joyce8/EMBER2024-capa huggingface dataset:
Function at 0x437310
Capabilities:
Enumerate files on windows
Hide graphical window

Disassembly:
push 0xffffffffffffffff
push 0x50373b
mov eax, dword fs:[0]
push eax
sub esp, 0x278
mov eax, dword [0x5364d0]
xor eax, esp
mov dword [esp + 0x270], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5364d0]
xor eax, esp
push eax
lea eax, [esp + 0x28c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x2a0]
mov ebx, dword [sym.imp.USER32.dll_IsWindow]
mov ebp, dword [esp + 0x29c]
mov esi, ecx
mov ecx, dword [esi + 4]
mov dword [esp + 0x1c], eax
lea eax, [esi + 4]
push ecx
mov edi, edx
mov dword [esp + 0x1c], eax
call ebx
test eax, eax
je 0x437529
cmp dword [esp + 0x1c], 0
je 0x437529
mov eax, esi
call fcn.004bdc00
mov edi, dword [edi]
lea edx, [esp + 0x34]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
mov dword [esp + 0x20], edi
test edi, edi
je 0x437504
cmp edi, 0xffffffff
je 0x437504
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileW]
lea esp, [esp]
lea eax, [esp + 0x60]
push 0x512924
push eax
call fcn.004e4707
add esp, 8
test eax, eax
je 0x437465
lea ecx, [esp + 0x60]
push 0x5153dc
push ecx
call fcn.004e4707
add esp, 8
test eax, eax
je 0x437465
mov al, byte [esp + 0x34]
test al, 2
jne 0x437465
cmp dword [esp + 0x2a4], 0
jne 0x437406
test al, 0x10
je 0x437465
mov edx, dword [0x563288]
mov eax, dword [edx + 0xc]
mov ecx, 0x563288
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
lea ecx, [esp + 0x60]
mov dword [esp + 0x294], 0
mov edx, dword [ebp]
push ecx
push edx
push 0x512580
lea edi, [esp + 0x20]
call fcn.00404890
mov ecx, dword [esp + 0x20]
add esp, 0xc
lea eax, [esi + 0x24]
push eax
call fcn.004bd130
mov ecx, edi
mov dword [esp + 0x294], 0xffffffff
call fcn.004016f0
mov edi, dword [esp + 0x20]
lea ecx, [esp + 0x34]
push ecx
push edi
call ebx
test eax, eax
jne 0x4373c0
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, dword [esi + 0x28]
push 0
push 0
push 0x18b
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
mov ebx, eax
test ebx, ebx
jg 0x43749f
call fcn.00436410
jmp 0x437529
mov eax, 0x14
call int.0041cd00
mov edi, eax
mov eax, 0xc8
imul edi, ebx
call int.0041cd00
cmp edi, eax
jle 0x4374c8
mov eax, 0xc8
call int.0041cd00
mov edi, eax
mov ecx, dword [esp + 0x1c]
mov eax, dword [ecx]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x24], eax
mov eax, dword [ecx + 0xc]
mov ecx, dword [ecx + 8]
mov dword [esp + 0x28], eax
push 0
add eax, edi
push 0
mov dword [esp + 0x38], eax
push edx
lea eax, [esp + 0x30]
mov dword [esp + 0x38], ecx
call fcn.00437ea0
call fcn.004370b0
mov eax, 1
jmp 0x43752b
mov esi, dword [esp + 0x18]
mov eax, dword [esi]
push eax
call ebx
test eax, eax
je 0x437529
mov ecx, dword [esi]
push ecx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x437529
mov edx, dword [esi]
push 0
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
mov ecx, dword [esp + 0x28c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x270]
xor ecx, esp
call fcn.004e3edb
add esp, 0x284
ret 0xc
Function at 0x4548c5
Capabilities:
Create process on windows

Disassembly:
cmp dword [esp + 0x18], 0
push esi
mov esi, ecx
jne 0x454ac3
mov eax, dword [esp + 0xc]
cmp eax, 0x110
jne 0x4548ef
mov eax, esi
call fcn.00454ad0
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov eax, 1
pop esi
ret 0x18
cmp eax, 0x111
jne 0x454ac3
mov eax, dword [esp + 0x10]
mov edx, 0x48c
cmp dx, ax
jne 0x45491d
push edx
call fcn.00455e20
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov eax, 1
pop esi
ret 0x18
mov edx, 0x48f
cmp dx, ax
jne 0x45493c
push edx
call fcn.00455e20
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov eax, 1
pop esi
ret 0x18
mov edx, 0x4af
cmp dx, ax
jne 0x45495b
push edx
call fcn.00455e20
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov eax, 1
pop esi
ret 0x18
mov edx, 0x498
cmp dx, ax
jne 0x45497a
push edx
call fcn.00455e20
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov eax, 1
pop esi
ret 0x18
mov edx, 0x46b
cmp dx, ax
jne 0x454999
push edx
call fcn.00455e20
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov eax, 1
pop esi
ret 0x18
mov edx, 0x5f0
cmp dx, ax
jne 0x4549b8
push edx
call fcn.00455e20
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov eax, 1
pop esi
ret 0x18
mov edx, 0x493
cmp dx, ax
jne 0x4549d7
push edx
call fcn.00455e20
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov eax, 1
pop esi
ret 0x18
mov edx, 0x48d
cmp dx, ax
jne 0x454a13
mov eax, esi
call fcn.00455f60
test eax, eax
je 0x454a02
mov eax, esi
call fcn.00455fd0
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov eax, 1
pop esi
ret 0x18
mov ecx, dword [esp + 0x18]
xor eax, eax
mov dword [ecx], eax
mov eax, 1
pop esi
ret 0x18
mov edx, 0x4a7
cmp dx, ax
jne 0x454a48
push 5
push 0
push 0
push str.https:__www.360totalsecurity.com
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [esp + 0x18]
mov dword [eax], 0
mov eax, 1
pop esi
ret 0x18
mov ecx, 0x8a0
cmp cx, ax
jne 0x454a67
push ecx
call fcn.00455e20
mov edx, dword [esp + 0x18]
mov dword [edx], eax
mov eax, 1
pop esi
ret 0x18
mov ecx, 0x46c
cmp cx, ax
jne 0x454a86
push ecx
call fcn.00455e20
mov edx, dword [esp + 0x18]
mov dword [edx], eax
mov eax, 1
pop esi
ret 0x18
mov ecx, 0x46d
cmp cx, ax
jne 0x454aa5
push ecx
call fcn.00455e20
mov edx, dword [esp + 0x18]
mov dword [edx], eax
mov eax, 1
pop esi
ret 0x18
mov ecx, 0x8a4
cmp cx, ax
jne 0x454ac3
call fcn.00455f10
mov edx, dword [esp + 0x18]
mov dword [edx], eax
mov eax, 1
pop esi
ret 0x18
xor eax, eax
pop esi
ret 0x18

Function at 0x455f10
Capabilities:
Create process on windows

Disassembly:
push ecx
lea eax, [esp]
push 0x2b7
push eax
call fcn.00433510
mov ecx, dword [eax]
add esp, 8
push 5
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [esp]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x455f57
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
pop ecx
ret
Function at 0x458580
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x4ff5a9
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5364d0]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
mov dword [esp + 0x14], 0
mov dword [esp + 8], 0
mov eax, dword [0x563288]
mov edx, dword [eax + 0xc]
mov ecx, 0x563288
call edx
add eax, 0x10
mov dword [esi], eax
mov dword [esp + 0x14], 0
mov ecx, 1
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, 0x104
or eax, ecx
mov dword [esp + 8], 1
jge 0x4585fa
mov ecx, 0x104
mov eax, esi
call fcn.004014d0
mov eax, dword [esi]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov eax, dword [esi]
mov ecx, dword [eax - 8]
test eax, eax
je 0x45861f
push ecx
push eax
call fcn.004e4d4d
add esp, 8
test eax, eax
jl 0x45865c
mov ecx, dword [esi]
cmp eax, dword [ecx - 8]
jg 0x45865c
mov dword [ecx - 0xc], eax
mov ecx, dword [esi]
xor edx, edx
mov word [ecx + eax*2], dx
push esi
lea eax, [edx + 0x5c]
call fcn.004178f0
push 1
push 0x511ddc
push esi
call fcn.0041e520
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 4
push 0x80070057
call fcn.00401540
int3

Function at 0x45a210
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x4fd84b
mov eax, dword fs:[0]
push eax
mov eax, 0x1018
call fcn.004f3c00
mov eax, dword [0x5364d0]
xor eax, esp
mov dword [esp + 0x1014], eax
push esi
mov eax, dword [0x5364d0]
xor eax, esp
push eax
lea eax, [esp + 0x1020]
mov dword fs:[0], eax
test edi, edi
je 0x45a371
lea esi, [esp + 0x14]
mov dword [esp + 0x14], 0
call fcn.0047fb20
xor eax, eax
push 0x7fe
push eax
lea ecx, [esp + 0x26]
push ecx
mov word [esp + 0x28], ax
call fcn.004e8fe0
mov esi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
add esp, 0xc
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x14]
push ecx
push 0
push edi
push SHChangeNotifyDeregister
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0x800
call esi
test eax, eax
jne 0x45a35d
cmp dword [esp + 0xc], 1
jne 0x45a35d
xor edx, edx
push 0x7fe
push edx
lea eax, [esp + 0x826]
push eax
mov word [esp + 0x828], dx
call fcn.004e8fe0
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x82c]
push str._s_shellexDropHandler
push edx
mov ecx, 0x400
call fcn.00428d30
push 0x800
lea eax, [esp + 0x38]
push 0
push eax
call fcn.004e8fe0
add esp, 0x24
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x14]
push eax
push 0
lea ecx, [esp + 0x82c]
push ecx
push SHChangeNotifyDeregister
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0x800
call esi
test eax, eax
jne 0x45a35d
lea esi, [esp + 0x14]
mov dword [esp + 0x1028], 0xffffffff
call fcn.0047fad0
mov eax, 1
jmp 0x45a373
lea esi, [esp + 0x14]
mov dword [esp + 0x1028], 0xffffffff
call fcn.0047fad0
xor eax, eax
mov ecx, dword [esp + 0x1020]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x1014]
xor ecx, esp
call fcn.004e3edb
add esp, 0x1024
ret
Function at 0x477760
Capabilities:
Get file attributes
Get file system object information

Disassembly:
push ebx
push esi
lea esi, [edi + 0x2b8]
call fcn.004013b0
push 0x2b4
lea ebx, [edi + 4]
push 0
push ebx
mov dword [edi + 0x2bc], 0xffffffff
call fcn.004e8fe0
mov eax, dword [edi]
add esp, 0xc
test eax, eax
je 0x477816
push 0x4209
push 0x2b4
push ebx
push 0
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov eax, dword [esi]
mov edx, dword [eax - 8]
sub eax, 0x10
mov ecx, 1
sub ecx, dword [eax + 0xc]
sub edx, 0x104
or ecx, edx
jge 0x4777ce
mov ecx, 0x104
mov eax, esi
call fcn.004014d0
mov eax, dword [esi]
push eax
mov eax, dword [edi]
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x477816
mov eax, dword [esi]
mov ecx, dword [eax - 8]
test eax, eax
je 0x4777f5
push ecx
push eax
call fcn.004e4d4d
add esp, 8
test eax, eax
jl 0x477819
mov ecx, dword [esi]
cmp eax, dword [ecx - 8]
jg 0x477819
mov dword [ecx - 0xc], eax
mov ecx, dword [esi]
xor edx, edx
mov word [ecx + eax*2], dx
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [edi + 0x2bc], eax
pop esi
pop ebx
ret
push 0x80070057
call fcn.00401540
int3

Function at 0x477b30
Capabilities:
Create thread

Disassembly:
mov edx, dword [esp + 4]
mov dword [esi + 0x60], eax
mov dword [esi + 0x68], ecx
mov dword [esi + 0x70], edx
cmp dword [esi + 0x5c], edi
je 0x477b60
test edi, edi
je 0x477b4e
mov eax, dword [edi]
mov ecx, dword [eax + 4]
push edi
call ecx
mov eax, dword [esi + 0x5c]
test eax, eax
je 0x477b5d
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
mov dword [esi + 0x5c], edi
lea ecx, [esp + 4]
push ecx
push 0
push esi
push 0x4799f0
push 0
push 0
call fcn.004e5813
add esp, 0x18
mov dword [esi + 0x64], eax
ret 4

Function at 0x477b80
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4fde5e
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x5364d0]
xor eax, esp
push eax
lea eax, [esp + 8]
mov dword fs:[0], eax
mov esi, dword [esp + 0x18]
mov eax, dword [edi]
sub eax, 0x10
call fcn.004048c0
add eax, 0x10
mov dword [esi], eax
mov dword [esp + 0x10], 0
mov eax, dword [edi + 4]
sub eax, 0x10
call fcn.004048c0
add eax, 0x10
mov dword [esi + 4], eax
mov byte [esp + 0x10], 1
mov eax, dword [edi + 8]
sub eax, 0x10
call fcn.004048c0
add eax, 0x10
mov dword [esi + 8], eax
mov byte [esp + 0x10], 2
mov eax, dword [edi + 0xc]
sub eax, 0x10
call fcn.004048c0
add eax, 0x10
mov dword [esi + 0xc], eax
mov eax, dword [edi + 0x10]
mov dword [esi + 0x10], eax
mov ecx, dword [edi + 0x14]
mov dword [esi + 0x14], ecx
mov edx, dword [edi + 0x18]
mov dword [esi + 0x18], edx
mov eax, dword [edi + 0x1c]
mov dword [esi + 0x1c], eax
mov ecx, dword [edi + 0x20]
mov dword [esi + 0x20], ecx
mov edx, dword [edi + 0x24]
mov dword [esi + 0x24], edx
mov eax, dword [edi + 0x28]
mov dword [esi + 0x28], eax
mov ecx, dword [edi + 0x30]
mov dword [esi + 0x30], ecx
mov edx, dword [edi + 0x34]
mov dword [esi + 0x34], edx
mov eax, esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0xc
ret 4
Function at 0x4a71e0
Capabilities:
Create thread

Disassembly:
push ecx
mov eax, dword [esi + 0x90]
sub eax, 0
je 0x4a720e
sub eax, 1
jne 0x4a7229
lea eax, [esp]
push eax
push 0
push esi
push 0x4a7230
push 0
push 0
call fcn.004e5813
mov dword [esi + 8], eax
add esp, 0x18
pop ecx
ret
lea ecx, [esp]
push ecx
push 0
push esi
push 0x4a75f0
push 0
push 0
call fcn.004e5813
mov dword [esi + 8], eax
add esp, 0x18
pop ecx
ret

Function at 0x4a8340
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x502b98
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5364d0]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi]
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
push eax
call ebx
mov ebp, eax
test ebp, ebp
je 0x4a850d
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4a8381
sub eax, edx
sar eax, 1
cmp eax, 4
jb 0x4a850d
push str..001
push ebp
call fcn.004e4707
add esp, 8
test eax, eax
jne 0x4a83b5
mov eax, 2
jmp 0x4a850f
push str..z01
push ebp
call fcn.004e4707
add esp, 8
test eax, eax
je 0x4a84e3
mov eax, dword [edi]
sub eax, 0x10
call fcn.004048c0
lea esi, [eax + 0x10]
mov dword [esp + 0x14], esi
mov dword [esp + 0x24], 0
cmp dword [esi - 4], 1
jle 0x4a83fc
mov eax, dword [esi - 0xc]
push eax
lea ecx, [esp + 0x18]
push ecx
call fcn.00401410
mov esi, dword [esp + 0x14]
push esi
call dword [sym.imp.SHLWAPI.dll_PathRemoveExtensionW]
mov eax, dword [esi - 8]
push eax
push esi
call fcn.004e4d4d
add esp, 8
test eax, eax
jl 0x4a8503
cmp eax, dword [esi - 8]
jg 0x4a8503
xor edx, edx
mov dword [esi - 0xc], eax
push esi
mov word [esi + eax*2], dx
call ebx
lea ecx, [esp + 0x18]
push ecx
mov ecx, eax
call fcn.00401640
mov byte [esp + 0x24], 1
mov eax, dword [esp + 0x18]
cmp dword [eax - 0xc], 0
jl 0x4a8481
push str..part
push eax
call fcn.004e4d6c
add esp, 8
test eax, eax
je 0x4a8481
sub eax, dword [esp + 0x18]
sar eax, 1
cmp eax, 0xffffffff
je 0x4a8481
lea ecx, [esp + 0x18]
call fcn.004016f0
lea ecx, [esp + 0x14]
call fcn.004016f0
mov eax, 3
jmp 0x4a850f
cmp dword [esp + 0x2c], 0
je 0x4a84ea
push str..zip
push ebp
call fcn.004e4707
add esp, 8
test eax, eax
jne 0x4a84ea
push str..z01
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x34]
push eax
call fcn.00404510
add esp, 0xc
mov byte [esp + 0x24], 2
call fcn.00404930
lea ecx, [esp + 0x2c]
call fcn.004016f0
mov eax, dword [edi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4a84ea
lea ecx, [esp + 0x18]
call fcn.004016f0
lea ecx, [esp + 0x14]
call fcn.004016f0
mov eax, 4
jmp 0x4a850f
lea ecx, [esp + 0x18]
call fcn.004016f0
lea ecx, [esp + 0x14]
call fcn.004016f0
mov eax, 1
jmp 0x4a850f
push 0x80070057
call fcn.00401540
xor eax, eax
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 4
Function at 0x4a8b60
Capabilities:
Check if file exists
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x4ff8a0
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5364d0]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi]
sub eax, 0x10
call fcn.004048c0
lea esi, [eax + 0x10]
mov dword [esp + 0x18], esi
mov ebp, 1
mov dword [esp + 0x2c], 0
cmp dword [esi - 4], ebp
jle 0x4a8bbe
mov eax, dword [esi - 0xc]
push eax
lea ecx, [esp + 0x1c]
push ecx
call fcn.00401410
mov esi, dword [esp + 0x18]
push esi
call dword [sym.imp.SHLWAPI.dll_PathRemoveExtensionW]
mov eax, dword [esi - 8]
push eax
push esi
call fcn.004e4d4d
add esp, 8
test eax, eax
jl 0x4a8cc9
cmp eax, dword [esi - 8]
jg 0x4a8cc9
mov dword [esi - 0xc], eax
xor edx, edx
mov word [esi + eax*2], dx
lea eax, [esi - 0x10]
mov dword [esp + 0x1c], eax
call fcn.004048c0
add eax, 0x10
mov dword [esp + 0x14], eax
push 4
push str..zip
lea eax, [esp + 0x1c]
push eax
mov byte [esp + 0x38], 1
call fcn.0041e520
mov ecx, dword [esp + 0x14]
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ecx
call ebx
mov eax, edi
lea edi, [esp + 0x14]
call fcn.00404930
mov edi, dword [esp + 0x14]
push edi
call ebx
mov dword [esp + 0x20], eax
test eax, eax
je 0x4a8c6b
inc ebp
cmp ebp, 0xa
push ebp
lea edi, [esp + 0x18]
push esi
jge 0x4a8c4f
push str._s.z0_d
jmp 0x4a8c54
push str._s.z_d
call fcn.00404890
mov edi, dword [esp + 0x20]
add esp, 0xc
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4a8c31
lea eax, [edi - 0x10]
mov byte [esp + 0x2c], 0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4a8c8c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x2c], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4a8cb1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
push 0x80070057
call fcn.00401540
int3
Function at 0x4a9960
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x5065d8
mov eax, dword fs:[0]
push eax
sub esp, 0x74
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5364d0]
xor eax, esp
push eax
lea eax, [esp + 0x88]
mov dword fs:[0], eax
mov eax, dword [esp + 0x98]
mov ecx, dword [eax]
or ebp, 0xffffffff
xor ebx, ebx
lea edx, [esp + 0x1c]
push edx
push 0x511ddc
push eax
mov eax, dword [ecx + 0x20]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x30], ebp
mov dword [esp + 0x34], ebp
mov dword [esp + 0x38], ebp
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x58], 0x10
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x60], ebx
mov dword [esp + 0x64], ebx
mov dword [esp + 0x68], ebx
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x70], ebx
mov dword [esp + 0x74], ebx
mov dword [esp + 0x78], ebp
mov dword [esp + 0x7c], ebp
mov dword [esp + 0x80], ebx
mov dword [esp + 0x84], ebx
mov dword [esp + 0x88], ebx
mov dword [esp + 0x54], ebp
mov dword [esp + 0x50], ebp
mov dword [esp + 0x4c], ebp
mov dword [esp + 0x48], ebp
mov dword [esp + 0x44], ebp
mov dword [esp + 0x40], ebp
call eax
mov dword [esp + 0x14], eax
cmp eax, ebx
jne 0x4a9a30
xor eax, eax
jmp 0x4a9af2
mov edx, dword [0x563288]
mov eax, dword [edx + 0xc]
mov ecx, 0x563288
call eax
lea esi, [eax + 0x10]
mov dword [esp + 0x18], esi
mov edi, dword [esp + 0x9c]
lea ecx, [esp + 0x18]
push ecx
mov dword [esp + 0x94], ebx
call int.0041ca50
lea eax, [esi - 0x10]
mov dword [esp + 0x90], ebp
lea edx, [eax + 0xc]
mov ecx, ebp
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4a9a81
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, edi
call fcn.004a9c60
mov esi, dword [esp + 0x1c]
mov edi, eax
cmp esi, ebx
jne 0x4a9a96
xor ecx, ecx
jmp 0x4a9aaf
mov ecx, esi
lea eax, [ecx + 2]
jmp 0x4a9aa0
mov dx, word [ecx]
add ecx, 2
cmp dx, bx
jne 0x4a9aa0
sub ecx, eax
sar ecx, 1
push ecx
push esi
mov eax, edi
call fcn.00401560
mov eax, dword [esp + 0x98]
mov ecx, dword [eax]
lea edx, [esp + 0x1c]
push edx
mov edx, dword [esp + 0x18]
push edx
push eax
mov eax, dword [ecx + 0x24]
call eax
test eax, eax
jne 0x4a9a30
mov eax, dword [esp + 0x98]
mov edx, dword [esp + 0x14]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x28]
call eax
mov eax, 1
mov ecx, dword [esp + 0x88]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x80
ret 8
Function at 0x4b24f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0xffffffffffffffff
push 0x4fda90
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5364d0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
xor esi, esi
mov dword [esp + 0x14], esi
xor ebp, ebp
mov dword [esp + 0x28], esi
movzx eax, word [esp + 0x30]
push 0x518f60
push eax
mov eax, dword [0x56324c]
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
mov dword [esp + 0x1c], edi
cmp edi, esi
je 0x4b2620
mov ecx, dword [0x56324c]
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebp, eax
mov dword [esp + 0x18], ebp
cmp ebp, esi
je 0x4b2620
mov edx, dword [0x56324c]
mov ebx, dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
push edx
call ebx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x4b2620
mov eax, dword [0x56324c]
push edi
push eax
call ebx
push ebp
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push edi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push eax
call fcn.004e95a0
xor ebx, ebx
add esp, 0xc
mov dword [esp + 0x30], ebx
lea ecx, [esp + 0x30]
push ecx
push ebx
push esi
mov byte [esp + 0x34], 1
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jl 0x4b25fd
mov edx, dword [esp + 0x30]
push edx
call fcn.004b24b0
mov edi, eax
add esp, 4
cmp edi, ebx
je 0x4b25fd
mov ecx, dword [edi + 4]
push ebx
lea eax, [esp + 0x18]
push eax
push ecx
call sub.gdiplus.dll_GdipCreateHBITMAPFromBitmap
cmp eax, ebx
je 0x4b25f3
mov dword [edi + 8], eax
mov dword [esp + 0x14], ebx
mov edx, dword [edi]
mov eax, dword [edx]
push 1
mov ecx, edi
call eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov byte [esp + 0x28], 0
mov eax, dword [esp + 0x30]
cmp eax, ebx
je 0x4b2620
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov esi, dword [esp + 0x14]
test ebp, ebp
je 0x4b262f
push ebp
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 4