joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403b80
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x220
mov eax, dword [0x44e848]
xor eax, esp
mov dword [esp + 0x21c], eax
push esi
push 1
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
jne 0x403bbf
xor al, al
pop esi
mov ecx, dword [esp + 0x21c]
xor ecx, esp
call fcn.00427533
add esp, 0x220
ret
push edi
push 0x100
push str.PelService
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
test edi, edi
je 0x403c11
lea eax, [esp + 8]
push eax
push 0x90
push edi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x403c2a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [esp + 0x28]
push 0x43e9e8
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea edx, [esp + 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
pop edi
xor al, al
pop esi
mov ecx, dword [esp + 0x21c]
xor ecx, esp
call fcn.00427533
add esp, 0x220
ret
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call edi
push esi
call edi
mov ecx, dword [esp + 0x224]
pop edi
pop esi
xor ecx, esp
mov al, 1
call fcn.00427533
add esp, 0x220
ret

Function at 0x403de0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x620
mov eax, dword [0x44e848]
xor eax, esp
mov dword [esp + 0x61c], eax
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x638]
xor eax, eax
mov esi, ecx
push 0x206
push eax
lea ecx, [esp + 0x1e]
push ecx
mov dword [esp + 0x1c], esi
mov word [esp + 0x20], ax
call fcn.00427580
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x232]
push eax
mov word [esp + 0x234], dx
call fcn.00427580
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x446]
push edx
mov word [esp + 0x448], cx
call fcn.00427580
add esp, 0x24
call fcn.00412396
mov ebp, dword [esp + 0x634]
mov ebx, dword [eax + 4]
push 0x104
cmp ebp, 0x8a
jne 0x403e83
lea eax, [esp + 0x18]
push eax
mov ecx, esi
call fcn.004134a3
jmp 0x403e90
lea ecx, [esp + 0x18]
push ecx
push ebp
mov ecx, esi
call fcn.00412d57
lea esi, [ebx + 0x2ae]
push esi
push 0x104
lea edx, [esp + 0x42c]
push edx
lea eax, [esp + 0x20]
push eax
push edi
push 0x43d9c8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push esi
push 0x104
lea ecx, [esp + 0x224]
push ecx
lea edx, [esp + 0x430]
push edx
push edi
add ebx, 0xa6
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp ebp, 0x8a
jne 0x403ef4
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x21c]
push eax
call fcn.00412e42
jmp 0x403f06
lea ecx, [esp + 0x21c]
push ecx
mov ecx, dword [esp + 0x14]
push ebp
call fcn.00412d81
mov ecx, dword [esp + 0x62c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00427533
add esp, 0x620
ret 8
Function at 0x404b80
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x44e848]
xor eax, esp
mov dword [esp + 0x114], eax
push 0x114
lea eax, [esp + 4]
push 0
push eax
call fcn.00427580
add esp, 0xc
lea ecx, [esp]
push ecx
mov dword [esp + 4], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 4], 6
jne 0x404be9
cmp dword [esp + 8], 0
jbe 0x404be9
push str.ChangeWindowMessageFilter
push 0x43eed4
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x404be9
push 1
push 2
call eax
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.00427533
add esp, 0x118
ret
Function at 0x404c30
Capabilities:
Identify system language via api

Disassembly:
push esi
push edi
mov esi, ecx
call fcn.00412396
mov eax, dword [eax + 8]
push 0x104
lea edi, [esi + 0x2ae]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x5c
push edi
call fcn.004276b8
add esp, 8
push str.TPMXUD.ini
xor ecx, ecx
push edi
mov word [eax + 2], cx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov edi, dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
call edi
and eax, 0x3ff
add eax, 0xfffffffc
cmp eax, 0x20
ja case.0x404c8c.9
movzx edx, byte [eax + 0x404f30]
jmp dword [edx*4 + 0x404ed8]
push str.Czech
add esi, 0xa6
push esi
call fcn.00427da5
add esp, 8
pop edi
pop esi
ret
push str.Danish
add esi, 0xa6
push esi
call fcn.00427da5
add esp, 8
pop edi
pop esi
ret
push str.Dutch
add esi, 0xa6
push esi
call fcn.00427da5
add esp, 8
pop edi
pop esi
ret
push str.Finnish
add esi, 0xa6
push esi
call fcn.00427da5
add esp, 8
pop edi
pop esi
ret
push str.French
add esi, 0xa6
push esi
call fcn.00427da5
add esp, 8
pop edi
pop esi
ret
push str.German
add esi, 0xa6
push esi
call fcn.00427da5
add esp, 8
pop edi
pop esi
ret
push str.Greek
add esi, 0xa6
push esi
call fcn.00427da5
add esp, 8
pop edi
pop esi
ret
push str.Hungarian
add esi, 0xa6
push esi
call fcn.00427da5
add esp, 8
pop edi
pop esi
ret
push str.Italian
add esi, 0xa6
push esi
call fcn.00427da5
add esp, 8
pop edi
pop esi
ret
push str.Japanese
add esi, 0xa6
push esi
call fcn.00427da5
add esp, 8
pop edi
pop esi
ret
push str.Korean
add esi, 0xa6
push esi
call fcn.00427da5
add esp, 8
pop edi
pop esi
ret
push str.Norwegian
add esi, 0xa6
push esi
call fcn.00427da5
add esp, 8
pop edi
pop esi
ret
push str.Polish
add esi, 0xa6
push esi
call fcn.00427da5
add esp, 8
pop edi
pop esi
ret
push str.Russian
add esi, 0xa6
push esi
call fcn.00427da5
add esp, 8
pop edi
pop esi
ret
push str.Slovak
add esi, 0xa6
push esi
call fcn.00427da5
add esp, 8
pop edi
pop esi
ret
push str.Slovenian
add esi, 0xa6
push esi
call fcn.00427da5
add esp, 8
pop edi
pop esi
ret
push str.Spanish
add esi, 0xa6
push esi
call fcn.00427da5
add esp, 8
pop edi
pop esi
ret
push str.Swedish
add esi, 0xa6
push esi
call fcn.00427da5
add esp, 8
pop edi
pop esi
ret
push str.Turkish
add esi, 0xa6
push esi
call fcn.00427da5
add esp, 8
pop edi
pop esi
ret
call edi
mov ecx, 0xfc00
and ax, cx
mov edx, 0x800
add esi, 0xa6
cmp dx, ax
jne 0x404e73
push str.China
push esi
call fcn.00427da5
add esp, 8
pop edi
pop esi
ret
push str.Taiwan
push esi
call fcn.00427da5
add esp, 8
pop edi
pop esi
ret
call edi
mov ecx, 0xfc00
and ax, cx
mov edx, 0x400
add esi, 0xa6
cmp dx, ax
jne 0x404eaf
push str.Br.Portuguese
push esi
call fcn.00427da5
add esp, 8
pop edi
pop esi
ret
push str.Portuguese
push esi
call fcn.00427da5
add esp, 8
pop edi
pop esi
ret
push 0x43d9c8
add esi, 0xa6
push esi
call fcn.00427da5
add esp, 8
pop edi
pop esi
ret
Function at 0x405e30
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x43a426
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x44e848]
xor eax, esp
mov dword [esp + 0x420], eax
push ebx
push esi
mov eax, dword [0x44e848]
xor eax, esp
push eax
lea eax, [esp + 0x430]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0x14], ebx
call fcn.0040ad12
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x405e89
push 0x80004005
call fcn.00401020
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0xc], eax
push 0x104
lea ecx, [esp + 0x20]
push ecx
push ebx
mov dword [esp + 0x444], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [esp + 0x1c]
push 0x5c
push edx
call fcn.004276b8
add esp, 8
xor ecx, ecx
mov word [eax + 2], cx
lea eax, [esp + 0x1c]
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x405ed0
sub eax, edx
sar eax, 1
push eax
lea edx, [esp + 0x20]
push edx
lea ecx, [esp + 0x14]
call fcn.00403430
push str.TPMXUD.ini
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x20]
push ecx
call fcn.00405650
add esp, 0xc
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x43c], 1
call fcn.004055d0
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
mov byte [esp + 0x438], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x405f3e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [esp + 0xc]
push esi
push 0x104
lea ecx, [esp + 0x22c]
push ecx
push str.Mouse_Suite
push str.Product_Reg
push 0x43e660
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea edx, [esp + 0x10]
push edx
push 0x20119
push ebx
lea eax, [esp + 0x230]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x405fb2
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push ecx
push ebx
push ebx
push ebx
push str.RunAutoUpdate
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [esp + 0x14], ebx
jbe 0x405fa7
mov bl, 1
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esi - 0x10]
mov dword [esp + 0x438], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x405fd9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov al, bl
mov ecx, dword [esp + 0x430]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x420]
xor ecx, esp
call fcn.00427533
add esp, 0x430
ret
Function at 0x406010
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x43a426
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x44e848]
xor eax, esp
mov dword [esp + 0x420], eax
push ebx
push esi
mov eax, dword [0x44e848]
xor eax, esp
push eax
lea eax, [esp + 0x430]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0x14], ebx
call fcn.0040ad12
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x406069
push 0x80004005
call fcn.00401020
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0xc], eax
push 0x104
lea ecx, [esp + 0x20]
push ecx
push ebx
mov dword [esp + 0x444], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [esp + 0x1c]
push 0x5c
push edx
call fcn.004276b8
add esp, 8
xor ecx, ecx
mov word [eax + 2], cx
lea eax, [esp + 0x1c]
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4060b0
sub eax, edx
sar eax, 1
push eax
lea edx, [esp + 0x20]
push edx
lea ecx, [esp + 0x14]
call fcn.00403430
push str.TPMXUD.ini
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x20]
push ecx
call fcn.00405650
add esp, 0xc
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x43c], 1
call fcn.004055d0
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
mov byte [esp + 0x438], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40611e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [esp + 0xc]
push esi
push 0x104
lea ecx, [esp + 0x22c]
push ecx
push str.Mouse_Suite
push str.Product_Reg
push 0x43e660
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea edx, [esp + 0x10]
push edx
push 0x20119
push ebx
lea eax, [esp + 0x230]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x406192
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push ecx
push ebx
push ebx
push ebx
push str.CheckNetWork
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [esp + 0x14], ebx
jbe 0x406187
mov bl, 1
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esi - 0x10]
mov dword [esp + 0x438], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4061b9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov al, bl
mov ecx, dword [esp + 0x430]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x420]
xor ecx, esp
call fcn.00427533
add esp, 0x430
ret
Function at 0x407240
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x43a651
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x44e848]
xor eax, esp
mov dword [esp + 0x214], eax
push esi
push edi
mov eax, dword [0x44e848]
xor eax, esp
push eax
lea eax, [esp + 0x224]
mov dword fs:[0], eax
mov esi, ecx
push 0x43f290
lea ecx, [esp + 0x10]
call fcn.00403860
mov dword [esp + 0x22c], 0
call fcn.0040ad12
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4072ae
push 0x80004005
call fcn.00401020
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x10], eax
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x22]
push edx
mov byte [esp + 0x238], 1
mov word [esp + 0x24], cx
call fcn.00427580
add esp, 0xc
push 0x104
lea eax, [esp + 0x1c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [esp + 0x18]
push 0x5c
push ecx
call fcn.004276b8
add esp, 8
xor edx, edx
mov word [eax], dx
lea eax, [esp + 0x18]
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x407310
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x14]
call fcn.00401390
lea ecx, [esp + 0x14]
push ecx
mov ecx, esi
call fcn.00406b20
mov edx, dword [eax]
push edx
lea eax, [esp + 0x14]
push str.___E__T__G___s_:F
push eax
mov byte [esp + 0x238], 2
call fcn.00401450
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
add esp, 0xc
mov byte [esp + 0x22c], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40737f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edi, dword [esp + 0x10]
mov eax, dword [edi - 0xc]
push eax
push edi
lea ecx, [esp + 0x14]
call fcn.00401390
mov ecx, dword [esp + 0xc]
mov esi, dword [ecx - 0xc]
mov eax, dword [ecx - 8]
mov edx, 1
sub edx, dword [ecx - 4]
sub eax, esi
or eax, edx
jge 0x4073b7
push esi
lea ecx, [esp + 0x10]
call fcn.00401180
mov ecx, dword [esp + 0xc]
mov eax, ecx
test esi, esi
jl 0x40745c
cmp esi, dword [ecx - 8]
jg 0x40745c
mov dword [ecx - 0xc], esi
mov edx, dword [esp + 0xc]
xor ecx, ecx
push ecx
push ecx
push eax
push str.cacls.exe
push ecx
push ecx
mov word [edx + esi*2], cx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea eax, [edi - 0x10]
mov byte [esp + 0x22c], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40740b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov dword [esp + 0x22c], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x407436
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x224]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.00427533
add esp, 0x224
ret
push 0x80070057
call fcn.00401020
int3
Function at 0x407cd0
Capabilities:
Set registry value

Disassembly:
push ecx
mov ecx, dword [ecx + 0x39c]
push 0
lea eax, [esp + 4]
push eax
push 0
push 0xf013f
push 0
push 0
push 0
push ecx
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x407d2b
push str.TRUE
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [esp]
add eax, eax
push eax
push str.TRUE
push 1
push 0
push str.CheckNetWork
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [esp]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ecx
ret

Function at 0x407d30
Capabilities:
Delete registry value

Disassembly:
push ecx
mov ecx, dword [ecx + 0x39c]
lea eax, [esp]
push eax
push 0xf003f
push 0
push ecx
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x407d6b
mov ecx, dword [esp]
push str.CheckNetWork
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov edx, dword [esp]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ecx
ret
Function at 0x408cc0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x218
mov eax, dword [0x44e848]
xor eax, esp
mov dword [esp + 0x214], eax
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x39c]
lea ecx, [esp + 0xc]
push ecx
push 0x20119
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
xor bl, bl
mov dword [esp + 0x1c], 1
mov dword [esp + 0x24], 0x208
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x408d43
lea edx, [esp + 0x10]
push edx
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x10]
push ecx
push 0
push str.Version
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x408d43
lea eax, [esp + 0x14]
push eax
lea ecx, [esi + 0x388]
mov bl, 1
call fcn.004037e0
mov ecx, dword [esp + 0x21c]
pop esi
mov al, bl
pop ebx
xor ecx, esp
call fcn.00427533
add esp, 0x218
ret
Function at 0x409490
Capabilities:
Check os version

Disassembly:
sub esp, 0x11c
mov eax, dword [0x44e848]
xor eax, esp
mov dword [esp + 0x118], eax
push esi
mov esi, dword [esp + 0x124]
push 0x114
lea eax, [esp + 0xc]
push 0
push eax
mov dword [esp + 0x10], 0
call fcn.00427580
add esp, 0xc
lea ecx, [esp + 8]
push ecx
mov dword [esp + 0xc], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [esp + 0xc]
cmp eax, 6
jne 0x409504
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x4094f3
push str.Vista
jmp 0x409515
cmp eax, 1
je 0x409510
cmp eax, 2
jne 0x409510
push str.Win8
jmp 0x409515
cmp eax, 5
jne 0x409510
push 0x43f714
jmp 0x409515
push str.Win7
mov ecx, esi
call fcn.00403860
mov ecx, dword [esp + 0x11c]
mov eax, esi
pop esi
xor ecx, esp
call fcn.00427533
add esp, 0x11c
ret 4
Function at 0x40c1c8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x58], ebx
test ebx, 0xffff0000
jne 0x40c1ec
cmp dword [edi + 0x54], 0
jne 0x40c1ec
movzx eax, bx
mov dword [edi + 0x54], eax
call fcn.00412396
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.0040c189
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x4119a9
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x4119f0
call fcn.00412396
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x4119f0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x411a0c
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.00411521
mov esi, eax
test edi, edi
je 0x411a0a
test ebx, ebx
je 0x411a0a
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x4134a3
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x43af8b
call fcn.004287eb
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x4134c8
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x41350e
lea ecx, [ebp - 0x10]
call fcn.004011d0
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040a9d0
add esp, 0x10
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00401040
mov eax, esi
call fcn.004288c3
ret 8
Function at 0x416727
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
cmp dword [ebp + 0xc], ebx
je 0x41676f
call fcn.00412396
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x41676f
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
test eax, eax
je 0x4167b2
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
test ebx, ebx
je 0x41679b
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x41679b
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x4167af
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x427533
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x44e848]
jne 0x42753d
repz ret
jmp fcn.0042fe3a
Function at 0x43346d
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0042bf62
and dword [ebp - 4], 0
cmp dword [0x452b38], 0
mov ebx, eax
jne 0x43351e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4335cf
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4335cf
push eax
call fcn.0042bef0
mov dword [esp], 0x443608
push edi
mov dword [0x452b38], eax
call esi
push eax
call fcn.0042bef0
mov dword [esp], 0x4435f4
push edi
mov dword [0x452b3c], eax
call esi
push eax
call fcn.0042bef0
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x452b40], eax
call esi
push eax
call fcn.0042bef0
pop ecx
mov dword [0x452b48], eax
test eax, eax
je 0x43351e
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0042bef0
pop ecx
mov dword [0x452b44], eax
mov eax, dword [0x452b44]
cmp eax, ebx
je 0x433576
cmp dword [0x452b48], ebx
je 0x433576
push eax
call fcn.0042bf6b
push dword [0x452b48]
mov esi, eax
call fcn.0042bf6b
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x433576
test edi, edi
je 0x433576
call esi
test eax, eax
je 0x43356d
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x43356d
test byte [ebp - 0xc], 1
jne 0x433576
or dword [ebp + 0x10], 0x200000
jmp 0x4335af
mov eax, dword [0x452b3c]
cmp eax, ebx
je 0x4335af
push eax
call fcn.0042bf6b
pop ecx
test eax, eax
je 0x4335af
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4335af
mov eax, dword [0x452b40]
cmp eax, ebx
je 0x4335af
push eax
call fcn.0042bf6b
pop ecx
test eax, eax
je 0x4335af
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x452b38]
call fcn.0042bf6b
pop ecx
test eax, eax
je 0x4335cf
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4335d1
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret