joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42fe92
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, ecx
lea eax, [ebp - 4]
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x42febc
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x42fec2
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
pop esi
leave
ret
lea ecx, [esi + 0xc]
call fcn.00403de0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push eax
call fcn.004338b9
int3

Function at 0x43019d
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 0xc], 0
push esi
mov esi, ecx
jne 0x4301ae
xor eax, eax
jmp 0x4301ca
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4301cf
mov eax, dword [ebp - 4]
pop esi
leave
ret 8
lea ecx, [esi + 0xc]
call fcn.00403de0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push eax
call fcn.004338b9
int3

Function at 0x43026d
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, ecx
push 0
push dword [ebp + 0xc]
mov eax, dword [edi]
push dword [ebp + 8]
mov esi, dword [eax + 0x2c]
mov ecx, esi
call dword [0x59d9f8]
mov ecx, edi
call esi
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x4302a0
pop edi
pop esi
pop ebp
ret 8
lea ecx, [edi + 0xc]
call fcn.00403de0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push eax
call fcn.004338b9
int3

Function at 0x430374
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, ecx
test esi, esi
je 0x43039f
push 0
lea eax, [ebp - 4]
push eax
push esi
push dword [ebp + 8]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4303a5
cmp dword [ebp - 4], esi
jne 0x4303bc
pop edi
pop esi
leave
ret 8
lea ecx, [edi + 0xc]
call fcn.00403de0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push eax
call fcn.004338b9
lea ecx, [edi + 0xc]
call fcn.00403de0
push eax
push 0xffffffffffffffff
push 0xd
call fcn.0043350f
int3
Function at 0x4311e1
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push 0x10
mov eax, 0x58e839
call fcn.005626a5
mov ebx, ecx
mov dword [ebp - 0x18], ebx
lea eax, [ebx + 0x1c]
push eax
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [ebp + 8]
test edi, edi
jle 0x4312d8
cmp edi, dword [ebx + 0xc]
jge 0x4312d8
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
je 0x431238
cmp edi, dword [esi + 8]
jl 0x4312c6
cmp dword [ebp + 0xc], 0
je 0x4312c6
xor edi, edi
jmp 0x43126a
xor edi, edi
push 0x10
mov dword [ebp - 4], edi
call fcn.00430e19
mov esi, eax
test esi, esi
je 0x431252
mov dword [esi], vtable.CThreadData.0
jmp 0x431254
mov esi, edi
or dword [ebp - 4], 0xffffffff
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0x14]
mov dword [esi + eax], ecx
mov dword [ebx + 0x14], esi
push 4
push dword [ebx + 0xc]
call fcn.0042f2f4
cmp dword [esi + 0xc], 0
pop ecx
pop ecx
jne 0x431286
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
jmp 0x431292
push 2
push eax
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
mov edx, eax
test edx, edx
je 0x4312ff
mov ecx, dword [esi + 8]
mov dword [esi + 0xc], edx
mov eax, dword [ebx + 0xc]
sub eax, ecx
shl eax, 2
push eax
lea eax, [edx + ecx*4]
push edi
push eax
call fcn.005640c0
mov eax, dword [ebx + 0xc]
add esp, 0xc
mov dword [esi + 8], eax
push esi
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov edi, dword [ebp + 8]
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x4312d8
cmp edi, dword [esi + 8]
jge 0x4312d8
mov eax, dword [ebp + 0xc]
mov dword [ecx + edi*4], eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.0056260a
ret 8
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.0042df9e
int3
Function at 0x433b26
Capabilities:
Get file attributes
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x5f0e24]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
push 0x128
xor edi, edi
push edi
push esi
call fcn.005640c0
push 0xffffffffffffffff
push dword [ebx + 0xc]
lea eax, [esi + 0x24]
push 0x104
push eax
call fcn.00574469
push eax
call fcn.0042df5a
mov eax, dword [ebx + 4]
add esp, 0x20
cmp eax, dword [0x5a1a04]
je 0x433c84
lea ecx, [ebp - 0x48]
push ecx
lea ecx, [ebp - 0x40]
push ecx
lea ecx, [ebp - 0x38]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
je 0x433c98
lea eax, [ebp - 0x30]
push eax
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x433c98
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x2c]
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], ecx
mov eax, dword [ebx + 0xc]
cmp dword [eax - 0xc], edi
je 0x433be2
mov ecx, dword [ebx + 0x10]
test ecx, ecx
je 0x433bd6
lea edx, [ebp - 0x28]
push edx
push edi
push eax
call fcn.004338d7
neg eax
sbb eax, eax
and eax, dword [ebp - 0x28]
jmp 0x433bdd
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x433be4
mov eax, edi
mov ecx, esi
mov dword [ecx + 0x20], eax
lea eax, [ebp - 0x38]
push eax
call fcn.00430d44
test eax, eax
je 0x433c0b
push 0xffffffffffffffff
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x50]
call fcn.00430bcb
mov ecx, dword [eax]
mov eax, dword [eax + 4]
jmp 0x433c0f
mov ecx, edi
mov eax, edi
mov dword [esi], ecx
mov dword [esi + 4], eax
lea eax, [ebp - 0x40]
push eax
call fcn.00430d44
test eax, eax
je 0x433c36
push 0xffffffffffffffff
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x50]
call fcn.00430bcb
mov ecx, dword [eax]
mov eax, dword [eax + 4]
jmp 0x433c3a
mov ecx, edi
mov eax, edi
mov dword [esi + 0x10], ecx
mov dword [esi + 0x14], eax
lea eax, [ebp - 0x48]
push eax
call fcn.00430d44
test eax, eax
je 0x433c62
push 0xffffffffffffffff
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x50]
call fcn.00430bcb
mov edi, dword [eax]
mov ecx, dword [eax + 4]
jmp 0x433c64
mov ecx, edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], ecx
mov eax, dword [esi]
or eax, dword [esi + 4]
jne 0x433c76
mov dword [esi], edi
mov dword [esi + 4], ecx
mov eax, dword [esi + 0x10]
or eax, dword [esi + 0x14]
jne 0x433c84
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], ecx
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00561e7d
leave
ret 4
xor eax, eax
jmp 0x433c87
Function at 0x435437
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
mov ecx, dword [esi + 4]
call fcn.00435942
push 0xfffffffffffffff0
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowLongA]
push dword [ebp + 0xc]
and eax, 3
mov ecx, esi
cmp al, 3
je 0x435473
call fcn.00435654
mov dword [esi + 0xc], 1
jmp 0x435478
call fcn.00435654
cmp dword [esi], 0
je 0x4354c3
push edi
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov esi, dword [ebp + 0x10]
mov edi, eax
mov ecx, esi
test edi, edi
jle 0x43549e
push edi
call fcn.0042f7f4
lea ecx, [edi + 1]
push ecx
jmp 0x4354ad
push 0xff
call fcn.00403f70
push 0x100
push eax
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0xffffffffffffffff
mov ecx, esi
call fcn.0042f817
pop edi
jmp 0x4354e7
mov esi, dword [ebp + 0x10]
push dword [esi]
push 0xffffffffffffffff
push 0x14d
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 0xffffffff
jne 0x4354e7
push dword [esi]
push dword [ebp - 4]
call fcn.00434ba5
pop esi
leave
ret 0xc

Function at 0x4355ab
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
push edi
push dword [ebp + 0xc]
call fcn.00435654
cmp dword [esi], 0
mov edi, eax
mov dword [esi + 0xc], 1
je 0x4355f3
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.0042f7f4
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.0042f817
jmp 0x4355fe
mov eax, dword [ebp + 0x10]
push dword [eax]
push edi
call fcn.00434ba5
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x4359fc
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x58e793
call fcn.0056263c
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x74], ebx
jne 0x435a22
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x435a7c
lea ecx, [ebp - 0x10]
call fcn.0040abf0
mov edi, dword [edi + 0x74]
lea ecx, [ebp - 0x10]
push ecx
mov dword [ebp - 4], ebx
mov eax, dword [edi]
mov esi, dword [eax + 0x8c]
mov ecx, esi
call dword [0x59d9f8]
mov ecx, edi
call esi
mov esi, dword [ebp + 8]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push esi
call fcn.00574469
push eax
call fcn.0042df5a
add esp, 0x14
test esi, esi
je 0x435a6f
push esi
call fcn.005744f0
pop ecx
mov ebx, eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.004023d0
mov eax, ebx
call fcn.0056260a
ret 8
Function at 0x439e31
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
xor esi, esi
mov ebx, ecx
push edi
cmp dword [ebp + 8], esi
je 0x439e70
call fcn.004316c6
push 0xf0
push dword [ebp + 8]
mov edi, dword [eax + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x439e70
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x439e78
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
push esi
mov ecx, ebx
call fcn.004412cf
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x43a87d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
je 0x43a909
cmp dword [esi + 0x20], 0
je 0x43a909
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x43a909
cmp dword [ebp + 8], 0
je 0x43a909
xor edi, edi
mov ebx, edi
call fcn.004316c6
push str.AFX_DIALOG_LAYOUT
push dword [ebp + 8]
mov eax, dword [eax + 0xc]
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 8], eax
test eax, eax
je 0x43a8ed
mov ebx, dword [ebp - 4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp - 8]
mov edi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x43a909
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
push edi
push ebx
push esi
call fcn.00441e52
mov edi, eax
add esp, 0xc
test edi, edi
je 0x43a905
mov ecx, esi
call fcn.0043a61b
mov eax, edi
jmp 0x43a90b
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x4429d2
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x84], 0
mov esi, dword [ebx + 0x8c]
mov edi, dword [ebx + 0x88]
je 0x442a1a
call fcn.004316c6
push 5
push dword [ebx + 0x84]
mov eax, dword [eax + 0xc]
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x442a1a
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x442a27
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
xor eax, eax
inc eax
test esi, esi
je 0x442a63
mov edx, 0xffff
lea ecx, [esi + 0xc]
cmp word [esi + 2], dx
jne 0x442a46
movzx edi, word [esi + 0x12]
movzx edx, word [esi + 0x14]
jmp 0x442a4f
movzx edx, word [ecx]
mov ecx, esi
movzx edi, word [esi + 0xa]
test dword [ecx], 0x1801
jne 0x442a61
test di, di
jne 0x442a61
test dx, dx
je 0x442a63
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x442a68
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
mov dword [esi + 0x84], edi
test edi, 0xffff0000
jne 0x442a93
cmp dword [esi + 0x80], 0
jne 0x442a93
movzx eax, di
mov dword [esi + 0x80], eax
call fcn.004316c6
push 5
push edi
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x442ac3
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x442ac3
push ebx
push dword [ebp + 0xc]
mov ecx, esi
push eax
call fcn.00442d2a
jmp 0x442ac5
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x442acc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, ecx
call fcn.004316c6
push 5
push dword [ebp + 8]
mov esi, dword [eax + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x442b0c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x442b0c
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push dword [ebp + 0xc]
mov ecx, edi
push eax
call fcn.00442b14
jmp 0x442b0e
xor eax, eax
pop edi
pop esi
pop ebp
ret 8
Function at 0x442dff
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x24
mov eax, 0x58f21c
call fcn.005626a5
mov edi, ecx
mov dword [ebp - 0x24], edi
mov ebx, dword [edi + 0x8c]
mov esi, dword [edi + 0x88]
mov dword [ebp - 0x18], ebx
call fcn.004316c6
cmp dword [edi + 0x84], 0
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x20], eax
je 0x442e5e
call fcn.004316c6
push 5
push dword [edi + 0x84]
mov ebx, dword [eax + 0xc]
push ebx
mov dword [ebp - 0x20], ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x442e72
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, dword [ebp - 0x18]
mov esi, eax
test esi, esi
je 0x442e6e
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov dword [ebp - 0x18], eax
test ebx, ebx
jne 0x442e7a
or eax, 0xffffffff
jmp 0x442fcc
mov ecx, edi
call fcn.0044340c
mov ebx, eax
mov dword [ebp - 0x2c], ebx
call fcn.00438b25
xor esi, esi
and dword [ebp - 0x1c], esi
and dword [ebp - 0x28], esi
mov dword [ebp - 0x14], esi
test ebx, ebx
je 0x442f06
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp ebx, eax
je 0x442f06
push ebx
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x442f06
push esi
push ebx
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [ebp - 0x14], 1
call fcn.004317d0
mov esi, eax
mov dword [ebp - 0x1c], esi
test esi, esi
je 0x442f03
mov ecx, dword [esi]
mov esi, dword [ecx + 0x150]
mov ecx, esi
call dword [0x59d9f8]
mov ecx, dword [ebp - 0x1c]
call esi
test eax, eax
je 0x442f03
mov esi, dword [ebp - 0x1c]
mov ecx, esi
call fcn.00435ac7
test eax, eax
je 0x442f03
push 0
mov ecx, esi
call fcn.0043589a
mov dword [ebp - 0x28], 1
mov esi, dword [ebp - 0x14]
and dword [ebp - 4], 0
push edi
call fcn.004387f2
push ebx
call fcn.00439e9e
push dword [ebp - 0x20]
mov ecx, edi
push eax
push dword [ebp - 0x18]
call fcn.00442da2
test eax, eax
jne 0x442f4f
cmp dword [edi + 0x9c], eax
jne 0x442f4f
call fcn.004316c6
push ebx
mov eax, dword [eax + 8]
mov dword [ebp - 0x20], eax
call fcn.00439e9e
push dword [ebp - 0x20]
mov ecx, edi
push eax
push dword [ebp - 0x18]
call fcn.00442da2
and dword [edi + 0x9c], 0
jmp 0x442f7a
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x28], 0
je 0x442f8e
mov ecx, dword [ebp - 0x1c]
push 1
call fcn.0043589a
test esi, esi
je 0x442f9b
push 1
push ebx
call dword [sym.imp.USER32.dll_EnableWindow]
test ebx, ebx
je 0x442fb1
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [edi + 0x20]
jne 0x442fb1
push ebx
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [edi]
mov esi, dword [eax + 0x60]
mov ecx, esi
call dword [0x59d9f8]
mov ecx, edi
call esi
mov ecx, edi
call fcn.004433c3
mov eax, dword [edi + 0x68]
call fcn.0056260a
ret
Function at 0x444c8f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
mov dword [ebp - 4], ebx
test byte [edi + 4], 1
mov esi, dword [edi + 0xc]
jne 0x444ce5
push 5
push esi
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
jne 0x444cbe
call fcn.00436978
push esi
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
jne 0x444cd3
call fcn.00436978
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x444ce5
call fcn.00436978
call fcn.004316c6
cmp dword [eax + 0x3c], 0
je 0x444cfa
push esi
mov ecx, ebx
call fcn.004443b5
mov esi, eax
push dword [ebp + 0xc]
push esi
call fcn.00444ee0
mov ebx, eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x88]
test ecx, ecx
je 0x444d23
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 4]
and dword [eax + 0x88], 0
test ebx, ebx
je 0x444d2f
mov esi, ebx
mov dword [eax + 0x88], ebx
or dword [edi + 4], 1
mov dword [edi + 0xc], esi
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x449079
Capabilities:
Extract resource via kernel32 functions
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x4491bf
mov ecx, 0x5f031c
call fcn.00431054
mov esi, eax
test esi, esi
je 0x4491b4
xor eax, eax
cmp word [esi + 8], ax
jne 0x44917e
push str.comctl32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ebx, eax
test ebx, ebx
je 0x44913a
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov edi, dword [ebp + 0x10]
mov ecx, 0x3ff
and ax, cx
cmp ax, 0x11
jne 0x449100
push str.MS_UI_Gothic
call fcn.004491fd
pop ecx
test eax, eax
je 0x449100
mov eax, edi
neg eax
push 0xfc11
sbb eax, eax
and eax, 0xe
add eax, 0x3ee
push eax
push 5
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
test eax, eax
jne 0x44911b
neg edi
push 5
sbb edi, edi
and edi, 0xe
add edi, 0x3ee
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x44913a
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
test eax, eax
je 0x449140
push ebx
push edi
push eax
call fcn.00448be9
add esp, 0xc
jmp 0x449140
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov eax, dword [edi]
push 1
mov eax, dword [eax - 0xc]
inc eax
push eax
call fcn.0042f2f4
pop ecx
pop ecx
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ecx, eax
mov dword [esi + 4], ecx
test ecx, ecx
je 0x4491b9
mov eax, dword [edi]
push eax
mov eax, dword [eax - 0xc]
inc eax
push eax
push ecx
call fcn.004305d6
mov ax, word [ebx]
add esp, 0xc
mov word [esi + 8], ax
xor eax, eax
jmp 0x449181
mov ebx, dword [ebp + 0xc]
mov edi, dword [esi + 4]
test edi, edi
je 0x44918f
push edi
call fcn.005744f0
pop ecx
mov ecx, dword [ebp + 8]
push eax
push edi
call fcn.00404280
movzx ecx, word [esi + 8]
mov edx, 0xffff
xor eax, eax
mov word [ebx], cx
pop edi
cmp cx, dx
pop esi
setne al
pop ebx
pop ebp
ret 0xc
call fcn.0042df84
call fcn.0042df9e
int3
Function at 0x4587f1
Capabilities:
Get file system object information

Disassembly:
push 0x398
mov eax, 0x59038e
call fcn.0056266f
mov ebx, ecx
mov ecx, dword [ebp + 0x14]
xor esi, esi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x3a0], edi
test ecx, ecx
je 0x458982
mov eax, dword [ebp + 0x10]
sub eax, esi
je 0x458954
sub eax, 1
je 0x458870
sub eax, 1
je 0x458848
sub eax, 1
je 0x458870
push 0x5d0779
mov ecx, edi
call fcn.00403d40
mov eax, edi
call fcn.0056261e
ret 0x10
push 0x408
push 0x160
lea eax, [ebp - 0x39c]
push eax
push esi
push dword [ecx + 4]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
test eax, eax
je 0x458832
lea eax, [ebp - 0x28c]
push eax
jmp 0x458837
lea eax, [ebp - 0x114]
push eax
push dword [ecx + 4]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
test eax, eax
je 0x458832
push esi
lea eax, [ebp - 0x23c]
mov dword [ebp - 0x23c], esi
push eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x238], esi
push eax
mov dword [ebp - 0x234], esi
mov dword [ebp - 0x230], esi
mov dword [ebp - 0x22c], esi
mov dword [ebp - 0x228], esi
call fcn.00433c9c
test eax, eax
je 0x458832
lea ecx, [ebp - 0x3a0]
call fcn.0040abf0
cmp dword [ebp + 0x10], 1
mov dword [ebp - 4], esi
jne 0x45890a
test byte [ebp - 0x21c], 0x18
jne 0x45892c
mov eax, dword [ebx]
lea ecx, [ebp - 0x3a0]
push ecx
push dword [ebp - 0x220]
mov esi, dword [eax + 0x1a0]
mov ecx, esi
push dword [ebp - 0x224]
call dword [0x59d9f8]
mov ecx, ebx
call esi
jmp 0x45892c
mov eax, dword [ebx]
lea ecx, [ebp - 0x3a0]
push ecx
lea ecx, [ebp - 0x234]
push ecx
mov esi, dword [eax + 0x1a4]
mov ecx, esi
call dword [0x59d9f8]
mov ecx, ebx
call esi
mov eax, dword [ebp - 0x3a0]
add eax, 0xfffffff0
push eax
call fcn.00404160
pop ecx
mov ecx, dword [ebp - 0x3a0]
add eax, 0x10
mov dword [edi], eax
lea ecx, [ecx - 0x10]
call fcn.004023d0
jmp 0x45883e
push 0x208
push 0x160
lea eax, [ebp - 0x39c]
push eax
push esi
push dword [ecx + 4]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
test eax, eax
je 0x458832
lea eax, [ebp - 0x390]
jmp 0x45886d
call fcn.0042df84
int3

Function at 0x458afa
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, ecx
call fcn.004a8b29
call fcn.00431714
cmp dword [eax + 0x14], 0
jne 0x458b15
mov ecx, esi
pop esi
jmp fcn.00457dfe
pop esi
ret

Function at 0x459490
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x16c
mov eax, dword [0x5f0e24]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x168], esi
test eax, eax
je 0x4594fa
push 0x208
push 0x160
lea ecx, [ebp - 0x164]
push ecx
push 0
push dword [eax + 4]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
mov ecx, esi
test eax, eax
je 0x4594df
lea eax, [ebp - 0x158]
push eax
jmp 0x4594e4
push 0x5a8a10
call fcn.00403d40
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00561e7d
leave
ret 8
call fcn.0042df84
int3

Function at 0x4599df
Capabilities:
Get common file path
Get file system object information

Disassembly:
push esi
mov esi, ecx
call fcn.00403a20
call fcn.00431714
cmp dword [eax + 0x14], 0
jne 0x4599fa
mov ecx, esi
pop esi
jmp fcn.0045923a
pop esi
ret
Function at 0x46294e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
push edi
test esi, esi
jne 0x462967
call fcn.004316c6
mov esi, dword [eax + 0xc]
push 0x5a9f78
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
je 0x4629a9
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4629a9
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x4629a9
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 4]
push eax
push ebx
call fcn.004629b2
jmp 0x4629ab
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8