joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41e706
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
mov ecx, dword [edi + 4]
call fcn.0041ec11
push 0xfffffffffffffff0
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
push dword [ebp + 0xc]
mov esi, eax
mov ecx, edi
and esi, 3
call fcn.0041e941
cmp esi, 3
je 0x41e744
mov dword [edi + 0xc], 1
cmp dword [edi], 0
je 0x41e79a
push ebx
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov edi, dword [ebp + 0x10]
mov ebx, eax
mov ecx, edi
test ebx, ebx
jle 0x41e775
push ebx
call fcn.0041400d
push ebx
mov ecx, edi
mov esi, eax
call fcn.004140e3
lea ecx, [ebx + 1]
push ecx
push esi
jmp 0x41e785
push 0xff
call fcn.0041400d
push 0x100
push eax
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0xffffffffffffffff
mov ecx, edi
call fcn.004149d9
pop ebx
jmp 0x41e7be
mov esi, dword [ebp + 0x10]
push dword [esi]
push 0xffffffffffffffff
push 0x14d
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
jne 0x41e7be
push dword [esi]
push dword [ebp - 4]
call fcn.0041dc33
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x41e887
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov ecx, esi
call fcn.0041e941
cmp dword [esi], 0
mov ebx, eax
mov dword [esi + 0xc], 1
je 0x41e8de
push edi
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov ecx, dword [ebp + 0x10]
mov edi, eax
push edi
call fcn.0041400d
mov ecx, dword [ebp + 0x10]
mov esi, eax
push edi
call fcn.004140e3
lea edx, [edi + 1]
push edx
push esi
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.004149d9
pop edi
jmp 0x41e8e9
mov eax, dword [ebp + 0x10]
push dword [eax]
push ebx
call fcn.0041dc33
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x41ecc7
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x580e6b
call fcn.0054dd5d
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x74], ebx
jne 0x41eced
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x41ed5e
call fcn.00414e0c
push eax
lea ecx, [ebp - 0x10]
call fcn.00413775
mov edi, dword [edi + 0x74]
lea ecx, [ebp - 0x10]
push ecx
mov dword [ebp - 4], ebx
mov eax, dword [edi]
mov esi, dword [eax + 0x8c]
mov ecx, esi
call fcn.0054dd20
mov ecx, edi
call esi
mov esi, dword [ebp + 8]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push esi
call fcn.0055d97a
add esp, 0x10
test eax, eax
je 0x41ed44
cmp eax, 0xc
je 0x41ed6b
cmp eax, 0x16
je 0x41ed66
cmp eax, 0x22
je 0x41ed66
cmp eax, 0x50
jne 0x41ed66
test esi, esi
je 0x41ed51
push esi
call fcn.00559869
pop ecx
mov ebx, eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00404640
mov eax, ebx
call fcn.0054dd26
ret 8
call fcn.004146d9
call fcn.004146f3
int3
Function at 0x4222e3
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 4], ecx
mov esi, edi
cmp dword [ebp + 8], esi
je 0x422328
call fcn.00416bc5
push 0xf0
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x422328
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x422344
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.0042ac2d
mov ebx, eax
test edi, edi
je 0x422342
test esi, esi
je 0x422342
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x422d3f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
je 0x422dfd
cmp dword [esi + 0x20], 0
je 0x422dfd
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x422dfd
cmp dword [ebp + 8], 0
je 0x422dfd
xor eax, eax
mov ebx, eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], ebx
mov edi, eax
call fcn.00416bc5
push 0x5930b8
push dword [ebp + 8]
mov eax, dword [eax + 0xc]
push eax
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x422dce
mov edi, dword [ebp - 0xc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp - 0x10]
mov dword [ebp - 4], eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x422dfd
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov dword [ebp - 8], eax
push dword [ebp - 4]
push ebx
push esi
call fcn.0042b766
add esp, 0xc
mov ebx, eax
cmp dword [ebp - 8], 0
je 0x422dee
test edi, edi
je 0x422dee
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
test ebx, ebx
je 0x422df9
mov ecx, esi
call fcn.00422ae2
mov eax, ebx
jmp 0x422dff
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x427a43
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x84], 0
mov ecx, dword [ebx + 0x88]
mov edi, dword [ebx + 0x8c]
mov dword [ebp - 4], ecx
je 0x427a88
call fcn.00416bc5
push 5
push dword [ebx + 0x84]
mov esi, dword [eax + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ecx, eax
mov dword [ebp - 4], eax
test ecx, ecx
je 0x427a98
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [ebp - 4]
mov edi, eax
xor esi, esi
inc esi
test edi, edi
je 0x427ae4
mov edx, dword [edi]
mov eax, edx
shr eax, 0x10
mov dword [ebp - 4], 0xffff
cmp ax, word [ebp - 4]
jne 0x427ac3
movzx eax, word [edi + 0x12]
mov edx, dword [edi + 0xc]
mov dword [ebp - 4], eax
movzx eax, word [edi + 0x14]
jmp 0x427ace
movzx eax, word [edi + 0xa]
mov dword [ebp - 4], eax
movzx eax, word [edi + 0xc]
test edx, 0x1801
jne 0x427ae2
cmp word [ebp - 4], 0
jne 0x427ae2
test ax, ax
je 0x427ae4
xor esi, esi
cmp dword [ebx + 0x84], 0
je 0x427af4
push ecx
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x427afd
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, ecx
push edi
mov edi, dword [ebp + 8]
mov dword [ebx + 0x84], edi
test edi, 0xffff0000
jne 0x427b28
cmp dword [ebx + 0x80], 0
jne 0x427b28
movzx eax, di
mov dword [ebx + 0x80], eax
call fcn.00416bc5
push 5
push edi
mov esi, dword [eax + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov edi, eax
mov ecx, ebx
push edi
call fcn.00427dbb
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x427b62
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor esi, esi
call fcn.00416bc5
push 5
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x427b99
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
mov ecx, dword [ebp - 4]
push ebx
push dword [ebp + 0xc]
push esi
call fcn.00427bba
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x427eb5
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x28
mov eax, 0x58156c
call fcn.0054ddc8
mov edi, ecx
mov dword [ebp - 0x24], edi
mov eax, dword [edi + 0x8c]
mov esi, dword [edi + 0x88]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], esi
call fcn.00416bc5
xor ebx, ebx
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x20], eax
cmp dword [edi + 0x84], ebx
je 0x427f14
call fcn.00416bc5
push 5
push dword [edi + 0x84]
mov esi, dword [eax + 0xc]
push esi
mov dword [ebp - 0x20], esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
mov dword [ebp - 0x1c], eax
test esi, esi
je 0x427f24
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x18], eax
jmp 0x427f27
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x427f33
or eax, 0xffffffff
jmp 0x4280b7
mov ecx, edi
call fcn.00428509
mov esi, eax
mov dword [ebp - 0x28], esi
call fcn.0042100a
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x2c], ebx
test esi, esi
je 0x427fdb
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp esi, eax
je 0x427fdb
push esi
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x427fdb
push ebx
push esi
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [ebp - 0x30], 1
call fcn.0041dfba
mov dword [ebp - 0x14], eax
test eax, eax
je 0x427f9d
mov ecx, dword [eax]
mov esi, dword [ecx + 0x74]
mov ecx, esi
call fcn.0054dd20
mov ecx, dword [ebp - 0x14]
call esi
mov esi, eax
mov dword [ebp - 0x14], esi
jmp 0x427fa2
mov esi, ebx
mov dword [ebp - 0x14], ebx
test esi, esi
je 0x427fdb
mov eax, dword [esi]
mov esi, dword [eax + 0x150]
mov ecx, esi
call fcn.0054dd20
mov ecx, dword [ebp - 0x14]
call esi
test eax, eax
je 0x427fdb
mov esi, dword [ebp - 0x14]
mov ecx, esi
call fcn.0041edb1
test eax, eax
je 0x427fdb
push ebx
mov ecx, esi
call fcn.0041eb6c
mov dword [ebp - 0x2c], 1
push edi
mov dword [ebp - 4], ebx
call fcn.00420cab
mov esi, dword [ebp - 0x28]
push esi
call fcn.0042236b
push dword [ebp - 0x20]
mov ecx, edi
push eax
push dword [ebp - 0x18]
call fcn.00427e58
test eax, eax
jne 0x428026
cmp dword [edi + 0x9c], ebx
jne 0x428026
call fcn.00416bc5
push esi
mov eax, dword [eax + 8]
mov dword [ebp - 0x20], eax
call fcn.0042236b
push dword [ebp - 0x20]
mov ecx, edi
push eax
push dword [ebp - 0x18]
call fcn.00427e58
or dword [ebp - 4], 0xffffffff
mov dword [edi + 0x9c], ebx
jmp 0x428057
cmp dword [ebp - 0x2c], 0
je 0x428067
mov ecx, dword [ebp - 0x14]
push 1
call fcn.0041eb6c
cmp dword [ebp - 0x30], 0
je 0x428076
push 1
push esi
call dword [sym.imp.USER32.dll_EnableWindow]
test esi, esi
je 0x42808c
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [edi + 0x20]
jne 0x42808c
push esi
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [edi]
mov esi, dword [eax + 0x60]
mov ecx, esi
call fcn.0054dd20
mov ecx, edi
call esi
mov ecx, edi
call fcn.004284c0
cmp dword [edi + 0x84], ebx
je 0x4280b4
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [edi + 0x68]
call fcn.0054dd26
ret
Function at 0x42d2c3
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
mov dword [ebp - 4], ebx
test byte [esi + 4], 1
mov edi, dword [esi + 0xc]
jne 0x42d319
push 5
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x42d2f2
call fcn.0041bbef
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x42d307
call fcn.0041bbef
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x42d319
call fcn.0041bbef
call fcn.00416bc5
cmp dword [eax + 0x3c], 0
je 0x42d32e
push edi
mov ecx, ebx
call fcn.0042c9fc
mov edi, eax
push dword [ebp + 0xc]
push edi
call fcn.0042d51f
mov ebx, eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x88]
test ecx, ecx
je 0x42d357
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 4]
and dword [eax + 0x88], 0
test ebx, ebx
je 0x42d363
mov edi, ebx
mov dword [eax + 0x88], ebx
or dword [esi + 4], 1
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x42fa73
Capabilities:
Extract resource via kernel32 functions
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x42fbd3
mov ecx, 0x63da40
call fcn.00417748
mov esi, eax
test esi, esi
je 0x42fbc8
xor eax, eax
cmp word [esi + 8], ax
jne 0x42fb92
push str.comctl32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ebx, eax
test ebx, ebx
je 0x42fb34
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov edi, dword [ebp + 0x10]
mov ecx, 0x3ff
and ax, cx
cmp ax, 0x11
jne 0x42fafa
push 0x594900
call fcn.0042fc13
pop ecx
test eax, eax
je 0x42fafa
mov eax, edi
neg eax
push 0xfc11
sbb eax, eax
and eax, 0xe
add eax, 0x3ee
push eax
push 5
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
test eax, eax
jne 0x42fb15
neg edi
push 5
sbb edi, edi
and edi, 0xe
add edi, 0x3ee
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x42fb34
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
test eax, eax
je 0x42fb3a
push ebx
push edi
push eax
call fcn.0042e1b5
add esp, 0xc
jmp 0x42fb3a
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov eax, dword [edi]
push 2
mov eax, dword [eax - 0xc]
inc eax
push eax
call fcn.00414bcc
pop ecx
pop ecx
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edx, eax
mov dword [esi + 4], edx
test edx, edx
je 0x42fbcd
mov eax, dword [edi]
push eax
mov ecx, dword [eax - 0xc]
lea eax, [ecx + 1]
push eax
push edx
call fcn.0055d849
add esp, 0xc
test eax, eax
je 0x42fb87
cmp eax, 0xc
je 0x42fbcd
cmp eax, 0x16
je 0x42fbc8
cmp eax, 0x22
je 0x42fbc8
cmp eax, 0x50
jne 0x42fbc8
mov ax, word [ebx]
mov word [esi + 8], ax
xor eax, eax
jmp 0x42fb95
mov ebx, dword [ebp + 0xc]
mov edi, dword [esi + 4]
test edi, edi
je 0x42fba3
push edi
call fcn.00559869
pop ecx
mov ecx, dword [ebp + 8]
push eax
push edi
call fcn.0041410e
movzx ecx, word [esi + 8]
mov edx, 0xffff
xor eax, eax
mov word [ebx], cx
pop edi
cmp cx, dx
pop esi
setne al
pop ebx
pop ebp
ret 0xc
call fcn.004146d9
call fcn.004146f3
int3
Function at 0x43067b
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [0x63ecb0], 0
push edi
mov edi, ecx
jne 0x430694
xor eax, eax
jmp 0x43072e
push ebx
push esi
xor ebx, ebx
push ebx
push 0x40
push ebx
call fcn.0041eddb
push ebx
push 1
mov ecx, edi
call fcn.00430617
push eax
call fcn.00442f58
push eax
mov ecx, edi
call fcn.004313e3
push 1
push ebx
mov ecx, edi
call fcn.00430617
push eax
call fcn.00442f58
push eax
mov ecx, edi
call fcn.004313e3
mov eax, dword [edi]
mov esi, dword [eax + 0x194]
mov ecx, esi
call fcn.0054dd20
mov ecx, edi
call esi
cmp dword [edi + 0x154], ebx
jne 0x430729
lea eax, [ebp - 8]
mov dword [ebp - 0xc], ebx
push eax
push ebx
push ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
call sub.SHELL32.dll_SHGetSpecialFolderLocation
test eax, eax
js 0x430729
mov eax, dword [edi]
lea ecx, [ebp - 0xc]
push ecx
mov esi, dword [eax + 0x188]
mov ecx, esi
call fcn.0054dd20
mov ecx, edi
call esi
push dword [ebp - 8]
mov ecx, dword [0x63ecb0]
call fcn.00476604
xor eax, eax
pop esi
inc eax
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x4307e4
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xddc
mov eax, dword [0x636f58]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
test ecx, ecx
je 0x430a1c
test ebx, ebx
je 0x430a1c
mov eax, dword [ebp + 0x10]
xor edi, edi
mov dword [ebp - 0x644], edi
mov dword [ebp - 0x640], edi
mov dword [ebp - 0x63c], edi
mov dword [ebp - 0x638], edi
mov dword [ebp - 0x634], edi
mov dword [ebp - 0x630], edi
mov dword [ebp - 0x874], edi
mov dword [ebp - 0x870], edi
mov dword [ebp - 0x86c], edi
mov dword [ebp - 0x868], edi
mov dword [ebp - 0x864], edi
mov dword [ebp - 0x860], edi
sub eax, edi
je 0x4309e5
sub eax, 1
je 0x43087c
sub eax, 1
je 0x43094d
sub eax, 1
jne 0x430a07
lea eax, [ebp - 0x20c]
push eax
push dword [ecx + 4]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x4309e0
push edi
lea eax, [ebp - 0x644]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.0041af01
test eax, eax
je 0x4309e0
lea eax, [ebp - 0x414]
push eax
push dword [ebx + 4]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x4309db
push edi
lea eax, [ebp - 0x874]
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.0041af01
test eax, eax
je 0x4309db
xor edx, edx
inc edx
cmp dword [ebp + 0x10], edx
jne 0x4309a4
test byte [ebp - 0x624], 0x10
jne 0x4309e0
test byte [ebp - 0x854], 0x10
jne 0x430946
mov ecx, dword [ebp - 0x858]
mov eax, dword [ebp - 0x85c]
cmp dword [ebp - 0x628], ecx
ja 0x430946
jb 0x4309e0
cmp dword [ebp - 0x62c], eax
jb 0x4309e0
cmp dword [ebp - 0x628], ecx
jb 0x430a07
ja 0x430946
cmp dword [ebp - 0x62c], eax
jbe 0x430a07
mov edi, edx
jmp 0x430a07
mov esi, 0x408
lea eax, [ebp - 0xddc]
push esi
push 0x2b4
push eax
push edi
push dword [ecx + 4]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x430a07
push esi
push 0x2b4
lea eax, [ebp - 0xb28]
push eax
push edi
push dword [ebx + 4]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x430a07
lea eax, [ebp - 0x914]
push eax
lea eax, [ebp - 0xbc8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov edi, eax
jmp 0x430a07
mov ecx, dword [ebp - 0x868]
mov eax, dword [ebp - 0x86c]
cmp dword [ebp - 0x638], ecx
jg 0x430946
jl 0x4309e0
cmp dword [ebp - 0x63c], eax
jb 0x4309e0
cmp dword [ebp - 0x638], ecx
jl 0x430a07
jg 0x430946
cmp dword [ebp - 0x63c], eax
jmp 0x430940
xor edi, edi
inc edi
jmp 0x430a07
or edi, 0xffffffff
jmp 0x430a07
mov eax, dword [ecx]
push dword [ebx + 8]
push dword [ecx + 8]
mov esi, dword [eax]
push edi
push eax
mov ecx, dword [esi + 0x1c]
call fcn.0054dd20
call dword [esi + 0x1c]
test eax, eax
jns 0x430a04
xor eax, eax
jmp 0x430a09
movsx edi, ax
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0054d4f5
mov esp, ebp
pop ebp
ret 0xc
call fcn.004146d9
int3

Function at 0x43136b
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, ecx
call fcn.00476cbe
call fcn.00416c13
cmp dword [eax + 0x14], 0
jne 0x431386
mov ecx, esi
pop esi
jmp fcn.0043067b
pop esi
ret
Function at 0x43fafd
Capabilities:
Get common file path

Disassembly:
push 0x78
mov eax, 0x5826e7
call fcn.0054dd5d
mov ebx, ecx
cmp dword [0x63ecb0], 0
je 0x43fc45
lea eax, [ebp - 0x14]
xor esi, esi
push eax
push esi
push esi
call sub.SHELL32.dll_SHGetSpecialFolderLocation
test eax, eax
jns 0x43fb30
xor eax, eax
jmp 0x43fc3f
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.SHELL32.dll_SHGetDesktopFolder]
test eax, eax
js 0x43fb29
push 0xc
push 0x40
mov dword [ebp - 0x40], 0x67
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x43fc45
mov eax, dword [ebp - 0x14]
mov dword [edi + 8], eax
push dword [ebp - 0x14]
mov ecx, dword [0x63ecb0]
call fcn.00476575
mov dword [edi], esi
lea ecx, [ebp - 0x10]
mov dword [edi + 4], eax
mov eax, dword [ebx]
push edi
push ecx
mov dword [ebp - 0x1c], edi
mov esi, dword [eax + 0x164]
mov ecx, esi
call fcn.0054dd20
mov ecx, ebx
call esi
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x10]
and dword [ebp - 4], 0
push dword [eax - 0xc]
call fcn.0041400d
mov dword [ebp - 0x30], eax
mov eax, dword [ebx]
push 0
push edi
mov esi, dword [eax + 0x168]
mov ecx, esi
call fcn.0054dd20
mov ecx, ebx
call esi
mov dword [ebp - 0x28], eax
mov eax, dword [ebx]
push 1
push edi
mov esi, dword [eax + 0x168]
mov ecx, esi
call fcn.0054dd20
mov ecx, ebx
call esi
push 0xa
pop ecx
mov dword [ebp - 0x24], eax
lea esi, [ebp - 0x40]
lea eax, [ebp - 0x84]
mov dword [ebp - 0x20], 1
push eax
push 0
push 0x1132
push dword [ebx + 0x20]
lea edi, [ebp - 0x7c]
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x80], 0xffff0002
mov dword [ebp - 0x84], 0xffff0000
call dword [sym.imp.USER32.dll_SendMessageW]
push eax
push 2
push 0x1102
push dword [ebx + 0x20]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 8]
mov ecx, esi
call fcn.0054dd20
call esi
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00404640
xor eax, eax
inc eax
call fcn.0054dd26
ret
call fcn.004146d9
int3

Function at 0x43fe95
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b8
mov eax, dword [0x636f58]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
test eax, eax
je 0x43fefb
push 0x208
push 0x2b4
lea ecx, [ebp - 0x2b8]
push ecx
push 0
push dword [eax + 4]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov ecx, esi
test eax, eax
je 0x43fede
lea eax, [ebp - 0x2ac]
push eax
jmp 0x43fee3
push 0x597868
call fcn.004137ad
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0054d4f5
mov esp, ebp
pop ebp
ret 8
call fcn.004146d9
int3
Function at 0x44f2b5
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
test esi, esi
jne 0x44f2ce
call fcn.00416bc5
mov esi, dword [eax + 0xc]
push 0x59991c
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x44f324
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x44f323
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
test eax, eax
jne 0x44f304
xor esi, esi
jmp 0x44f31a
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 8]
push eax
push dword [ebp - 4]
call fcn.0044f32c
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8