joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c8510
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x53d058]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
lea ecx, [esi - 0x10000]
movzx eax, cx
mov edi, ecx
sub edi, eax
test eax, eax
cmove edi, ecx
cmp edi, ebx
jbe 0x4c85db
cmp edi, dword [0x53e1ac]
jb 0x4c855b
cmp edi, dword [0x53e1b0]
ja 0x4c855b
sub edi, 0x8000000
jmp 0x4c85d3
push 0x1c
lea eax, [ebp - 0x20]
mov dword [ebp - 8], 0
xorps xmm0, xmm0
push eax
push edi
movups xmmword [ebp - 0x20], xmm0
movq qword [ebp - 0x10], xmm0
call sub.KERNEL32.dll_VirtualQuery
test eax, eax
je 0x4c85db
cmp dword [ebp - 0x10], 0x10000
jne 0x4c85be
cmp dword [ebp - 0x14], 0x10000
jb 0x4c85be
push 0x40
push 0x3000
push 0x10000
push edi
call sub.KERNEL32.dll_VirtualAlloc
test eax, eax
jne 0x4c868d
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x677
je 0x4c85db
sub edi, 0x10000
jmp 0x4c85d3
mov ecx, dword [ebp - 0x1c]
add ecx, 0xffff0000
mov edi, ecx
movzx eax, di
sub edi, eax
test eax, eax
cmove edi, ecx
cmp edi, ebx
ja 0x4c8543
movzx eax, si
test eax, eax
je 0x4c85ea
sub esi, eax
add esi, 0x10000
mov edi, dword [ebp + 0x10]
cmp esi, edi
jae 0x4c868b
cmp esi, dword [0x53e1ac]
jb 0x4c860d
cmp esi, dword [0x53e1b0]
ja 0x4c860d
add esi, 0x8000000
jmp 0x4c8683
push 0x1c
lea eax, [ebp - 0x20]
mov dword [ebp - 8], 0
xorps xmm0, xmm0
push eax
push esi
movups xmmword [ebp - 0x20], xmm0
movq qword [ebp - 0x10], xmm0
call sub.KERNEL32.dll_VirtualQuery
test eax, eax
je 0x4c868b
cmp dword [ebp - 0x10], 0x10000
mov ecx, dword [ebp - 0x14]
jne 0x4c866e
cmp ecx, 0x10000
jb 0x4c866e
push 0x40
push 0x3000
push 0x10000
push esi
call sub.KERNEL32.dll_VirtualAlloc
test eax, eax
jne 0x4c868d
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x677
je 0x4c868b
add esi, 0x10000
jmp 0x4c8683
mov esi, dword [ebp - 0x20]
add esi, ecx
movzx ecx, si
test ecx, ecx
je 0x4c8683
mov eax, 0x10000
sub eax, ecx
add esi, eax
cmp esi, edi
jb 0x4c85f5
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0049852a
mov esp, ebp
pop ebp
ret
Function at 0x4c89b0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x5395d0
push 0x4cf080
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x53d058]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov eax, dword [ebp + 8]
push 0x1c
lea ecx, [ebp - 0x38]
push ecx
push eax
call sub.KERNEL32.dll_VirtualQuery
mov dword [ebp - 4], 0
mov eax, 0x5a4d
mov ecx, dword [ebp - 0x34]
cmp word [ecx], ax
jne 0x4c8a55
mov edx, dword [ecx + 0x3c]
cmp dword [edx + ecx], 0x4550
jne 0x4c8a55
mov esi, dword [edx + ecx + 0xd8]
lea eax, [esi + ecx]
cmp dword [ebp + 0xc], eax
jb 0x4c8a55
mov eax, dword [edx + ecx + 0xdc]
add eax, esi
add eax, ecx
cmp dword [ebp + 0xc], eax
jae 0x4c8a55
mov dword [ebp - 4], 0xfffffffe
mov al, 1
jmp 0x4c8a5e
mov dword [ebp - 4], 0xfffffffe
xor al, al
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.0049852a
mov esp, ebp
pop ebp
ret
Function at 0x4c9000
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x53d058]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [0x544bc4], eax
je 0x4c903c
pop edi
mov eax, 0x10dd
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049852a
mov esp, ebp
pop ebp
ret 8
mov eax, dword [0x544bc8]
test eax, eax
jne 0x4c9166
test edi, edi
jne 0x4c9062
lea eax, [edi + 0x57]
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049852a
mov esp, ebp
pop ebp
ret 8
test ebx, ebx
je 0x4c907b
cmp dword [ebx], 0
jne 0x4c9092
mov dword [0x544bc8], 6
mov dword [0x544bcc], ebx
pop edi
mov eax, 6
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049852a
mov esp, ebp
pop ebp
ret 8
push esi
push 0x18
call fcn.00498569
mov esi, eax
add esp, 4
test esi, esi
jne 0x4c90ab
lea edi, [eax + 8]
jmp 0x4c9148
push 0
push dword [ebx]
call fcn.004c8f70
push 0
push edi
mov dword [ebp - 0xc], eax
call fcn.004c8f70
mov edi, dword [ebp - 0xc]
mov edx, eax
movzx ecx, byte [edi + 0x36]
mov eax, dword [edi + 0x40]
sub eax, ecx
mov dword [ebp - 0xc], eax
test ecx, ecx
je 0x4c913a
cmp ecx, 0x1e
ja 0x4c913a
cmp dword [edi + 0x44], edx
jne 0x4c913a
lea edx, [ebp - 8]
mov dword [ebp - 8], 0
push edx
push 0x40
push ecx
push eax
call sub.KERNEL32.dll_VirtualProtect
test eax, eax
jne 0x4c90ff
call sub.KERNEL32.dll_GetLastError
mov edi, eax
jmp 0x4c9148
mov eax, dword [ebp - 0xc]
mov dword [esi + 0xc], eax
mov dword [esi + 8], ebx
mov dword [esi + 0x10], edi
mov dword [esi + 4], 1
mov eax, dword [ebp - 8]
mov dword [esi + 0x14], eax
mov eax, dword [0x544bd4]
mov dword [esi], eax
xor eax, eax
mov dword [0x544bd4], esi
pop esi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049852a
mov esp, ebp
pop ebp
ret 8
cmp dword [0x544bbc], 0
mov edi, 9
jne 0x4c9152
mov dword [0x544bc8], edi
test esi, esi
je 0x4c915d
push 0x18
push esi
call fcn.0049855b
add esp, 8
mov dword [0x544bcc], ebx
mov eax, edi
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.0049852a
mov esp, ebp
pop ebp
ret 8
Function at 0x4c9180
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x53d058]
xor eax, ebp
mov dword [ebp - 4], eax
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [0x544bc4], eax
je 0x4c91b0
mov eax, 0x10dd
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049852a
mov esp, ebp
pop ebp
ret
push esi
mov esi, dword [0x544bd4]
push edi
test esi, esi
je 0x4c921d
push ebx
nop dword [eax]
lea eax, [ebp - 8]
push eax
mov eax, dword [esi + 0x10]
push dword [esi + 0x14]
movzx eax, byte [eax + 0x36]
push eax
push dword [esi + 0xc]
call sub.KERNEL32.dll_VirtualProtect
cmp dword [esi + 4], 0
jne 0x4c9209
mov ebx, dword [esi + 0x10]
test ebx, ebx
je 0x4c9209
push 0x48
push 0
mov edi, ebx
push ebx
and edi, 0xffff0000
call fcn.004cdf10
mov eax, dword [edi + 8]
add esp, 0xc
mov dword [ebx + 0x40], eax
mov dword [edi + 8], ebx
mov dword [esi + 0x10], 0
mov edi, dword [esi]
push 0x18
push esi
call fcn.0049855b
add esp, 8
mov esi, edi
test edi, edi
jne 0x4c91c0
pop ebx
mov dword [0x544bd4], 0
call sub.KERNEL32.dll_GetCurrentProcess
mov esi, dword [0x544bb4]
mov edi, eax
test esi, esi
je 0x4c925c
lea eax, [ebp - 8]
push eax
push 0x20
push 0x10000
push esi
call sub.KERNEL32.dll_VirtualProtect
push 0x10000
push esi
push edi
call sub.KERNEL32.dll_FlushInstructionCache
mov esi, dword [esi + 4]
test esi, esi
jne 0x4c9238
mov edi, dword [0x544bd0]
test edi, edi
je 0x4c9281
push dword [edi + 4]
call sub.KERNEL32.dll_ResumeThread
mov esi, dword [edi]
push 8
push edi
call fcn.0049855b
add esp, 8
mov edi, esi
test esi, esi
jne 0x4c9266
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
mov dword [0x544bd0], 0
mov dword [0x544bc4], 0
pop esi
call fcn.0049852a
mov esp, ebp
pop ebp
ret

Function at 0x4c92b0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x53d058]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x544bc4], 0
jne 0x4c934b
call sub.KERNEL32.dll_GetCurrentThreadId
mov ecx, eax
mov edx, 0x544bc4
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x4c934b
push esi
mov esi, dword [0x544bb4]
mov dword [0x544bd4], eax
mov dword [0x544bd0], eax
mov dword [0x544bcc], eax
test esi, esi
je 0x4c931c
nop dword [eax]
lea eax, [ebp - 8]
push eax
push 0x40
push 0x10000
push esi
call sub.KERNEL32.dll_VirtualProtect
test eax, eax
je 0x4c9332
mov esi, dword [esi + 4]
test esi, esi
jne 0x4c9300
xor eax, eax
mov dword [0x544bc8], eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049852a
mov esp, ebp
pop ebp
ret
call sub.KERNEL32.dll_GetLastError
mov dword [0x544bc8], eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049852a
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 0x10dd
xor ecx, ebp
call fcn.0049852a
mov esp, ebp
pop ebp
ret
Function at 0x4c9810
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x544bc8]
test eax, eax
jne 0x4c988f
push edi
call sub.KERNEL32.dll_GetCurrentThread
mov edi, dword [ebp + 8]
cmp edi, eax
jne 0x4c9830
xor eax, eax
pop edi
pop ebp
ret 4
push esi
push 8
call fcn.00498569
mov esi, eax
add esp, 4
test esi, esi
jne 0x4c9846
lea edi, [eax + 8]
jmp 0x4c9863
push edi
call sub.KERNEL32.dll_SuspendThread
cmp eax, 0xffffffff
jne 0x4c987b
call sub.KERNEL32.dll_GetLastError
mov edi, eax
push 8
push esi
call fcn.0049855b
add esp, 8
pop esi
mov dword [0x544bc8], edi
mov eax, edi
mov dword [0x544bcc], 0
pop edi
pop ebp
ret 4
mov eax, dword [0x544bd0]
mov dword [esi + 4], edi
mov dword [esi], eax
xor eax, eax
mov dword [0x544bd0], esi
pop esi
pop edi
pop ebp
ret 4
Function at 0x4cbb60
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x504bd8
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x53d058]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
push 2
push edi
call fcn.0048617b
lea esi, [edi + 0x30]
mov dword [ebp - 4], 0
push 0x2c
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00498569
add esp, 0xc
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov ecx, edi
mov byte [ebp - 4], 1
call fcn.004cbf50
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4e5167
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004e4fdd

Function at 0x4eb893
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004eb510
Function at 0x409e90
Capabilities:
Hide graphical window

Disassembly:
push esi
push edi
push 0xfffffffffffffff0
push dword [esp + 0x10]
mov esi, ecx
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov cl, byte [esi + 8]
mov edi, eax
test edi, 0x10000000
je 0x409ed2
push dword [esp + 0xc]
or cl, 4
mov byte [esi + 8], cl
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x409ecd
test edi, 0x21000000
jne 0x409ecd
or byte [esi + 8], 2
mov cl, byte [esi + 8]
jmp 0x409ed8
and cl, 0xfd
mov byte [esi + 8], cl
test cl, 2
je 0x409ee9
mov ecx, esi
call fcn.0040a6a0
pop edi
pop esi
ret 4
push 0
push dword [esi + 0x40]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
ret 4
Function at 0x40df60
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x524e58
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x58a87c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor ecx, ecx
mov bl, 1
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 7
mov word [ebp - 0x34], cx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], ecx
lea ecx, [ebp - 0x34]
cmp ecx, eax
je 0x40dfcd
cmp dword [eax + 0x14], 8
mov ecx, eax
jb 0x40dfc1
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
lea ecx, [ebp - 0x34]
call fcn.00407120
lea eax, [ebp - 0x34]
push eax
push 0x40deb0
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [ebp - 0x18]
xor esi, esi
mov edx, dword [ebp - 0x1c]
sub eax, edx
sar eax, 2
test eax, eax
je 0x40e020
mov edi, dword [sym.imp.USER32.dll_SendMessageTimeoutW]
push 0
push 0xbb8
push 3
push 0
push 0
push 0x464
push dword [edx + esi*4]
call edi
mov ecx, dword [ebp - 0x18]
neg eax
mov edx, dword [ebp - 0x1c]
sbb al, al
sub ecx, edx
inc esi
sar ecx, 2
and bl, al
cmp esi, ecx
jb 0x40dff3
lea ecx, [ebp - 0x34]
call fcn.0040e050
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ef136
mov esp, ebp
pop ebp
ret 4

Function at 0x412b20
Capabilities:
Check for peb ntglobalflag flag

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5254f4
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x58a87c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.00406eb0
mov dword [ebp - 4], 0
lea ecx, [esi + 0x18]
call fcn.00406eb0
mov byte [ebp - 4], 1
lea ecx, [esi + 0x30]
call fcn.00406eb0
mov byte [ebp - 4], 2
lea ecx, [esi + 0x48]
call fcn.00406eb0
mov byte [ebp - 4], 3
lea ecx, [esi + 0x70]
mov word [esi + 0x60], 0x101
mov dword [esi + 0x64], 0
mov dword [esi + 0x68], 0
mov dword [esi + 0x6c], 0
call fcn.00406eb0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x414380
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x525a00
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x58a87c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov ecx, edi
call fcn.00406d60
test al, al
je 0x4143c0
xor al, al
jmp 0x41457b
push edi
call fcn.00413a50
add esp, 4
test al, al
je 0x4143d4
mov al, 1
jmp 0x41457b
push 0
mov ecx, edi
call fcn.00406d70
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push eax
call ebx
test eax, eax
jne 0x414423
lea ecx, [ebp - 0x28]
call fcn.00406eb0
mov dword [ebp - 4], 0
lea edx, [ebp - 0x28]
mov ecx, edi
call fcn.004367c0
test al, al
je 0x414414
push 0
lea ecx, [ebp - 0x28]
call fcn.00406d70
push eax
call ebx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00406de0
push edi
call fcn.00413a50
add esp, 4
test al, al
jne 0x4143cd
mov ecx, edi
call fcn.00407110
xor esi, esi
mov dword [ebp - 0x44], eax
test eax, eax
je 0x41451c
mov ecx, edi
call fcn.00403750
mov ebx, eax
nop dword [eax]
mov ecx, dword [ebx + 0x14]
mov eax, ebx
cmp ecx, 8
jb 0x41445c
mov eax, dword [ebx]
mov edx, 0x2f
cmp dx, word [eax + esi*2]
mov edx, 0x5c
je 0x41447f
mov eax, ebx
cmp ecx, 8
jb 0x414475
mov eax, dword [ebx]
cmp dx, word [eax + esi*2]
jne 0x41450c
push esi
push 0
lea eax, [ebp - 0x28]
mov ecx, edi
push eax
call fcn.00406cc0
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x28]
call fcn.00406d60
test al, al
jne 0x4144fd
lea eax, [ebp - 0x28]
push eax
call fcn.00413830
add esp, 4
test al, al
jne 0x4144fd
push 0
lea ecx, [ebp - 0x28]
call fcn.00406d70
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x4144fd
lea ecx, [ebp - 0x40]
call fcn.00406eb0
mov byte [ebp - 4], 2
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0x28]
call fcn.004367c0
test al, al
je 0x4144f1
push 0
lea ecx, [ebp - 0x40]
call fcn.00406d70
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x40]
call fcn.00406de0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00406de0
inc esi
cmp esi, dword [ebp - 0x44]
jb 0x414450
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push edi
call fcn.00413830
add esp, 4
test al, al
jne 0x414572
push 0
mov ecx, edi
call fcn.00406d70
push eax
call ebx
test eax, eax
jne 0x414572
lea ecx, [ebp - 0x40]
call fcn.00406eb0
mov dword [ebp - 4], 3
lea edx, [ebp - 0x40]
mov ecx, edi
call fcn.004367c0
test al, al
je 0x414563
push 0
lea ecx, [ebp - 0x40]
call fcn.00406d70
push eax
call ebx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.00406de0
push edi
call fcn.00413a50
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ef136
mov esp, ebp
pop ebp
ret
Function at 0x415620
Capabilities:
Check mutex on windows

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esp + 8]
mov dword [esi], 0
mov word [esi + 4], 0
call fcn.00406d60
test al, al
jne 0x415647
mov ecx, dword [esp + 8]
call fcn.00406d70
jmp 0x415649
xor eax, eax
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi], eax
test eax, eax
je 0x415671
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
mov eax, esi
jne 0x415673
mov byte [esi + 5], 1
pop esi
ret 4
mov eax, esi
pop esi
ret 4

Function at 0x4156d0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x525ca8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x58a87c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [edi]
test eax, eax
je 0x415716
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi], 0
lea ecx, [ebp - 0x14]
mov word [edi + 4], 0
mov dword [ebp - 0x14], 0
call fcn.0042c880
mov dword [ebp - 4], 0
mov esi, dword [ebp - 0x14]
cmp dword [esi], 0
je 0x41573f
lea ebx, [esi + 8]
jmp 0x415741
xor ebx, ebx
mov ecx, dword [ebp - 0x18]
call fcn.00406d60
test al, al
jne 0x415757
mov ecx, dword [ebp - 0x18]
call fcn.00406d70
jmp 0x415759
xor eax, eax
push eax
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [edi], eax
test eax, eax
je 0x41577a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x41577a
mov byte [edi + 5], 1
cmp dword [edi], 0
setne bl
mov dword [ebp - 4], 0xffffffff
mov eax, dword [esi]
test eax, eax
je 0x4157a3
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x4157b8
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [esi + 4], 0
push 0x2c
push esi
call fcn.004ef177
add esp, 8
mov dword [ebp - 0x14], 0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ef136
mov esp, ebp
pop ebp
ret 4
Function at 0x4157f0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x525cd8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x58a87c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi]
mov ebx, dword [ebp + 8]
test eax, eax
je 0x415833
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi], 0
push ecx
lea ecx, [ebp - 0x14]
mov word [edi + 4], 0
mov dword [ebp - 0x14], 0
call fcn.0042c940
mov dword [ebp - 4], 0
mov esi, dword [ebp - 0x14]
cmp dword [esi], 0
je 0x415860
lea eax, [esi + 8]
mov dword [ebp - 0x18], eax
jmp 0x415867
mov dword [ebp - 0x18], 0
mov ecx, ebx
call fcn.00406d60
test al, al
jne 0x41587b
mov ecx, ebx
call fcn.00406d70
jmp 0x41587d
xor eax, eax
push eax
push 0
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov ecx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi], eax
test eax, eax
jne 0x4158ce
call ecx
cmp eax, 5
jne 0x4158c8
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, ebx
call fcn.00406d60
test al, al
jne 0x4158b8
mov ecx, ebx
call fcn.00406d70
jmp 0x4158ba
xor eax, eax
push eax
push 0
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [edi], eax
mov ecx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [edi]
test eax, eax
je 0x4158ec
call ecx
cmp eax, 0xb7
jne 0x4158e1
mov byte [edi + 5], 1
mov ecx, dword [edi]
call fcn.0042b600
mov eax, dword [edi]
test eax, eax
setne bl
mov dword [ebp - 4], 0xffffffff
mov eax, dword [esi]
test eax, eax
je 0x415912
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x415927
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [esi + 4], 0
push 0x2c
push esi
call fcn.004ef177
add esp, 8
mov dword [ebp - 0x14], 0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ef136
mov esp, ebp
pop ebp
ret 4
Function at 0x4183e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
lea ebp, [esp - 0x418]
sub esp, 0x418
push 0xfffffffffffffffe
push 0x56d198
push 0x4f13c0
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x58a87c]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp + 0x414], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov edi, ecx
mov eax, dword [ebp + 0x420]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x424]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x428]
mov dword [ebp - 0x20], eax
xor bl, bl
mov byte [ebp - 0x19], bl
push 0x412
push 0
lea eax, [ebp]
push eax
call fcn.004f1ee0
add esp, 0xc
lea eax, [ebp]
push eax
mov ecx, edi
call fcn.00418200
cmp byte [edi + 0x30], bl
je 0x418492
lea eax, [ebp]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4184b7
test al, 0x10
jne 0x4184b7
call fcn.0041ab60
push 0
lea ecx, [ebp]
push ecx
mov ecx, eax
call fcn.0041ae50
test al, al
je 0x4184b7
mov dword [edi + 0x34], 0
lea eax, [ebp]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
mov dword [ebp - 4], 0
test esi, esi
jne 0x4184bb
mov dword [ebp - 4], 0xfffffffe
xor al, al
jmp 0x41851c
push str.ExtractArchive
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4184ea
mov dword [edi + 0x34], esi
push edi
push 0x418100
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push dword [ebp - 0x28]
call eax
add esp, 0x14
test eax, eax
sete bl
mov byte [ebp - 0x19], bl
mov dword [edi + 0x34], 0
mov dword [ebp - 4], 0xfffffffe
jmp 0x41850f
test esi, esi
je 0x41851a
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov al, bl
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x414]
xor ecx, ebp
call fcn.004ef136
lea esp, [ebp + 0x418]
pop ebp
ret 0xc
Function at 0x418550
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
lea ebp, [esp - 0x418]
sub esp, 0x418
push 0xfffffffffffffffe
push 0x56d1b8
push 0x4f13c0
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x58a87c]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp + 0x414], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov edi, ecx
mov eax, dword [ebp + 0x420]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x424]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x428]
mov dword [ebp - 0x20], eax
xor bl, bl
mov byte [ebp - 0x19], bl
push 0x412
push 0
lea eax, [ebp]
push eax
call fcn.004f1ee0
add esp, 0xc
lea eax, [ebp]
push eax
mov ecx, edi
call fcn.00418200
cmp byte [edi + 0x30], bl
je 0x418602
lea eax, [ebp]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x418627
test al, 0x10
jne 0x418627
call fcn.0041ab60
push 0
lea ecx, [ebp]
push ecx
mov ecx, eax
call fcn.0041ae50
test al, al
je 0x418627
mov dword [edi + 0x34], 0
lea eax, [ebp]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
mov dword [ebp - 4], 0
test esi, esi
jne 0x41862b
mov dword [ebp - 4], 0xfffffffe
xor al, al
jmp 0x41868f
push str.ExtractArchive2
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41865d
mov dword [edi + 0x34], esi
push dword [edi + 0x38]
push edi
push 0x418100
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push dword [ebp - 0x28]
call eax
add esp, 0x18
test eax, eax
sete bl
mov byte [ebp - 0x19], bl
mov dword [edi + 0x34], 0
mov dword [ebp - 4], 0xfffffffe
jmp 0x418682
test esi, esi
je 0x41868d
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov al, bl
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x414]
xor ecx, ebp
call fcn.004ef136
lea esp, [ebp + 0x418]
pop ebp
ret 0xc