword [ebp - 0x18]
and edx, 2
test edx, edx
jne 0x462f8a
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_CharUpperA]
mov ecx, dword [ebp - 0x18]
and ecx, 4
test ecx, ecx
jne 0x462fd2
lea edx, [ebp - 0x15c]
push edx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 0xffffffff
je 0x462fd2
mov ecx, dword [ebp - 0x160]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
lea edx, [ebp - 0x130]
push edx
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp - 0x168], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.0045546c
mov eax, dword [ebp - 0x168]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x471e80
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
add ecx, 0x20
call fcn.004a7faa
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
and eax, 1
test eax, eax
je 0x471ed6
push 1
push 0
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov ecx, dword [ebp - 8]
call dword [edx + 0xa0]
test eax, eax
jne 0x471ed4
push str.Warning:_File_save_with_new_name_failed._n
push 0x536e24
call fcn.0042ca55
add esp, 8
xor eax, eax
jmp 0x471f11
jmp 0x471f0c
push 1
mov ecx, dword [ebp - 8]
add ecx, 0x20
call fcn.004a7faa
push eax
mov eax, dword [ebp - 8]
mov edx, dword [eax]
mov ecx, dword [ebp - 8]
call dword [edx + 0xa0]
test eax, eax
jne 0x471f0c
push str.Warning:_File_save_failed._n
push 0x536e44
call fcn.0042ca55
add esp, 8
xor eax, eax
jmp 0x471f11
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x472640
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ce145
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x110
mov dword [ebp - 0x11c], 0
lea ecx, [ebp - 0x10]
call fcn.004a7f07
mov dword [ebp - 4], 1
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0x114]
push ecx
push 0x104
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
mov eax, dword [ebp - 0x118]
mov byte [eax], 0
push 0x105
lea ecx, [ebp - 0x10]
call fcn.00455c18
push eax
push 0
push 0x536ed0
lea ecx, [ebp - 0x114]
push ecx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.00455d53
cmp dword [ebp + 0x10], 0
jne 0x4726dd
lea ecx, [ebp - 0x10]
call fcn.004a7faa
push eax
call fcn.00462934
lea edx, [ebp - 0x10]
push edx
mov ecx, dword [ebp + 8]
call fcn.0045509a
mov eax, dword [ebp - 0x11c]
or al, 1
mov dword [ebp - 0x11c], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.0045546c
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x47bab6
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
lea eax, [ebp + 0x18]
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp + 8]
call fcn.0047b6e0
mov dword [ebp - 0x28], eax
mov edx, dword [ebp + 8]
cmp dword [edx], 0
je 0x47bb15
push 0x20
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x24]
push ecx
call fcn.0047b874
test eax, eax
jne 0x47bb13
push 0xffffffffffffffff
push 0
mov edx, dword [ebp + 0x14]
push edx
call fcn.0047b4c9
mov ecx, dword [ebp + 8]
call fcn.0047b7ff
jmp 0x47bb34
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
lea edx, [ebp - 0x24]
push edx
call dword [sym.imp.USER32.dll_wvsprintfA]
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
call fcn.0046dc93
mov dword [ebp - 4], 0
mov esp, ebp
pop ebp
ret

Function at 0x47bd4c
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
call fcn.0047b6e0
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
cmp dword [ecx], 0
je 0x47bda0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
add eax, 1
push eax
mov ecx, dword [ebp - 8]
push ecx
mov ecx, dword [ebp + 0x10]
call fcn.00455dc7
push eax
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0xffffffffffffffff
mov ecx, dword [ebp + 0x10]
call fcn.00455d53
jmp 0x47bdb2
mov ecx, dword [ebp + 0x10]
call fcn.004a7faa
push eax
mov eax, dword [ebp - 4]
push eax
call fcn.0046dc93
mov esp, ebp
pop ebp
ret 0xc

Function at 0x47c1a4
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
call fcn.0047b72e
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
cmp dword [ecx], 0
je 0x47c21d
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jle 0x47c1f4
mov eax, dword [ebp - 8]
add eax, 1
push eax
mov ecx, dword [ebp - 8]
push ecx
mov ecx, dword [ebp + 0x10]
call fcn.00455dc7
push eax
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x47c211
push 0x100
push 0xff
mov ecx, dword [ebp + 0x10]
call fcn.00455c18
push eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0xffffffffffffffff
mov ecx, dword [ebp + 0x10]
call fcn.00455d53
jmp 0x47c24e
mov ecx, dword [ebp + 0x10]
call fcn.004a7faa
push eax
push 0xffffffffffffffff
push 0x14d
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 0xffffffff
jne 0x47c24e
mov ecx, dword [ebp + 0x10]
call fcn.004a7faa
push eax
mov edx, dword [ebp - 4]
push edx
call fcn.0046dc93
mov esp, ebp
pop ebp
ret 0xc
Function at 0x47d715
Capabilities:
Delete registry key
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 0x14], ecx
cmp dword [ebp + 8], 0
jne 0x47d73b
push 0x110
push str.appui3.cpp
call fcn.004aba00
test eax, eax
je 0x47d73b
int3
xor eax, eax
test eax, eax
jne 0x47d721
mov ecx, dword [ebp - 0x14]
cmp dword [ecx + 0x80], 0
je 0x47d826
cmp dword [ebp + 0xc], 0
jne 0x47d78f
mov ecx, dword [ebp - 0x14]
call fcn.004c302c
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x47d76f
xor eax, eax
jmp 0x47d899
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x47d81b
cmp dword [ebp + 0x10], 0
jne 0x47d7ce
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x14]
call fcn.004c3132
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x47d7b1
xor eax, eax
jmp 0x47d899
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x47d81b
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x14]
call fcn.004c3132
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x47d7ea
xor eax, eax
jmp 0x47d899
mov ecx, dword [ebp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
push eax
mov edx, dword [ebp + 0x10]
push edx
push 1
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp dword [ebp - 4], 0
sete al
jmp 0x47d899
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x94], 0
jne 0x47d846
push 0x132
push str.appui3.cpp
call fcn.004aba00
test eax, eax
je 0x47d846
int3
xor ecx, ecx
test ecx, ecx
jne 0x47d826
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x94]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 0xfff
jl 0x47d877
push 0x133
push str.appui3.cpp
call fcn.004aba00
test eax, eax
je 0x47d877
int3
xor ecx, ecx
test ecx, ecx
jne 0x47d84c
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x94]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc