joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44d984
Capabilities:
Get geographical location

Disassembly:
push ebx
add esp, 0xfffffef8
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
push 0x1001
push 0x800
call fcn.00409644
test eax, eax
jle 0x44d9bc
mov eax, ebx
mov edx, esp
mov ecx, 0x105
push 0
call fcn.00405b60
jmp 0x44d9c3
mov eax, ebx
call fcn.00405828
add esp, 0x108
pop ebx
ret

Function at 0x44dccc
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff98
push ebx
xor edx, edx
mov dword [ebp - 0x64], edx
mov dword [ebp - 0x68], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x44ddc6
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x44ddd4
push 0x44de00
call fcn.0040966c
push eax
call fcn.00409694
test eax, eax
je 0x44dd13
mov dword [ebp - 0x60], 0x40
lea edx, [ebp - 0x60]
push edx
call eax
jmp 0x44dd39
mov dword [ebp - 0x20], 0x20
lea eax, [ebp - 0x20]
push eax
call fcn.004097d8
mov eax, dword [ebp - 0x14]
xor edx, edx
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], edx
mov eax, dword [ebp - 0x18]
xor edx, edx
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], edx
push 0
push 0x100000
mov eax, dword [ebp - 0x50]
mov edx, dword [ebp - 0x4c]
add eax, 0x80000
adc edx, 0
call fcn.004077a8
push edx
push eax
lea ecx, [ebp - 0x64]
mov dl, 0x30
mov eax, 1
call fcn.0040d8f0
push dword [ebp - 0x64]
push 0x44de28
push 0
push 0x100000
mov eax, dword [ebp - 0x58]
mov edx, dword [ebp - 0x54]
add eax, 0x80000
adc edx, 0
call fcn.004077a8
push edx
push eax
lea ecx, [ebp - 0x68]
mov dl, 0x30
mov eax, 1
call fcn.0040d8f0
push dword [ebp - 0x68]
push 0x44de38
mov eax, ebx
mov edx, 4
call fcn.00405d38
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44ddcd
lea eax, [ebp - 0x68]
mov edx, 2
call fcn.0040584c
ret
Function at 0x44e150
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov ebx, ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x44e29d
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
lea eax, [ebp - 4]
call fcn.00405828
xor eax, eax
push ebp
push 0x44e278
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
lea eax, [ebp - 4]
mov ecx, ebx
mov edx, esi
call fcn.00405960
push 0
mov edx, edi
lea eax, [ebp - 8]
mov ecx, ebx
call fcn.00405960
lea eax, [ebp - 4]
xor edx, edx
call fcn.00405a38
call fcn.00405bbc
cmp ebx, eax
jne 0x44e26e
lea eax, [ebp - 8]
xor edx, edx
call fcn.00405a38
call fcn.00405bbc
cmp ebx, eax
jne 0x44e26e
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00405ecc
je 0x44e26e
lea eax, [ebp - 0x10]
push eax
push 0x40
push ebx
push esi
call fcn.00409990
test eax, eax
je 0x44e26e
mov edx, esi
mov eax, edi
mov ecx, ebx
call fcn.00403290
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x10]
push eax
push ebx
push esi
call fcn.00409990
mov eax, dword [0x554cf4]
call fcn.00407c50
mov ebx, eax
lea eax, [ebx + 1]
push eax
mov eax, 0x554cf4
mov ecx, 1
mov edx, dword [0x44e12c]
call fcn.00407e18
add esp, 4
lea edi, [ebx + ebx*2]
mov eax, dword [0x554cf4]
mov dword [eax + edi*4], esi
mov eax, dword [0x554cf4]
lea eax, [eax + edi*4 + 4]
mov edx, dword [ebp - 4]
call fcn.0040587c
mov eax, dword [0x554cf4]
lea eax, [eax + edi*4 + 8]
mov edx, dword [ebp - 8]
call fcn.0040587c
mov byte [ebp - 9], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x44e282
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44e2a4
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040584c
ret
Function at 0x44e2b0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x44e3a7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x554cf4]
call fcn.00407c58
test eax, eax
jl 0x44e391
inc eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], 0
mov eax, dword [ebp - 8]
lea eax, [eax + eax*2]
mov edx, dword [0x554cf4]
lea ebx, [edx + eax*4]
xor eax, eax
push ebp
push 0x44e37b
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebx + 8]
call fcn.00405bbc
mov ecx, eax
mov edx, dword [ebx]
lea eax, [ebp - 4]
call fcn.00405960
mov eax, dword [ebp - 4]
mov edx, dword [ebx + 8]
call fcn.00405ecc
jne 0x44e371
lea eax, [ebp - 0xc]
push eax
push 0x40
mov eax, dword [ebx + 4]
call fcn.00405bbc
push eax
mov eax, dword [ebx]
push eax
call fcn.00409990
test eax, eax
je 0x44e371
mov eax, dword [ebx + 4]
call fcn.00405bbc
mov ecx, eax
mov edx, dword [ebx]
mov eax, dword [ebx + 4]
call fcn.00403290
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebx + 4]
call fcn.00405bbc
push eax
mov eax, dword [ebx]
push eax
call fcn.00409990
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x44e385
inc dword [ebp - 8]
dec dword [ebp - 0x10]
jne 0x44e2e9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44e3ae
lea eax, [ebp - 4]
call fcn.00405828
ret
Function at 0x44e6c4
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x44e7fc
push dword fs:[eax]
mov dword fs:[eax], esp
cmp bl, 0x5c
je 0x44e7e1
mov eax, dword [ebp + 8]
cmp dword [eax - 8], 0
je 0x44e73c
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x2c]
mov edx, ebx
mov ecx, 0
call fcn.00405acc
lea eax, [ebp - 0x2c]
mov edx, 0x44e818
call fcn.00405bf0
mov eax, dword [ebp - 0x2c]
call fcn.00405ee4
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
call eax
jmp 0x44e79d
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x30]
mov edx, ebx
mov ecx, 0
call fcn.00405acc
lea eax, [ebp - 0x30]
mov edx, 0x44e818
call fcn.00405bf0
mov eax, dword [ebp - 0x30]
call fcn.00405ee4
push eax
call fcn.004095e4
test eax, eax
je 0x44e79d
mov eax, dword [ebp - 0x24]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0x20]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0x1c]
xor edx, edx
call fcn.00407760
call fcn.00407760
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
push 0x44e828
lea eax, [ebp - 0x38]
mov edx, ebx
mov ecx, 0
call fcn.00405acc
mov eax, dword [ebp - 0x38]
lea edx, [ebp - 0x34]
call fcn.0040bf54
push dword [ebp - 0x34]
push 0x44e838
push dword [ebp - 4]
push dword [ebp - 8]
lea eax, [ebp - 0x3c]
call fcn.0040e1c0
push dword [ebp - 0x3c]
mov eax, esi
mov edx, 4
call fcn.00405d38
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44e803
lea eax, [ebp - 0x3c]
mov edx, 5
call fcn.0040584c
ret
Function at 0x451298
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor ebx, ebx
call fcn.004095cc
cmp esi, eax
je 0x4512c2
push edi
call fcn.00409950
mov esi, eax
cmp esi, 0xffffffff
je 0x4512c2
push edi
call fcn.004098e8
test esi, esi
setg bl
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x455104
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00405ed4
mov eax, dword [ebp - 8]
call fcn.00405ed4
xor eax, eax
push ebp
push 0x45522d
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [edi], 0
jne 0x455200
mov eax, dword [ebp - 4]
call fcn.00405ee4
push eax
call fcn.00409674
xor ecx, ecx
mov edx, dword [ebp - 8]
call fcn.00417484
mov dword [edi], eax
test esi, esi
je 0x455174
cmp word [esi], 0x25ff
jne 0x455174
mov eax, esi
add eax, 2
mov eax, dword [eax]
mov ebx, dword [eax]
jmp 0x455176
xor ebx, ebx
push 0
call fcn.0040966c
cmp eax, dword [0x553b20]
je 0x45518e
cmp byte [0x5484a4], 0
je 0x4551a5
lea eax, [ebp - 0x14]
call fcn.00430cc4
mov eax, dword [ebp - 0x14]
mov edx, dword [edi]
mov ecx, dword [ebp + 8]
call fcn.00430f94
jmp 0x4551b4
mov edx, dword [edi]
mov ecx, dword [ebp + 8]
mov eax, dword [0x553b20]
call fcn.00430efc
test ebx, ebx
je 0x4551c3
mov eax, esi
add eax, 2
mov eax, dword [eax]
cmp ebx, dword [eax]
je 0x4551c7
xor eax, eax
jmp 0x4551c9
mov al, 1
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x455204
add esi, 2
mov ebx, dword [esi]
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
push ebx
call fcn.00409990
test eax, eax
je 0x455204
mov eax, dword [ebp + 8]
mov dword [ebx], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x10]
push eax
push 4
push ebx
call fcn.00409990
jmp 0x455204
mov byte [ebp - 9], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x455234
lea eax, [ebp - 0x14]
mov edx, dword [0x430c98]
call fcn.00407f38
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040584c
ret

Function at 0x455244
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x455319
push dword fs:[eax]
mov dword fs:[eax], esp
test edi, edi
je 0x4552fd
test esi, esi
je 0x455285
cmp word [esi], 0x25ff
jne 0x455285
mov eax, esi
add eax, 2
mov eax, dword [eax]
mov ebx, dword [eax]
jmp 0x455287
xor ebx, ebx
push 0
call fcn.0040966c
cmp eax, dword [0x553b20]
je 0x45529f
cmp byte [0x5484a4], 0
je 0x4552b6
lea eax, [ebp - 0xc]
call fcn.00430cc4
mov eax, dword [ebp - 0xc]
mov ecx, edi
mov edx, dword [ebp - 4]
call fcn.00430f94
jmp 0x4552c5
mov ecx, edi
mov edx, dword [ebp - 4]
mov eax, dword [0x553b20]
call fcn.00430efc
test ebx, ebx
je 0x4552fd
mov eax, esi
add eax, 2
mov eax, dword [eax]
cmp ebx, dword [eax]
jne 0x4552fd
add esi, 2
mov ebx, dword [esi]
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push ebx
call fcn.00409990
test eax, eax
je 0x4552fd
mov dword [ebx], edi
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 8]
push eax
push 4
push ebx
call fcn.00409990
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x455320
lea eax, [ebp - 0xc]
mov edx, dword [0x430c98]
call fcn.00407f38
ret
Function at 0x455ae0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push ebx
push esi
push edi
mov dword [ebp - 0x44], ecx
mov edi, edx
mov ebx, eax
lea eax, [ebp - 0x40]
mov edx, dword [0x418b1c]
call fcn.00407048
xor eax, eax
push ebp
push 0x455ba0
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x45], 0
lea edx, [ebp - 0x40]
mov eax, ebx
call fcn.0041de24
cmp byte [ebp - 0x40], 0
je 0x455b84
mov eax, dword [ebp - 0x20]
call fcn.00407c58
test eax, eax
jl 0x455b84
inc eax
xor esi, esi
mov edx, esi
add edx, edx
add edx, edx
add edx, edx
sub edx, esi
mov ecx, dword [ebp - 0x20]
lea ebx, [ecx + edx*4]
cmp byte [ebx + 0x10], 0
je 0x455b80
cmp edi, dword [ebx + 0xc]
jne 0x455b80
lea eax, [ebp - 0x4c]
push eax
push 0x40
push 4
mov eax, dword [ebx + 0x14]
push eax
call fcn.00409990
test eax, eax
je 0x455b84
mov edx, dword [ebp - 0x44]
sub edx, dword [ebx + 8]
mov eax, dword [ebx + 0x14]
mov dword [eax], edx
lea edx, [ebp - 0x4c]
push edx
mov edx, dword [ebp - 0x4c]
push edx
push 4
push eax
call fcn.00409990
mov byte [ebp - 0x45], 1
jmp 0x455b84
inc esi
dec eax
jne 0x455b2f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x455ba7
lea eax, [ebp - 0x40]
mov edx, dword [0x418b1c]
call fcn.00407120
ret

Function at 0x456338
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405ed4
lea eax, [ebp - 0xc]
mov edx, dword [0x456218]
call fcn.00407048
xor eax, eax
push ebp
push 0x4563ea
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x4563f8
call fcn.00409e90
mov ebx, eax
test ebx, ebx
je 0x4563be
lea eax, [ebp - 0x10]
push eax
push 0
push ebx
call fcn.0040a058
mov cl, 0x30
mov edx, 1
call fcn.0040d944
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
mov edx, 0x45641c
call fcn.00405c6c
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.004058d8
lea eax, [ebp - 0xc]
push eax
push 0x456244
call fcn.00409e80
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4563f1
lea eax, [ebp - 0x10]
call fcn.00405828
lea eax, [ebp - 0xc]
mov edx, dword [0x456218]
call fcn.00407120
lea eax, [ebp - 4]
call fcn.00405828
ret
Function at 0x456458
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x456526
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
call fcn.004095bc
mov cl, 0x30
mov edx, 1
call fcn.0040d944
mov ecx, dword [ebp - 8]
lea eax, [ebp - 4]
mov edx, 0x456540
call fcn.00405c6c
mov eax, dword [ebp - 4]
call fcn.00405ee4
push eax
push 0
push 4
call fcn.00409890
mov ebx, eax
test ebx, ebx
je 0x45650b
push 0
push 0
push 0
push 4
push ebx
call fcn.00409868
mov esi, eax
test esi, esi
je 0x456505
mov eax, dword [esi + 4]
push eax
call fcn.004093a4
mov eax, dword [esi]
push eax
push 0
push 0x100000
call fcn.00409898
mov edi, eax
test edi, edi
je 0x4564ed
push 0xffffffffffffffff
push edi
call fcn.004099b0
push edi
call fcn.004093a4
mov edx, 0x5484d8
lea eax, [esi + 8]
mov ecx, 0x50
call fcn.00403290
push esi
call fcn.00409978
push ebx
call fcn.004093a4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45652d
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040584c
ret
Function at 0x456630
Capabilities:
Get file size
Read file via mapping
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffedc
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x124], edx
mov dword [ebp - 0x120], edx
mov dword [ebp - 4], edx
xor edx, edx
push ebp
push 0x4567e2
push dword fs:[edx]
mov dword fs:[edx], esp
xor ebx, ebx
push 0x104
lea edx, [ebp - 0x119]
push edx
push eax
call fcn.0040965c
push 0
push 0
push 3
push 0
push 3
push 0x80000000
lea eax, [ebp - 0x119]
push eax
call fcn.004093e4
mov esi, eax
cmp esi, 0xffffffff
je 0x456741
push 0
push 0
push 0
push 2
push 0
push esi
call fcn.004093f4
mov edi, eax
test edi, edi
je 0x45673b
push 0
push 0
push 0
push 4
push edi
call fcn.00409868
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x456735
mov eax, dword [ebp - 8]
call fcn.004171bc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x45672c
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0x58], 0
je 0x45672c
mov eax, dword [ebp - 0xc]
add eax, 0x58
mov dword [ebp - 0x10], eax
push 0
push esi
call fcn.00409614
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x10]
sub edx, dword [ebp - 8]
xor ecx, ecx
mov eax, dword [ebp - 8]
call fcn.004565d4
mov ecx, eax
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 8]
mov edx, dword [ebp - 0x14]
sub edx, eax
sub edx, 4
mov eax, dword [ebp - 0x10]
add eax, 4
call fcn.004565d4
add eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0xc]
cmp eax, dword [edx + 0x58]
je 0x45672c
mov bl, 1
mov eax, dword [ebp - 8]
push eax
call fcn.00409978
push edi
call fcn.004093a4
push esi
call fcn.004093a4
test bl, bl
je 0x4567b6
push 0x10
push 0
lea edx, [ebp - 0x120]
mov eax, dword [0x548bdc]
mov ecx, dword [eax]
call dword [ecx + 0x248]
mov eax, dword [ebp - 0x120]
call fcn.00405ee4
push eax
push 0
call fcn.0040a140
push 0
call fcn.0040966c
cmp eax, dword [0x553b20]
je 0x4567af
mov eax, 0x548bdc
call fcn.00408714
lea eax, [ebp - 0x124]
mov edx, dword [ebp - 4]
call fcn.004068ac
mov ecx, dword [ebp - 0x124]
mov dl, 1
mov eax, dword [0x40b710]
call fcn.0040b788
call fcn.00405030
jmp 0x4567b6
push 0
call fcn.004094bc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4567e9
lea eax, [ebp - 0x124]
call fcn.00406680
lea eax, [ebp - 0x120]
call fcn.00405828
lea eax, [ebp - 4]
call fcn.00405828
ret
Function at 0x45696c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor edx, edx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x456a79
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
mov ecx, 0x456a88
mov edx, 0x456a94
mov eax, esi
call fcn.00417828
lea eax, [ebp - 4]
xor edx, edx
call fcn.00405a38
call fcn.00405bbc
cmp eax, 0x14
jne 0x456a63
cmp esi, dword [0x553b20]
sete al
mov edx, dword [ebp - 4]
test byte [edx + 3], 0x80
sete dl
cmp al, dl
jne 0x456a63
mov eax, esi
call fcn.004171bc
mov ebx, eax
lea eax, [ebp - 8]
push eax
push 0x40
push 0xe0
lea eax, [ebx + 0x18]
push eax
call fcn.00409990
cmp esi, dword [0x553b20]
jne 0x456a17
mov eax, 0x42fc24
mov edx, dword [ebp - 4]
sub eax, dword [edx]
sub eax, esi
mov dword [ebx + 0x2c], eax
mov eax, 0x54843c
mov edx, dword [ebp - 4]
sub eax, dword [edx + 4]
sub eax, esi
mov dword [ebx + 0x30], eax
jmp 0x456a32
mov eax, dword [ebp - 4]
mov eax, dword [eax]
and eax, 0x7fffffff
mov dword [ebx + 0x2c], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
and eax, 0x7fffffff
mov dword [ebx + 0x30], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov dword [ebx + 0x1c], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov dword [ebx + 0x20], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
mov dword [ebx + 0x24], eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 8]
push eax
push 0xe0
lea eax, [ebx + 0x18]
push eax
call fcn.00409990
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x456a80
lea eax, [ebp - 4]
call fcn.00405828
ret
Function at 0x459710
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde0
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x21c], eax
mov dword [ebp - 0x220], eax
mov dword [ebp - 4], eax
lea ebx, [ebp - 8]
xor eax, eax
push ebp
push 0x45998d
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x548d44], 0
jne 0x459761
push 0x45999c
push 0x4599d0
call fcn.0040966c
push eax
call fcn.00409694
mov dword [0x548d44], eax
cmp dword [0x548d48], 0
jne 0x459784
push 0x4599e4
push 0x459a10
call fcn.00409830
push eax
call fcn.00409694
mov dword [0x548d48], eax
cmp dword [0x548d4c], 0
jne 0x4597a7
push 0x459a24
push 0x459a44
call fcn.0040966c
push eax
call fcn.00409694
mov dword [0x548d4c], eax
xor eax, eax
mov dword [ebx], eax
push ebx
push 0
push 0
push 5
call dword [0x548d44]
xor esi, esi
cmp dword [ebx], 0
jne 0x4597f9
mov dword [ebx], 0x10000
mov eax, dword [ebx]
add eax, eax
mov dword [ebx], eax
push esi
call fcn.00409850
mov eax, dword [ebx]
push eax
push 0x40
call fcn.00409848
mov esi, eax
push 0
mov eax, dword [ebx]
push eax
push esi
push 5
call dword [0x548d44]
test eax, eax
je 0x459819
cmp dword [ebx], 0x400000
jne 0x4597c5
jmp 0x459819
mov eax, dword [ebx]
add eax, eax
mov dword [ebx], eax
mov eax, dword [ebx]
push eax
push 0x40
call fcn.00409848
mov esi, eax
push 0
mov eax, dword [ebx]
push eax
push esi
push 5
call dword [0x548d44]
test eax, eax
jne 0x459961
mov ebx, esi
cmp dword [ebx + 0x3c], 0
je 0x45993f
lea eax, [ebp - 4]
mov edx, dword [ebx + 0x3c]
call fcn.0040683c
cmp dword [0x548d48], 0
je 0x45992a
mov eax, dword [ebx + 0x44]
push eax
push 0
push 0x410
call fcn.00409898
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x45992a
push 0x104
lea eax, [ebp - 0x216]
push eax
push 0
mov eax, dword [ebp - 0xc]
push eax
call dword [0x548d48]
test eax, eax
jbe 0x459921
lea eax, [ebp - 4]
lea edx, [ebp - 0x216]
mov ecx, 0x105
call fcn.00406890
mov edx, dword [ebp - 4]
mov eax, 0x459a68
call fcn.0040cf90
test al, al
je 0x4598fe
push 0x104
lea eax, [ebp - 0x216]
push eax
call fcn.00409710
lea eax, [ebp - 0x21c]
push eax
mov ecx, 0x7fffffff
mov edx, 0x15
mov eax, dword [ebp - 4]
call fcn.00406ce4
mov eax, dword [ebp - 0x21c]
push eax
lea eax, [ebp - 0x220]
lea edx, [ebp - 0x216]
mov ecx, 0x105
call fcn.00406890
mov edx, dword [ebp - 0x220]
lea eax, [ebp - 4]
pop ecx
call fcn.00406a64
jmp 0x459921
mov edx, dword [ebp - 4]
mov eax, 0x459aa0
call fcn.0040ccfc
test al, al
je 0x459921
lea eax, [ebp - 4]
mov ecx, 4
mov edx, 1
call fcn.00406db4
mov eax, dword [ebp - 0xc]
push eax
call fcn.004093a4
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebx + 0x50]
mov edx, dword [ebx + 0x44]
mov eax, dword [ebp - 4]
call fcn.00459364
pop ecx
jmp 0x459954
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebx + 0x50]
mov edx, dword [ebx + 0x44]
mov eax, 0x459ab8
call fcn.00459364
pop ecx
mov edi, dword [ebx]
test edi, edi
je 0x459961
add ebx, edi
jmp 0x459823
push esi
call fcn.00409850
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x459994
lea eax, [ebp - 0x220]
mov edx, 2
call fcn.00406688
lea eax, [ebp - 4]
call fcn.00406680
ret
Function at 0x45aa90
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
mov esi, 0x554d0c
push 0xa
push 0x45ab24
mov eax, dword [0x553b20]
push eax
call fcn.00409514
mov ebx, eax
test ebx, ebx
jne 0x45aab4
call fcn.00464924
push ebx
mov eax, dword [0x553b20]
push eax
call fcn.00409840
mov ebx, eax
test ebx, ebx
jne 0x45aacb
call fcn.00464924
push ebx
call fcn.00409860
mov dword [esi], eax
cmp dword [esi], 0
jne 0x45aadd
call fcn.00464924
mov eax, dword [esi]
mov edx, dword [esi]
mov ecx, edx
add ecx, dword [eax]
mov dword [0x554d10], ecx
mov ecx, edx
add ecx, dword [eax + 4]
mov dword [0x554d14], ecx
mov ecx, edx
add ecx, dword [eax + 8]
mov dword [0x554d18], ecx
mov ecx, edx
add ecx, dword [eax + 0xc]
mov dword [0x554d1c], ecx
mov ecx, edx
add ecx, dword [eax + 0x10]
mov dword [0x554d20], ecx
add edx, dword [eax + 0x14]
mov dword [0x554d24], edx
pop esi
pop ebx
ret

Function at 0x45c454
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x45c4fd
test eax, edx
je 0x45c500
push 0
push 0
cmp word [eax - 0xa], 2
je 0x45c47d
push edx
mov edx, eax
mov eax, esp
call fcn.004068ac
pop edx
mov eax, dword [esp]
cmp word [edx - 0xa], 2
je 0x45c493
push eax
lea eax, [esp + 8]
call fcn.004068ac
pop eax
mov edx, dword [esp + 4]
movzx ecx, word [edx]
cmp cx, word [eax]
je 0x45c4a2
movzx eax, word [eax]
sub eax, ecx
jmp 0x45c4c9
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
shl ecx, 1
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x45c4e3
add ecx, 4
js 0x45c4ba
pop eax
pop ebx
mov ecx, esp
mov edx, dword [ecx]
or edx, dword [ecx + 4]
je 0x45c4e0
push eax
mov eax, ecx
mov edx, 2
call fcn.0040584c
pop eax
pop edx
pop edx
ret
bsf ebx, ebx
shr ebx, 4
add ebx, ebx
add ecx, ebx
jns 0x45c4c7
movzx eax, word [ecx + eax]
movzx edx, word [ecx + edx]
sub eax, edx
pop ebx
pop ebx
jmp 0x45c4c9
xor eax, eax
ret
test eax, eax
je 0x45c510
test edx, edx
jne 0x45c464
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x45d6f8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
mov esi, eax
mov eax, esi
call fcn.0040671c
push eax
call fcn.004095fc
cmp eax, 0xffffffff
je 0x45d716
test al, 0x10
sete al
pop esi
pop ebx
ret
call fcn.0040962c
mov ebx, eax
cmp ebx, 2
je 0x45d737
cmp ebx, 3
je 0x45d737
cmp ebx, 0x7b
je 0x45d737
mov eax, esi
call fcn.0045d6b8
test al, al
jne 0x45d73b
xor eax, eax
jmp 0x45d73d
mov al, 1
pop esi
pop ebx
ret

Function at 0x45d740
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.0040671c
push eax
call fcn.004095fc
cmp eax, 0xffffffff
je 0x45d759
test al, 0x10
jne 0x45d75d
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret