joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4012c7
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
call main
jmp 0x4f9e84
push 0x14
push 0x573d20
call fcn.00500bc0
call main
movzx esi, ax
push 2
call main
pop ecx
mov eax, 0x5a4d
cmp word [0x400000], ax
je 0x4f9eb2
xor ebx, ebx
jmp 0x4f9ee5
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x4f9eae
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x4f9eae
xor ebx, ebx
cmp dword [eax + 0x400074], 0xe
jbe 0x4f9ee5
cmp dword [eax + 0x4000e8], ebx
setne bl
mov dword [ebp - 0x1c], ebx
call fcn.00401890
test eax, eax
jne 0x4f9ef9
push 0x1c
call main
pop ecx
call fcn.00401968
test eax, eax
jne 0x4f9f0a
push 0x10
call main
pop ecx
call fcn.00402d57
and dword [ebp - 4], 0
call fcn.00402d89
test eax, eax
jns 0x4f9f24
push 0x1b
call main
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineW]
mov dword [0x5821a8], eax
call main
mov dword [0x5803c8], eax
call main
test eax, eax
jns 0x4f9f4a
push 8
call main
pop ecx
call fcn.004035fa
test eax, eax
jns 0x4f9f5b
push 9
call main
pop ecx
push 1
call main
pop ecx
test eax, eax
je 0x4f9f6e
push eax
call main
pop ecx
call fcn.004060e6
push esi
push eax
push 0
push 0x400000
call main
mov esi, eax
mov dword [ebp - 0x24], esi
test ebx, ebx
jne 0x4f9f90
push esi
call main
call fcn.00500a34
jmp 0x4f9fc5
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
call fcn.00500c05
ret

Function at 0x401cd0
Capabilities:
Parse pe header

Disassembly:
mov ecx, dword [ecx + 4]
mov eax, 0x5a4d
cmp word [ecx], ax
je 0x401ce0
xor al, al
ret
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x401cdd
mov ecx, 0xe0
cmp word [eax + 0x14], cx
jne 0x401cdd
mov ecx, 0x10b
cmp word [eax + 0x18], cx
sete al
ret

Function at 0x42e630
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
xor edi, edi
call dword [sym.imp.kernel32.dll_GetEnvironmentStringsW]
mov ebx, eax
test ebx, ebx
je 0x42e6cf
mov esi, ebx
cmp word [ebx], di
je 0x42e66f
lea esp, [esp]
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x42e655
sub eax, edx
sar eax, 1
lea esi, [esi + eax*2]
add esi, 2
cmp word [esi], di
jne 0x42e650
sub esi, ebx
add esi, 2
sar esi, 1
cmp esi, 0x3ffffffe
jb 0x42e684
pop edi
pop esi
xor eax, eax
pop ebx
ret
xor ecx, ecx
mov eax, esi
mov edx, 2
mul edx
push 0x57fece
seto cl
neg ecx
or ecx, eax
push ecx
call main
mov edi, eax
add esp, 8
test edi, edi
je 0x42e6c8
lea ecx, [esi + esi]
push ecx
push ebx
push ecx
push edi
call main
add esp, 0x10
test eax, eax
je 0x42e6c8
push edi
call fcn.0041d0a7
add esp, 4
xor edi, edi
push ebx
call dword [sym.imp.kernel32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0x440170
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x579630]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.004f9050
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.kernel32.dll_GetSystemDirectoryW]
dec eax
cmp eax, 0x101
ja 0x4401dc
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.kernel32.dll_SetCurrentDirectoryW]
test eax, eax
je 0x4401dc
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401590
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
call fcn.00401590
mov esp, ebp
pop ebp
ret
Function at 0x4686c0
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x579630]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts.pdfUserChoice
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x46870f
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts.pdfUserChoice
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 2
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts.pdf
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x468749
push str.Application
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401590
mov esp, ebp
pop ebp
ret

Function at 0x46bbc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x46bbcf
pop dword [ebp - 0x14]
mov eax, 0xbe21a0a4
sub eax, 0xbddae4d5
sub dword [ebp - 0x14], eax
push 0x40
push 0x1000
push 0x7fc74
push 0
mov eax, 0xde150bb5
sub eax, 0xddc2389d
add eax, dword [ebp - 0x14]
call dword [eax]
mov ecx, 0x3eb0
xor esi, esi
add esi, eax
mov edi, 0x2fc2e3ee
add edi, 0xd0a00e12
add edi, dword [ebp - 0x14]
mov ebx, 0x2d5697e1
add ebx, 0xecaa4654
xor dword [ebp - 8], 0x2bcc8e86
mov edx, dword [edi]
sub dword [ebp - 0xc], 0x83ce4943
xor edx, ebx
add dword [ebp - 4], edx
mov dword [esi], edx
add esi, 4
add edi, 0x93aa846
add edi, 0xf6c557be
loop 0x46bc2a
add eax, 0x59f3b722
sub eax, 0x59f2c98f
mov ebx, eax
add eax, 0x8582c70e
add eax, 0x7a7d38f7
mov ecx, 0xa5d7e1c7
sub ecx, 0xa597e1c7
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x48f4b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x524cbb
mov eax, dword fs:[0]
push eax
sub esp, 0x274
mov eax, dword [0x579630]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
call fcn.00404d00
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 8]
mov ecx, eax
call fcn.004164a0
test al, al
je 0x48f633
call fcn.00414330
mov edi, eax
test edi, edi
je 0x48f633
test esi, esi
je 0x48f633
cmp word [esi], 0
je 0x48f633
push esi
lea ecx, [ebp - 0x23c]
call main
push esi
mov dword [ebp - 4], 0
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
je 0x48f57c
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.kernel32.dll_GetCurrentDirectoryW]
dec eax
cmp eax, 0x102
ja 0x48f57c
push esi
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x48f57c
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x23c]
call main
mov eax, dword [ebp + 0x10]
lea ecx, [ebp - 0x224]
xorps xmm0, xmm0
mov dword [ebp - 0x21c], 0
push 0
movq qword [ebp - 0x278], xmm0
push edi
mov dword [ebp - 0x278], 0x208
mov dword [ebp - 0x274], eax
movq qword [ebp - 0x224], xmm0
call main
push 0x30
lea eax, [ebp - 0x26c]
mov dword [ebp - 0x270], 0
push 0
push eax
call fcn.004f9050
cmp dword [ebp - 0x228], 8
lea eax, [ebp - 0x23c]
mov dword [ebp - 0x280], ebx
cmovae eax, dword [ebp - 0x23c]
mov dword [ebp - 0x27c], eax
lea eax, [ebp - 0x270]
push eax
lea eax, [ebp - 0x278]
push eax
lea eax, [ebp - 0x27c]
push eax
lea eax, [ebp - 0x280]
push eax
lea eax, [ebp - 0x224]
push 0xfe
push eax
call main
add esp, 0x24
lea ecx, [ebp - 0x23c]
test eax, eax
je 0x48f653
call fcn.004087d0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00401590
mov esp, ebp
pop ebp
ret 0xc
call fcn.004087d0
mov eax, 1
jmp 0x48f635

Function at 0x493b80
Capabilities:
Delete file

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 4]
test eax, eax
je 0x493b9b
push eax
call dword [sym.imp.GDI32.dll_CloseEnhMetaFile]
mov dword [esi + 8], eax
mov dword [esi + 4], 0
mov eax, dword [esi + 8]
test eax, eax
je 0x493bb0
push eax
call dword [sym.imp.GDI32.dll_DeleteEnhMetaFile]
mov dword [esi + 8], 0
cmp dword [esi + 0x1c], 0
je 0x493be9
cmp dword [esi + 0x20], 8
push edi
lea edi, [esi + 0xc]
jb 0x493bc4
mov eax, dword [edi]
jmp 0x493bc6
mov eax, edi
push eax
call dword [sym.imp.kernel32.dll_DeleteFileW]
cmp dword [edi + 0x14], 8
mov dword [edi + 0x10], 0
jb 0x493bdc
mov edi, dword [edi]
xor eax, eax
mov word [edi], ax
pop edi
mov dword [esi + 0x24], eax
mov dword [esi], eax
pop esi
ret
mov dword [esi + 0x24], 0
mov dword [esi], 0
pop esi
ret
Function at 0x49d820
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
mov eax, dword [0x579630]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0
push 2
push 6
xor bl, bl
mov dword [ebp - 0x21c], 0
call main
add esp, 0xc
test al, al
je 0x49da9c
cmp dword [0x57fcb4], 0
jne 0x49da9c
lea eax, [ebp - 0x228]
mov dword [ebp - 0x228], 0
push eax
push 1
push 0
push str.4075174
call main
add esp, 0x10
movzx eax, ax
cmp word [ebp - 0x228], 0
je 0x49d971
xor eax, eax
mov dword [ebp - 0x220], 0
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.004f9050
push str.SoftwareAdobeAdobe_AcrobatDCFeatureState
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x210], 0
push 0x104
push eax
mov dword [ebp - 0x214], 0
mov esi, 1
mov dword [ebp - 0x218], 4
call main
add esp, 0x18
lea eax, [ebp - 0x220]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x20c]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x49d96e
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x210]
push eax
push 0
push str.4075174
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x49d962
cmp dword [ebp - 0x210], 4
jne 0x49d962
cmp dword [ebp - 0x214], eax
setne al
mov dword [ebp - 0x22c], eax
mov esi, eax
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, si
test ax, ax
je 0x49da9c
push str.mmdevapi.dll
call main
add esp, 4
mov dword [0x57fcb4], eax
test eax, eax
je 0x49da9c
push 0x57fcb4
push str.mmdevapi.dll
push 1
call dword [sym.imp.kernel32.dll_GetModuleHandleExW]
test eax, eax
je 0x49da9c
cmp dword [0x57fcb4], 0
je 0x49da9c
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [ebp - 0x21c]
push eax
push 0x548490
push 3
push 0
push 0x548480
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x49da9c
mov esi, dword [ebp - 0x21c]
test esi, esi
je 0x49daac
push dword [0x57fcb4]
mov esi, dword [esi]
push esi
call main
add esp, 8
test al, al
je 0x49da9c
push dword [0x57fcb4]
lea eax, [esi + 0x20]
push eax
call main
add esp, 8
test al, al
je 0x49da9c
push edi
push dword [0x57fcb4]
lea edi, [esi + 0x18]
push dword [edi]
call main
add esp, 8
test al, al
je 0x49da9b
push dword [0x57fcb4]
add esi, 0x1c
push dword [esi]
call main
add esp, 8
test al, al
je 0x49da9b
push 4
lea eax, [ebp - 0x224]
mov dword [ebp - 0x224], method.acrobat_broker::SandboxBrokerClientImpl.virtual_84
push eax
push edi
call main
add esp, 0xc
test al, al
je 0x49da9b
push 4
lea eax, [ebp - 0x224]
mov dword [ebp - 0x224], method.acrobat_broker::SandboxBrokerClientImpl.virtual_84
push eax
push esi
call main
add esp, 0xc
movzx ebx, bl
test al, al
mov ecx, 1
cmovne ebx, ecx
pop edi
mov ecx, dword [ebp - 0x21c]
test ecx, ecx
je 0x49daac
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [ebp - 4]
mov al, bl
pop esi
xor ecx, ebp
pop ebx
call fcn.00401590
mov esp, ebp
pop ebp
ret
Function at 0x4cd190
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x78], 0
je 0x4cd1bc
cmp dword [esi + 0x7c], 0
je 0x4cd1bc
cmp dword [esi + 0x80], 0
je 0x4cd1bc
cmp dword [esi + 0x84], 0
je 0x4cd1bc
cmp dword [esi + 0x88], 0
jne 0x4cd22f
push str.prntvpt.dll
call main
mov edi, eax
add esp, 4
test edi, edi
jne 0x4cd1d5
pop edi
pop esi
xor al, al
pop ebx
ret
mov ebx, dword [sym.imp.kernel32.dll_GetProcAddress]
push str.PTOpenProvider
push edi
call ebx
mov dword [esi + 0x78], eax
test eax, eax
je 0x4cd1cf
push str.PTConvertDevModeToPrintTicket
push edi
call ebx
mov dword [esi + 0x7c], eax
test eax, eax
je 0x4cd1cf
push str.PTCloseProvider
push edi
call ebx
mov dword [esi + 0x80], eax
test eax, eax
je 0x4cd1cf
push str.PTConvertPrintTicketToDevMode
push edi
call ebx
mov dword [esi + 0x84], eax
test eax, eax
je 0x4cd1cf
push str.PTReleaseMemory
push edi
call ebx
mov dword [esi + 0x88], eax
test eax, eax
je 0x4cd1cf
pop edi
pop esi
mov al, 1
pop ebx
ret
Function at 0x4ceff0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x529038
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x579630]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov ecx, dword [ebp + 8]
cmp ecx, 0xffffffff
jne 0x4cf02c
xor eax, eax
jmp 0x4cf1bc
mov eax, dword [ebx + 0x20]
mov edx, dword [eax]
test edx, edx
je 0x4cf05a
mov esi, dword [ebx + 0x30]
mov edi, dword [esi]
lea eax, [edi + edx]
cmp edx, eax
jae 0x4cf05a
lea eax, [edi - 1]
mov dword [esi], eax
mov ecx, dword [ebx + 0x20]
mov edx, dword [ecx]
lea eax, [edx + 1]
mov dword [ecx], eax
mov eax, dword [ebp + 8]
mov byte [edx], al
jmp 0x4cf1bc
cmp dword [ebx + 0x50], 0
jne 0x4cf068
or eax, 0xffffffff
jmp 0x4cf1bc
mov esi, dword [ebx + 0xc]
lea eax, [ebx + 0x44]
cmp dword [esi], eax
jne 0x4cf089
mov ecx, dword [ebx + 0x38]
mov edx, dword [ebx + 0x3c]
mov dword [esi], ecx
sub edx, ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebx + 0x2c]
mov ecx, dword [ebp + 8]
mov dword [eax], edx
cmp dword [ebx + 0x40], 0
jne 0x4cf0ae
push dword [ebx + 0x50]
movsx eax, cl
push eax
call fcn.004fc544
or ecx, 0xffffffff
add esp, 8
cmp eax, ecx
cmovne ecx, dword [ebp + 8]
mov eax, ecx
jmp 0x4cf1bc
mov byte [ebp - 0x14], cl
lea eax, [ebp - 0x2c]
mov ecx, 0xf
mov byte [ebp - 0x2c], 0
xorps xmm0, xmm0
mov dword [ebp - 0x18], ecx
cmp ecx, 0x10
movq qword [ebp - 0x2c], xmm0
mov dword [ebp - 0x1c], 8
cmovae eax, dword [ebp - 0x2c]
mov byte [eax + 8], 0
mov dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x30]
mov esi, dword [ebx + 0x40]
lea ecx, [ebp - 0x2c]
cmovae ecx, dword [ebp - 0x2c]
lea edx, [ebp - 0x2c]
cmovae edx, dword [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x1c]
mov edi, dword [esi]
add eax, ecx
push eax
push edx
lea eax, [ebp - 0x34]
mov ecx, esi
push eax
lea eax, [ebp - 0x13]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebx + 0x48]
push eax
call dword [edi + 0x1c]
test eax, eax
js 0x4cf1a6
cmp eax, 1
jg 0x4cf186
mov edi, dword [ebp - 0x18]
lea eax, [ebp - 0x2c]
mov ecx, dword [ebp - 0x2c]
cmp edi, 0x10
mov esi, dword [ebp - 0x30]
cmovae eax, ecx
sub esi, eax
je 0x4cf157
push dword [ebx + 0x50]
cmp edi, 0x10
lea eax, [ebp - 0x2c]
push esi
cmovae eax, ecx
push 1
push eax
call fcn.004fc90e
add esp, 0x10
cmp esi, eax
jne 0x4cf1a6
lea eax, [ebp - 0x14]
mov byte [ebx + 0x45], 1
cmp dword [ebp - 0x34], eax
jne 0x4cf181
test esi, esi
jne 0x4cf0e1
cmp dword [ebp - 0x1c], 0x20
jae 0x4cf1a6
push esi
push 8
lea ecx, [ebp - 0x2c]
call main
jmp 0x4cf0e1
mov ebx, dword [ebp + 8]
jmp 0x4cf1a9
cmp eax, 3
jne 0x4cf1a6
push dword [ebx + 0x50]
push dword [ebp - 0x14]
call main
or ecx, 0xffffffff
add esp, 8
test al, al
cmovne ecx, dword [ebp + 8]
mov ebx, ecx
jmp 0x4cf1a9
or ebx, 0xffffffff
cmp dword [ebp - 0x18], 0x10
jb 0x4cf1ba
push dword [ebp - 0x2c]
call fcn.004085be
add esp, 4
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00401590
mov esp, ebp
pop ebp
ret 4
Function at 0x4edfb0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x579630]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov edi, ecx
push 5
push dword [edi + 0xcc]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [edi + 0xcc]
call dword [sym.imp.USER32.dll_UpdateWindow]
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 5
push dword [edi + 0xcc]
call ebx
push 0
push 0
push 7
push dword [edi + 0xcc]
call ebx
cmp byte [ebp + 8], 0
je 0x4ee012
push dword [edi + 0xcc]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov eax, dword [0x57da28]
test eax, eax
jne 0x4ee02f
pop edi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401590
mov esp, ebp
pop ebp
ret 4
cmp byte [edi + 0xc2], 0
mov dword [ebp - 0x24], eax
je 0x4ee103
mov ebx, dword [sym.imp.USER32.dll_PeekMessageW]
push esi
push 0x4ff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x24]
push eax
push 1
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
cmp eax, 1
ja 0x4ee102
test eax, eax
je 0x4ee0f8
cmp eax, 1
jne 0x4ee0e4
push 3
push 0
push 0
push 0
lea eax, [ebp - 0x20]
push eax
call ebx
test eax, eax
je 0x4ee0e9
mov esi, dword [edi + 4]
test esi, esi
je 0x4ee0bc
call dword [sym.imp.USER32.dll_GetFocus]
mov ecx, dword [esi + 0x24]
cmp ecx, eax
je 0x4ee0a3
push eax
push ecx
call dword [sym.imp.USER32.dll_IsChild]
test eax, eax
je 0x4ee0bc
lea eax, [ebp - 0x20]
push eax
push 0
push 0x37f
push dword [esi + 0x24]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 1
je 0x4ee0d0
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push 3
push 0
push 0
push 0
lea eax, [ebp - 0x20]
push eax
call ebx
test eax, eax
jne 0x4ee083
jmp 0x4ee0e9
cmp eax, 0xffffffff
je 0x4ee0f8
cmp byte [edi + 0xc2], 0
jne 0x4ee046
jmp 0x4ee102
mov dword [edi + 0xbc], 2
pop esi
mov ecx, dword [ebp - 4]
xor eax, eax
cmp dword [edi + 0xbc], 1
pop edi
sete al
xor ecx, ebp
pop ebx
call fcn.00401590
mov esp, ebp
pop ebp
ret 4
Function at 0x4f0c80
Capabilities:
Check for time delay via gettickcount
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x579630]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push 0x7f02
push 0
mov ebx, ecx
call dword [sym.imp.USER32.dll_LoadCursorW]
mov dword [ebp - 0x28], eax
test eax, eax
je 0x4f0cb0
push eax
call dword [sym.imp.USER32.dll_SetCursor]
jmp 0x4f0cb2
xor eax, eax
push esi
push edi
push 0
push dword [ebx + 0xcc]
mov dword [ebp - 0x24], eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov esi, dword [sym.imp.kernel32.dll_GetTickCount]
call esi
cmp byte [ebx + 0xc2], 0
mov edi, eax
je 0x4f0d1f
push 0
push 0
push 0
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x4f0d1f
call esi
call esi
sub eax, edi
cmp eax, 0x493e0
ja 0x4f0d1f
push dword [ebp - 0x28]
call dword [sym.imp.USER32.dll_SetCursor]
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
cmp byte [ebx + 0xc2], 0
jne 0x4f0cd8
mov eax, dword [ebp - 0x24]
pop edi
pop esi
test eax, eax
je 0x4f0d2f
push eax
call dword [sym.imp.USER32.dll_SetCursor]
mov ecx, dword [ebp - 4]
xor eax, eax
cmp dword [ebx + 0xbc], 1
pop ebx
sete al
xor ecx, ebp
call fcn.00401590
mov esp, ebp
pop ebp
ret
Function at 0x411881
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x78], ebx
test ebx, 0xffff0000
jne 0x4118a5
cmp dword [edi + 0x74], 0
jne 0x4118a5
movzx eax, bx
mov dword [edi + 0x74], eax
call fcn.00415a12
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.00411842
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x414fb6
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push esi
mov esi, ecx
call fcn.0041a552
call fcn.0040f0fa
cmp eax, esi
pop esi
jne 0x414fd2
mov ecx, 0x57dfb0
jmp fcn.00420c9a
ret

Function at 0x41bfbf
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x41c006
call fcn.00415a12
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x41c006
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x41c022
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.0041babf
mov esi, eax
test edi, edi
je 0x41c020
test ebx, ebx
je 0x41c020
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x41c42b
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x523884
call fcn.00505091
mov esi, ecx
cmp dword [esi + 0x6c], 0
jne 0x41c450
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x41c4a2
call fcn.0040e354
push eax
lea ecx, [ebp - 0x10]
call fcn.00407950
mov ecx, dword [esi + 0x6c]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00504be0
push eax
call fcn.0040b410
add esp, 0x14
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00407980
mov eax, esi
call fcn.00505169
ret 8