joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41a22f
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
shr esi, 2
mov eax, esi
shr eax, 1
add eax, 3
mov dword [ecx], eax
add ecx, 0x10
xor eax, eax
push edi
mov dword [ebp - 4], 1
test esi, esi
jbe 0x41a263
mov edi, dword [edx]
mov dword [ecx + eax*4], edi
inc eax
add edx, 4
cmp eax, esi
jb 0x41a256
mov eax, dword [ecx + esi*4 - 4]
mov edx, esi
imul edx, edx, 0xc
and dword [ebp + 8], 0
lea edx, [edx + ecx + 0x70]
mov dword [ebp - 8], edx
mov edx, 0xff
cmp dword [ebp + 8], 0
jne 0x41a2dd
mov edi, eax
and edi, edx
movzx edi, byte [edi + str.cw]
mov ebx, eax
shr ebx, 0x18
movzx ebx, byte [ebx + str.cw]
shl edi, 8
or edi, ebx
mov ebx, eax
shr eax, 8
shr ebx, 0x10
and eax, edx
movzx eax, byte [eax + str.cw]
xor eax, dword [ebp - 4]
shl dword [ebp - 4], 1
and ebx, edx
movzx ebx, byte [ebx + str.cw]
shl edi, 8
or edi, ebx
shl edi, 8
or eax, edi
test dword [ebp - 4], 0x100
je 0x41a2d8
mov dword [ebp - 4], 0x1b
mov dword [ebp + 8], esi
jmp 0x41a328
cmp dword [ebp + 8], 4
jne 0x41a328
cmp esi, 6
jbe 0x41a328
mov edi, eax
shr edi, 0x10
mov ebx, eax
shr ebx, 0x18
movzx ebx, byte [ebx + str.cw]
and edi, edx
movzx edi, byte [edi + str.cw]
shl ebx, 8
or edi, ebx
mov ebx, eax
shr ebx, 8
and ebx, edx
movzx ebx, byte [ebx + str.cw]
shl edi, 8
and eax, edx
movzx eax, byte [eax + str.cw]
or edi, ebx
shl edi, 8
or eax, edi
xor eax, dword [ecx]
dec dword [ebp + 8]
mov dword [ecx + esi*4], eax
add ecx, 4
cmp ecx, dword [ebp - 8]
jne 0x41a27c
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x41b66d
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 5
jae 0x41b681
xor eax, eax
leave
ret
lea eax, [ebp - 0x10]
push eax
call fcn.0041b653
neg eax
sbb eax, eax
and eax, dword [ebp - 8]
pop ecx
leave
ret
Function at 0x41fa70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
xor ebx, ebx
push ebp
xor eax, eax
push esi
mov esi, dword [esp + 0x10]
or dword [esi + 0x90], 0xffffffff
or dword [esi + 0x94], 0xffffffff
inc eax
push 0x20
mov dword [esi + 0x30], eax
mov dword [esi + 0x44], eax
mov eax, dword [esi + 4]
pop ebp
mov dword [esi + 0x78], ebx
mov dword [esi + 0x7c], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x70], ebx
mov dword [esi + 0x88], ebx
mov dword [esi + 0x68], ebx
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0x80], ebx
mov dword [esi + 0x84], ebx
cmp eax, ebp
jbe 0x41fad8
mov eax, ebp
mov dword [esi + 0x54], eax
mov eax, dword [esi]
push edi
mov dword [esi + 0x58], ebx
cmp eax, dword [esi + 0x20]
je 0x41fb17
lea edi, [esi + 0xc8]
cmp dword [edi + 8], ebx
je 0x41faf8
push edi
call fcn.0041ee31
pop ecx
add edi, 0x28
dec ebp
jne 0x41faec
mov ecx, dword [esi + 0x5c]
cmp ecx, ebx
je 0x41fb12
mov eax, dword [esi + 0x14]
push ecx
push eax
call dword [eax + 4]
pop ecx
pop ecx
mov dword [esi + 0x5c], ebx
mov eax, dword [esi]
mov dword [esi + 0x20], eax
push dword [esi + 0x10]
lea eax, [esi + 0x98]
push eax
call fcn.0041ed34
mov eax, dword [esi + 0x58]
lea edi, [eax + 5]
imul edi, edi, 0x28
add edi, esi
inc eax
pop ecx
mov dword [esi + 0x58], eax
pop ecx
mov eax, edi
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
call fcn.0041edda
mov ebp, eax
cmp ebp, ebx
jne 0x41fb82
lea eax, [edi + 0x20]
push eax
call fcn.00421221
mov ebp, eax
pop ecx
cmp ebp, ebx
jne 0x41fb82
lea eax, [edi + 0x1c]
push eax
call fcn.00421221
mov ebp, eax
pop ecx
cmp ebp, ebx
jne 0x41fb82
push edi
call fcn.0041f815
mov ebp, eax
cmp ebp, ebx
je 0x41fb82
mov eax, esi
mov dword [esi + 0x44], ebx
call fcn.0041ee97
cmp ebp, ebx
pop edi
jle 0x41fb91
and ebp, 0xffff
or ebp, 0x80070000
cmp ebp, ebx
je 0x41fb98
mov dword [esi + 0x40], ebp
cmp dword [esi + 0x38], ebx
jne 0x41fbaa
cmp dword [esi + 0x40], ebx
jne 0x41fbaa
cmp dword [esi + 0x3c], ebx
jne 0x41fbaa
mov dword [esi + 0x44], ebx
mov eax, dword [esi + 0x44]
neg eax
sbb eax, eax
not eax
pop esi
and eax, ebp
pop ebp
pop ebx
ret

Function at 0x420d9c
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 8], 0
and dword [eax + 0xc], 0
mov dword [eax + 0x20], 0x6a09e667
mov dword [eax + 0x24], 0xbb67ae85
mov dword [eax + 0x28], 0x3c6ef372
mov dword [eax + 0x2c], 0xa54ff53a
mov dword [eax + 0x30], 0x510e527f
mov dword [eax + 0x34], 0x9b05688c
mov dword [eax + 0x38], 0x1f83d9ab
mov dword [eax + 0x3c], 0x5be0cd19
ret

Function at 0x4211d3
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
xor eax, eax
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
push eax
call fcn.004625ad
mov ecx, dword [ebp + 8]
push eax
mov dword [ecx], eax
call fcn.00421163
add esp, 0x1c
leave
ret
Function at 0x42adde
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
cmp ecx, 2
jne 0x42adf8
mov eax, dword [eax + 0xc]
mov dword [0x4a5304], eax
xor eax, eax
inc eax
pop ebp
ret
cmp ecx, 3
jne 0x42ae07
mov eax, dword [eax + 0x10]
mov dword [0x4a5308], eax
jmp 0x42adf3
push esi
xor esi, esi
cmp dword [eax + 8], esi
jne 0x42ae13
xor eax, eax
jmp 0x42ae8f
mov ecx, dword [eax + 0x14]
mov dword [0x4a52dc], ecx
mov ecx, dword [eax + 0x18]
mov dword [0x4a52e0], ecx
mov ecx, dword [eax + 0x1c]
mov dword [0x4a52e4], ecx
mov ecx, dword [eax + 0x20]
mov dword [0x4a52e8], ecx
mov ecx, dword [eax + 0x24]
mov dword [0x4a52ec], ecx
mov ecx, dword [eax + 0x28]
mov dword [0x4a52f0], ecx
mov ecx, dword [eax + 0x2c]
mov dword [0x4a52f4], ecx
mov ecx, dword [eax + 0x30]
mov dword [0x4a52f8], ecx
lea ecx, [ebp + 8]
push ecx
push esi
mov dword [0x4a5304], esi
mov dword [0x4a5308], esi
push dword [eax + 8]
push 0x42ad96
push esi
push esi
call fcn.004625ad
push eax
call fcn.0042ad40
xor eax, eax
add esp, 0x1c
cmp dword [0x4a530c], esi
sete al
pop esi
pop ebp
ret
Function at 0x432f0f
Capabilities:
Set file attributes

Disassembly:
test dword [esp + 8], 0xf0000000
je 0x432f21
and dword [esp + 8], 0x3fff
jmp fcn.00432e4e

Function at 0x43310f
Capabilities:
Create directory

Disassembly:
push 0x18
mov eax, 0x477099
call fcn.0045eba3
push dword [ebp + 8]
xor ebx, ebx
cmp byte [0x4a52d8], bl
jne 0x433157
lea eax, [ebp - 0x24]
push eax
call fcn.00422813
mov eax, dword [eax]
pop ecx
pop ecx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push dword [ebp - 0x24]
mov esi, eax
call fcn.0043f924
pop ecx
cmp esi, ebx
je 0x4331d6
mov al, 1
jmp 0x4331d8
call fcn.004350ac
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov edi, eax
pop ecx
cmp edi, 1
je 0x433181
push ebx
push dword [ebp + 8]
call esi
test eax, eax
jne 0x433150
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x4331d6
cmp edi, ebx
je 0x4331d6
lea ecx, [ebp - 0x18]
call fcn.004222d6
cmp edi, 1
setne al
movzx eax, al
push eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call fcn.00435529
add esp, 0xc
test al, al
je 0x4331c9
push ebx
push dword [ebp - 0x18]
call esi
push dword [ebp - 0x18]
cmp eax, ebx
setne bl
or dword [ebp - 4], 0xffffffff
call fcn.0043f924
pop ecx
mov al, bl
jmp 0x4331d8
push dword [ebp - 0x18]
or dword [ebp - 4], 0xffffffff
call fcn.0043f924
pop ecx
xor al, al
call fcn.0045ec7b
ret
Function at 0x4332bc
Capabilities:
Get common file path

Disassembly:
push ebp
sub esp, 0x344
lea ebp, [esp - 4]
mov eax, dword [0x49c250]
xor eax, ebp
mov dword [ebp + 0x344], eax
push 0x1c
mov eax, 0x4770f7
call fcn.0045eba3
mov edi, dword [ebp + 0x350]
and dword [edi + 4], 0
mov eax, dword [edi]
xor ecx, ecx
mov word [eax], cx
mov dword [ebp - 0x10], edi
mov esi, 0x114
cmp byte [0x4a52d8], cl
jne 0x433378
lea eax, [ebp + 0x22c]
push eax
push esi
mov byte [ebp + 0x22c], cl
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x433374
cmp eax, esi
jae 0x433374
lea eax, [ebp + 0x22c]
push eax
lea eax, [ebp - 0x28]
push eax
mov byte [ebp + 0x340], 0
call fcn.00422867
pop ecx
pop ecx
and dword [ebp - 4], 0
push eax
mov ecx, edi
call fcn.0042244a
push dword [ebp - 0x28]
or dword [ebp - 4], 0xffffffff
call fcn.0043f924
pop ecx
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x344]
xor ecx, ebp
call fcn.0045dfca
add ebp, 0x348
leave
ret
xor al, al
jmp 0x433351
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
xor eax, eax
mov word [ebp], ax
lea eax, [ebp]
push eax
push esi
call ebx
mov edi, eax
test edi, edi
je 0x433374
cmp edi, esi
jae 0x4333ac
mov ecx, dword [ebp - 0x10]
xor eax, eax
mov word [ebp + 0x228], ax
lea eax, [ebp]
push eax
call fcn.004223f2
jmp 0x43334f
lea ecx, [ebp - 0x1c]
call fcn.004222d6
push edi
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], 1
call fcn.004138fe
push eax
push edi
call ebx
mov esi, eax
test esi, esi
jne 0x4333e4
xor bl, bl
push dword [ebp - 0x1c]
or dword [ebp - 4], 0xffffffff
call fcn.0043f924
pop ecx
mov al, bl
jmp 0x433351
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
push eax
mov word [eax + edi*2], cx
call fcn.00421a5e
pop ecx
mov dword [ebp - 0x18], eax
cmp eax, esi
jne 0x4333ce
dec edi
cmp edi, esi
jne 0x4333ce
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x1c]
push eax
call fcn.0042244a
mov bl, 1
jmp 0x4333d0
Function at 0x43349b
Capabilities:
Create directory

Disassembly:
push ebp
sub esp, 0x4c
push 0x38
mov eax, 0x477137
call fcn.0045eba3
cmp byte [0x4a52d8], 0
push edi
jne 0x4334f3
lea eax, [ebp + 0x38]
push eax
call fcn.00422813
mov eax, dword [eax]
pop ecx
pop ecx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push dword [ebp + 0x38]
mov esi, eax
call fcn.0043f924
pop ecx
test esi, esi
je 0x4335d3
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add ebp, 0x50
leave
ret
call fcn.004350ac
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ebx, eax
pop ecx
cmp ebx, 1
je 0x433520
push 0
push edi
call esi
test eax, eax
jne 0x4334de
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x4335d3
test ebx, ebx
je 0x4335d3
lea ecx, [ebp + 0x44]
call fcn.004222d6
and dword [ebp - 4], 0
cmp ebx, 1
setne al
movzx eax, al
push eax
lea eax, [ebp + 0x44]
push eax
push edi
call fcn.00435529
add esp, 0xc
test al, al
je 0x4335c6
push 0
push dword [ebp + 0x44]
call esi
test eax, eax
je 0x433570
mov bl, 1
push dword [ebp + 0x44]
or dword [ebp - 4], 0xffffffff
call fcn.0043f924
pop ecx
mov al, bl
jmp 0x4334e0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x433581
xor bl, bl
jmp 0x43355c
lea ecx, [ebp]
call fcn.004337b2
lea ecx, [ebp + 0x28]
call fcn.004222d6
push 0
push dword [ebp + 0x44]
lea ecx, [ebp]
mov byte [ebp - 4], 1
call fcn.00433e9f
push dword [ebp + 0x28]
mov byte [ebp - 4], 0
test al, al
jne 0x4335b5
call fcn.0043f924
pop ecx
jmp 0x43357d
mov ebx, dword [ebp + 0x20]
shr ebx, 4
and bl, 1
call fcn.0043f924
pop ecx
jmp 0x43355c
push dword [ebp + 0x44]
or dword [ebp - 4], 0xffffffff
call fcn.0043f924
pop ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x4335e7
xor al, al
jmp 0x4334e0
lea ecx, [ebp - 0x44]
call fcn.004337b2
lea ecx, [ebp - 0x1c]
call fcn.004222d6
push 0
push edi
lea ecx, [ebp - 0x44]
mov dword [ebp - 4], 2
call fcn.00433e9f
test al, al
jne 0x433617
xor bl, bl
push dword [ebp - 0x1c]
jmp 0x43355f
mov ebx, dword [ebp - 0x24]
shr ebx, 4
and bl, 1
jmp 0x43360f

Function at 0x433cbd
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0x18
mov eax, 0x477099
call fcn.0045eba3
cmp byte [0x4a52d8], 0
push dword [ebp + 8]
jne 0x433cf7
lea eax, [ebp - 0x24]
push eax
call fcn.00422813
pop ecx
pop ecx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push dword [ebp - 0x24]
mov esi, eax
call fcn.0043f924
pop ecx
mov eax, esi
jmp 0x433d5c
call fcn.004350ac
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
pop ecx
cmp edi, 1
je 0x433d14
push dword [ebp + 8]
call esi
cmp eax, 0xffffffff
jne 0x433d5c
test edi, edi
je 0x433d59
lea ecx, [ebp - 0x18]
call fcn.004222d6
and dword [ebp - 4], 0
cmp edi, 1
setne al
movzx eax, al
push eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 8]
call fcn.00435529
add esp, 0xc
push dword [ebp - 0x18]
test al, al
je 0x433d4f
call esi
or dword [ebp - 4], 0xffffffff
push dword [ebp - 0x18]
jmp 0x433ceb
or dword [ebp - 4], 0xffffffff
call fcn.0043f924
pop ecx
or eax, 0xffffffff
call fcn.0045ec7b
ret
Function at 0x434478
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push edi
lea eax, [ebp - 4]
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4344a2
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x4344a2
xor al, al
jmp 0x4344c2
push 1
push 0
push 0
push dword [ebp - 4]
call fcn.00461fc0
mov ecx, eax
xor eax, eax
add ecx, edi
adc edx, eax
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
pop edi
leave
ret 4

Function at 0x43466e
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x400000
cmp dword [ebp + 0xc], eax
jbe 0x43467e
mov dword [ebp + 0xc], eax
pop ebp
jmp fcn.004345da

Function at 0x4346a1
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, 0x400000
push esi
mov esi, ecx
cmp dword [ebp + 0xc], eax
jbe 0x4346b6
mov dword [ebp + 0xc], eax
and dword [ebp - 4], 0
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp + 0x10]
test eax, eax
mov eax, dword [ebp - 4]
mov dword [ecx], eax
mov ecx, dword [esi + 0x20d]
setne bl
cmp ecx, dword [esi]
jne 0x434724
add dword [esi + 0x211], eax
mov ecx, dword [esi + 0x219]
mov edx, dword [esi + 0x21d]
adc dword [esi + 0x215], 0
mov eax, ecx
or eax, edx
je 0x434724
mov eax, dword [0x4a52f0]
test eax, eax
je 0x434724
push edx
push ecx
push dword [esi + 0x215]
add esi, 0x221
push dword [esi - 0x10]
push esi
call eax
add esp, 0x14
pop esi
mov al, bl
pop ebx
leave
ret 0xc

Function at 0x435cdd
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
push esi
mov esi, dword [ebp + 8]
and dword [esi + 4], 0
push str.GlobalMemoryStatusEx
push str.kernel32.dll
mov dword [esi], SysReAllocString
mov dword [ebp - 0x60], 0x40
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x435d36
lea ecx, [ebp - 0x60]
push ecx
call eax
test eax, eax
je 0x435d36
push dword [ebp - 0x54]
push dword [ebp - 0x58]
push dword [ebp - 0x34]
push dword [ebp - 0x38]
call fcn.00435c8e
add esp, 0x10
mov dword [esi + 4], edx
jmp 0x435d56
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x20
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x18]
jb 0x435d52
mov eax, dword [ebp - 0x18]
and dword [esi + 4], 0
mov dword [esi], eax
mov al, 1
pop esi
leave
ret
Function at 0x43ae00
Capabilities:
Set global application hook

Disassembly:
cmp dword [0x4a5524], 0
push esi
mov esi, dword [sym.imp.USER32.dll_SetWindowsHookExA]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
jne 0x43ae2a
call edi
push eax
push 0
push 0x43a500
push 0xffffffffffffffff
call esi
mov dword [0x4a5524], eax
cmp dword [0x4a5528], 0
jne 0x43ae46
call edi
push eax
push 0
push 0x43ac40
push 3
call esi
mov dword [0x4a5528], eax
mov eax, dword [0x4a552c]
test eax, eax
jne 0x43ae62
call edi
push eax
push 0
push 0x43ad40
push 4
call esi
mov dword [0x4a552c], eax
cmp dword [0x4a5524], 0
pop edi
pop esi
je 0x43ae80
cmp dword [0x4a5528], 0
je 0x43ae80
test eax, eax
je 0x43ae80
mov eax, 1
ret
xor eax, eax
ret

Function at 0x44510c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x445153
call fcn.004462d0
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x445153
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x44516f
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.00444c86
mov esi, eax
test edi, edi
je 0x44516d
test ebx, ebx
je 0x44516d
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x447726
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x477ec2
call fcn.0045eba3
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x44774b
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x447791
lea ecx, [ebp - 0x10]
call fcn.00401c26
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0044529a
add esp, 0x10
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.0040135b
mov eax, esi
call fcn.0045ec7b
ret 8

Function at 0x44a5c5
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x58], ebx
test ebx, 0xffff0000
jne 0x44a5e9
cmp dword [edi + 0x54], 0
jne 0x44a5e9
movzx eax, bx
mov dword [edi + 0x54], eax
call fcn.004462d0
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.0044a586
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x44d637
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
cmp dword [ebp + 0xc], ebx
je 0x44d67f
call fcn.004462d0
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x44d67f
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
test eax, eax
je 0x44d6c2
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
test ebx, ebx
je 0x44d6ab
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x44d6ab
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x44d6bf
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x45dfca
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x49c250]
jne 0x45dfd4
repz ret
jmp fcn.00464bdd
Function at 0x46f53f
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0046575d
and dword [ebp - 4], 0
cmp dword [0x4a7e5c], 0
mov ebx, eax
jne 0x46f5f0
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x46f6a1
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x487eb8
push edi
call esi
test eax, eax
je 0x46f6a1
push eax
call fcn.004656eb
mov dword [esp], 0x487ea8
push edi
mov dword [0x4a7e5c], eax
call esi
push eax
call fcn.004656eb
mov dword [esp], 0x487e94
push edi
mov dword [0x4a7e60], eax
call esi
push eax
call fcn.004656eb
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4a7e64], eax
call esi
push eax
call fcn.004656eb
pop ecx
mov dword [0x4a7e6c], eax
test eax, eax
je 0x46f5f0
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004656eb
pop ecx
mov dword [0x4a7e68], eax
mov eax, dword [0x4a7e68]
cmp eax, ebx
je 0x46f648
cmp dword [0x4a7e6c], ebx
je 0x46f648
push eax
call fcn.00465766
push dword [0x4a7e6c]
mov esi, eax
call fcn.00465766
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x46f648
test edi, edi
je 0x46f648
call esi
test eax, eax
je 0x46f63f
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x46f63f
test byte [ebp - 0xc], 1
jne 0x46f648
or dword [ebp + 0x10], 0x200000
jmp 0x46f681
mov eax, dword [0x4a7e60]
cmp eax, ebx
je 0x46f681
push eax
call fcn.00465766
pop ecx
test eax, eax
je 0x46f681
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x46f681
mov eax, dword [0x4a7e64]
cmp eax, ebx
je 0x46f681
push eax
call fcn.00465766
pop ecx
test eax, eax
je 0x46f681
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4a7e5c]
call fcn.00465766
pop ecx
test eax, eax
je 0x46f6a1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x46f6a3
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4b5860
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x52ebfb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.005235ef
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x4b58e2
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.005210f0
mov eax, dword [eax]
push 0x90fd00
push eax
call fcn.00513a74
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0052387a
test bl, bl
je 0x4b58e2
push 0x90fd00
lea ecx, [esp + 0xc]
call fcn.00523c0a
push 0x90fd0c
lea ecx, [esp + 0xc]
call fcn.00523c0a
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x4b591e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0052387a
jmp 0x4b59e9
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x4b59a2
lea edx, [esp + 0x7c]
push 0x90fd08
push edx
call fcn.00513a74
add esp, 8
test eax, eax
je 0x4b59a2
lea eax, [esp + 0x7c]
push 0x90fd04
push eax
call fcn.00513a74
add esp, 8
test eax, eax
je 0x4b59a2
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4b5932
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0052387a
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x4b6c60
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x4b6cc2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc