joyce8/EMBER2024-capa huggingface dataset:
Function at 0x442f20
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0
mov esi, ecx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x442f95
push ebx
push edi
call dword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
je 0x442f8d
mov eax, dword [esi + 0x10]
lea ebx, [eax + eax]
lea eax, [ebx + 2]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x442f8d
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
cmp dword [esi + 0x14], 8
mov dword [ebp - 4], eax
jb 0x442f69
mov esi, dword [esi]
push ebx
push esi
push eax
call fcn.004ad230
mov eax, dword [ebp - 4]
add esp, 0xc
xor ecx, ecx
push edi
mov word [ebx + eax], cx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x444240
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dde38
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5203c4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xor eax, eax
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov dword [ebp - 4], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], 7
mov word [esi + 0x18], ax
mov byte [ebp - 4], 1
mov eax, dword [ebp + 8]
mov edx, eax
lea ebx, [edx + 2]
mov cx, word [edx]
add edx, 2
test cx, cx
jne 0x4442a4
sub edx, ebx
lea ecx, [esi + 0x18]
sar edx, 1
push edx
push eax
call fcn.00408d10
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x30], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x34], eax
mov eax, esi
mov dword [esi + 0x3c], 0
mov dword [esi + 0x38], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x445b50
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ddecb
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5203c4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xor eax, eax
mov dword [esi + 0x20], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 7
mov word [esi + 0x20], ax
mov dword [ebp - 4], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], 7
mov word [esi + 0x38], ax
lea ecx, [esi + 0x54]
mov byte [ebp - 4], 1
call fcn.00445500
mov dword [esi + 0xd4], 0
xor eax, eax
mov word [esi + 0xd4], ax
mov dword [esi + 0xe4], 0
mov dword [esi + 0xe8], 7
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 8], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x50], eax
mov dword [esi + 0xc8], eax
mov dword [esi + 0xcc], eax
mov eax, esi
mov dword [esi + 0xc], 0x4000
mov dword [esi + 0xd0], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x446330
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov ebx, ecx
push edi
mov edi, dword [ebp + 8]
push dword [ebx]
push 1
push dword [ebx + 8]
push edi
call fcn.004c448e
mov esi, dword [ebx + 8]
mov ecx, eax
add esp, 0x10
cmp ecx, 1
sete al
mov byte [esp + 0x13], al
mov eax, esi
cdq
idiv dword [ebx + 0x18]
mov dword [ebx + 0x1c], eax
cmp ecx, 1
jne 0x4464c5
add dword [ebx + 0x14], esi
cmp dword [ebx + 0x4c], 8
push 0xffffffffffffffff
push eax
lea eax, [ebx + 0x38]
push ecx
mov ecx, esp
jb 0x446386
mov eax, dword [eax]
mov dword [ecx], eax
mov edx, 0x18
push ecx
mov eax, esp
lea ecx, [ebx + 0x20]
mov dword [eax], str.read
call fcn.00444040
mov eax, dword [ebx + 0x1c]
add esp, 0x10
mov edx, dword [ebx + 0x18]
xor ecx, ecx
mov dword [esp + 0x14], 0
mov esi, edi
mov dword [esp + 0x1c], edx
test eax, eax
je 0x446474
mov edi, edx
jmp 0x4463cb
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
dec eax
mov dword [esp + 0x18], eax
cmp edx, 1
jne 0x4463db
xor edx, edx
cmp byte [esi], dl
jmp 0x4463e0
xor edx, edx
cmp word [esi], dx
sete dl
mov eax, edi
test edx, edx
je 0x446418
test ecx, ecx
je 0x44640a
cmp esi, ecx
je 0x44640a
imul edi, dword [esp + 0x14]
mov eax, esi
sub eax, ecx
push eax
push ecx
sub ecx, edi
push ecx
call fcn.004ad230
mov eax, dword [ebx + 0x18]
add esp, 0xc
mov edx, dword [esp + 0x14]
lea ecx, [eax + esi]
inc edx
mov dword [esp + 0x14], edx
jmp 0x44641c
mov edx, dword [esp + 0x14]
add esi, eax
mov edi, eax
cmp dword [esp + 0x18], 0
jne 0x4463c3
test ecx, ecx
je 0x446441
cmp esi, ecx
je 0x446441
sub esi, ecx
imul eax, edx
push esi
push ecx
sub ecx, eax
push ecx
call fcn.004ad230
add esp, 0xc
mov esi, dword [esp + 0x14]
test esi, esi
je 0x446471
push 0xffffffffffffffff
push esi
push ecx
mov eax, esp
mov edx, 1
push ecx
lea ecx, [ebx + 0x20]
mov dword [eax], 0
mov eax, esp
mov dword [eax], str.nulls_removed
call fcn.00444040
add esp, 0x10
sub dword [ebx + 0x1c], esi
mov edi, dword [ebp + 8]
cmp dword [ebx + 0x18], 1
jle 0x4464c5
test byte [ebx + 4], 0x80
je 0x4464c5
mov ecx, dword [ebx + 0x1c]
test ecx, ecx
je 0x4464a2
nop word [eax + eax]
movzx eax, word [edi + ecx*2 - 2]
dec ecx
rol ax, 8
mov word [edi + ecx*2], ax
test ecx, ecx
jne 0x446490
push 0xffffffffffffffff
push 0xffffffffffffffff
push ecx
mov eax, esp
xor edx, edx
push ecx
lea ecx, [ebx + 0x20]
mov dword [eax], 0
mov eax, esp
mov dword [eax], str.endian_swap
call fcn.00444040
add esp, 0x10
mov al, byte [esp + 0x13]
test al, al
jne 0x4464d8
mov ecx, ebx
call fcn.00445c30
mov al, byte [esp + 0x13]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x459410
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4de3ed
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x5203c4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov dword [ebp - 0x3c], ebx
mov esi, ecx
mov dword [ebp - 0x30], esi
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x38], eax
test ebx, ebx
jne 0x459462
mov dword [esi], edx
mov dword [esi + 4], edx
jmp 0x4595ce
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x18], 0xf
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push ebx
push 0
mov dword [ebp - 4], 0
push 0
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x2c], 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
test edi, edi
jle 0x4594d2
push 0
lea ecx, [edi - 1]
push ecx
lea ecx, [ebp - 0x2c]
call fcn.00413860
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x4594d2
cmp dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x2c]
push 0
cmovae eax, dword [ebp - 0x2c]
push 0
push ecx
push eax
lea eax, [edi - 1]
push eax
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x2c]
push 0x5055f4
cmovae eax, dword [ebp - 0x2c]
push eax
call fcn.004c315a
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x459584
push 2
push 0
push ebx
call fcn.004c3f6c
add esp, 0xc
push ebx
call fcn.004c39ad
add esp, 4
mov edi, eax
mov dword [ebp - 0x30], edi
push 0
push 0
push ebx
call fcn.004c3f6c
add esp, 0xc
lea ecx, [edi + 1]
push ecx
call fcn.004b778c
mov edi, eax
add esp, 4
test edi, edi
je 0x45956e
push ebx
push dword [ebp - 0x30]
push 1
push edi
call fcn.004c448e
mov ecx, dword [ebp - 0x30]
add esp, 0x10
cmp eax, ecx
jne 0x45956e
push ebx
mov byte [ecx + edi], 0
call fcn.004c3364
movss xmm2, dword [0x5092e4]
add esp, 4
mov ecx, edi
call fcn.00454cf0
push edi
mov ebx, eax
call fcn.004b7771
add esp, 4
jmp 0x459586
push ebx
call fcn.004c3364
add esp, 4
test edi, edi
je 0x459584
push edi
call fcn.004b7771
add esp, 4
xor ebx, ebx
push dword [ebp - 0x38]
mov edx, ebx
mov ecx, esi
push dword [ebp - 0x34]
push dword [ebp + 8]
push dword [ebp - 0x3c]
call fcn.00459000
mov edx, dword [ebp - 0x18]
add esp, 0x10
cmp edx, 0x10
jb 0x4595ce
mov ecx, dword [ebp - 0x2c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4595c4
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4595ec
push edx
push ecx
call fcn.004a8c37
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004a8e4e
mov esp, ebp
pop ebp
ret
call fcn.004b040f
int3
Function at 0x46f1e0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4deb8d
mov eax, dword fs:[0]
push eax
sub esp, 0x6c
mov eax, dword [0x5203c4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
mov edx, esi
cmp dword [esi + 0x14], 8
jb 0x46f21a
mov edx, dword [esi]
cmp dword [edi + 0x524], 8
lea eax, [edi + 0x510]
jb 0x46f22f
mov eax, dword [edi + 0x510]
mov ebx, dword [esi + 0x10]
mov ecx, dword [edi + 0x520]
cmp ecx, ebx
mov dword [ebp - 0x74], ebx
lea ebx, [edi + 0x510]
jne 0x46f26b
test ecx, ecx
je 0x46f3cd
sub eax, edx
mov dword [ebp - 0x78], eax
mov ax, word [eax + edx]
cmp ax, word [edx]
jne 0x46f26b
mov eax, dword [ebp - 0x78]
add edx, 2
sub ecx, 1
jne 0x46f252
jmp 0x46f3cd
cmp ebx, esi
je 0x46f282
cmp dword [esi + 0x14], 8
jb 0x46f277
mov esi, dword [esi]
push dword [ebp - 0x74]
mov ecx, ebx
push esi
call fcn.00408d10
mov ecx, dword [edi + 0x50c]
test ecx, ecx
je 0x46f29c
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [edi + 0x50c], 0
push ebx
lea ecx, [ebp - 0x28]
call fcn.004088c0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmovae eax, dword [ebp - 0x28]
push eax
call esi
test eax, eax
jne 0x46f330
push 0x5213b0
lea ecx, [ebp - 0x40]
call fcn.004088c0
mov byte [ebp - 4], 1
mov eax, dword [edi + 0x28c]
add eax, 0x1fc
cmp dword [eax + 0x14], 8
jb 0x46f2e8
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x70]
push eax
call fcn.0041c250
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
push ecx
mov edx, eax
lea ecx, [ebp - 0x58]
call fcn.0041c2c0
add esp, 0x10
lea ecx, [ebp - 0x28]
push eax
call fcn.0040b440
lea ecx, [ebp - 0x58]
call fcn.004074f0
lea ecx, [ebp - 0x70]
call fcn.004074f0
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0
call fcn.004074f0
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call esi
test eax, eax
je 0x46f3c5
push 0x10
call dword [sym.imp.gdiplus.dll_GdipAlloc]
mov esi, eax
mov dword [ebp - 0x74], esi
test esi, esi
je 0x46f37e
cmp dword [ebp - 0x14], 8
lea eax, [esi + 4]
lea ecx, [ebp - 0x28]
cmovae ecx, dword [ebp - 0x28]
push eax
push ecx
mov dword [esi], vtable.Gdiplus::Image.0
mov dword [eax], 0
call dword [sym.imp.gdiplus.dll_GdipLoadImageFromFile]
mov dword [esi + 8], eax
jmp 0x46f380
xor esi, esi
mov dword [edi + 0x50c], esi
mov eax, dword [esi + 8]
mov dword [esi + 8], 0
test eax, eax
jne 0x46f3c5
cmp byte [edi + 0x4f9], al
mov esi, dword [edi + 0x50c]
sete al
lea eax, [eax*2 + 1]
push eax
push dword [esi + 4]
call dword [sym.imp.gdiplus.dll_GdipImageRotateFlip]
test eax, eax
je 0x46f3bb
mov dword [esi + 8], eax
push 0
lea ecx, [edi + 4]
call fcn.00437020
lea ecx, [ebp - 0x28]
call fcn.004074f0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a8e4e
mov esp, ebp
pop ebp
ret 4
Function at 0x473ec5
Capabilities:
Check os version

Disassembly:
mov eax, dword fs:[0x18]
sub esp, 0x74
mov eax, dword [eax + 0x30]
cmp dword [eax + 0xa4], 6
jae 0x4740a9
cmp dword [0x527b28], 0
jne 0x4740a2
push ebx
push ebp
push edi
xor ebp, ebp
mov edx, str.NtOpenKeyedEvent
push ebp
mov ecx, 0x51f028
call fcn.00474764
mov ebx, eax
test ebx, ebx
jne 0x473f15
push ebp
push ebp
push 1
push 0xc0000264
call dword [sym.imp.KERNEL32.dll_RaiseException]
push 0x5c
pop edx
push 0x4b
pop eax
push 0x65
pop ecx
push 0x72
mov word [esp + 0x36], ax
pop eax
push 0x6e
mov word [esp + 0x3a], ax
pop eax
push 0x6c
mov word [esp + 0x3c], ax
pop eax
push 0x4f
pop edi
push 0x62
mov word [esp + 0x40], ax
pop eax
push 0x6a
mov word [esp + 0x44], ax
pop eax
push 0x63
mov word [esp + 0x46], ax
mov word [esp + 0x38], cx
mov word [esp + 0x3e], cx
mov word [esp + 0x48], cx
pop ecx
push 0x74
pop ebp
push 0x73
pop eax
push 0x43
mov word [esp + 0x4e], ax
pop eax
push 0x72
mov word [esp + 0x52], ax
mov word [esp + 0x34], dx
mov word [esp + 0x50], dx
pop edx
push 0x69
pop eax
push 0x53
mov word [esp + 0x56], ax
pop eax
push 0x65
mov word [esp + 0x5a], ax
pop eax
push 0x75
mov word [esp + 0x5c], ax
pop eax
push 0x66
mov word [esp + 0x62], ax
pop eax
push 0x4d
mov word [esp + 0x68], ax
pop eax
push 0x65
mov word [esp + 0x4a], cx
mov word [esp + 0x5e], cx
pop ecx
push 0x6d
mov word [esp + 0x6a], ax
pop eax
push 0x6f
mov word [esp + 0x6e], ax
pop eax
push 0x79
mov word [esp + 0x70], ax
pop eax
mov word [esp + 0x3e], di
mov word [esp + 0x48], bp
mov word [esp + 0x50], dx
mov word [esp + 0x54], bp
mov word [esp + 0x5c], di
mov word [esp + 0x60], bp
mov word [esp + 0x62], di
mov word [esp + 0x68], cx
mov word [esp + 0x6e], dx
mov word [esp + 0x70], ax
push 0x45
pop eax
mov word [esp + 0x72], ax
lea edi, [esp + 0x24]
push 0x76
pop eax
mov word [esp + 0x74], ax
push 0x6e
pop eax
mov word [esp + 0x78], ax
xor eax, eax
mov word [esp + 0x7c], ax
push 0x4c
pop eax
mov word [esp + 0x10], ax
mov word [esp + 0x12], ax
lea eax, [esp + 0x30]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x10]
mov dword [esp + 0x20], eax
xor eax, eax
mov word [esp + 0x7a], bp
xor ebp, ebp
mov dword [esp + 0x18], 0x18
mov dword [esp + 0x1c], ebp
stosd dword es:[edi], eax
mov word [esp + 0x76], cx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [esp + 0x18]
push eax
push 0x2000000
lea eax, [esp + 0x14]
push eax
call ebx
test eax, eax
jns 0x474083
push ebp
push ebp
push 1
push 0xc0000264
call dword [sym.imp.KERNEL32.dll_RaiseException]
mov ecx, dword [esp + 0xc]
mov edx, 0x527b28
xor eax, eax
lock cmpxchg dword [edx], ecx
pop edi
pop ebp
pop ebx
test eax, eax
je 0x4740a2
push dword [esp]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x527b28]
jmp 0x4740ab
xor eax, eax
add esp, 0x74
ret
Function at 0x474833
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
cmp byte [0x527b34], 0
push esi
mov esi, ecx
je 0x47485b
push 0x800
push 0
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
jmp 0x47491d
push ebx
push edi
test esi, esi
je 0x474919
xor ebx, ebx
cmp word [esi], bx
je 0x474919
mov edi, 0x200
lea eax, [ebp - 0x404]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov ecx, eax
test ecx, ecx
je 0x474919
cmp ecx, edi
jae 0x474919
push 0x5c
pop eax
mov word [ebp + ecx*2 - 0x404], ax
inc ecx
cmp ecx, edi
jae 0x474919
movzx eax, word [esi]
test ax, ax
je 0x4748c9
mov edx, eax
mov word [ebp + ecx*2 - 0x404], dx
inc ecx
cmp ecx, edi
jae 0x474919
add esi, 2
movzx eax, word [esi]
mov edx, eax
test ax, ax
jne 0x4748af
xor eax, eax
mov word [ebp + ecx*2 - 0x404], ax
mov eax, dword [0x527b2c]
test eax, eax
je 0x4748e7
lea ecx, [ebp - 4]
push ecx
push ebx
call eax
mov esi, eax
jmp 0x4748ec
mov esi, 0xc000000d
push 8
push ebx
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test esi, esi
js 0x474915
mov ecx, dword [0x527b2c]
test ecx, ecx
je 0x474915
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
call ecx
mov eax, edi
jmp 0x47491b
xor eax, eax
pop edi
pop ebx
pop esi
leave
ret

Function at 0x474d40
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ded8d
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x5203c4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp byte [0x527b44], 0
mov esi, dword [ebp + 8]
jne 0x474dbe
lea eax, [ebp - 0x28]
mov byte [0x527b44], 1
push eax
call fcn.00474e20
add esp, 4
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
jb 0x474d9b
mov eax, dword [ebp - 0x28]
push eax
call fcn.00474c70
add esp, 4
test eax, eax
je 0x474daf
mov byte [0x527b45], 1
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0xffffffff
call fcn.004074f0
cmp byte [0x527b45], 0
je 0x474df5
test esi, esi
je 0x474df5
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x474df5
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0
push eax
push esi
call fcn.00474a80
xor eax, eax
add esp, 8
cmp dword [ebp - 0x2c], 4
sete al
jmp 0x474df7
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a8e4e
mov esp, ebp
pop ebp
ret
Function at 0x4766e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0xc]
xor edx, edx
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
xor esi, esi
mov dword [ebp - 0x14], edi
test eax, eax
jle 0x4767dd
mov ecx, dword [ebp + 8]
cmp byte [ebp + 0x10], 0
je 0x476771
dec eax
cmp esi, eax
jge 0x476771
cmp byte [esi + ecx], 0xd
jne 0x476771
cmp byte [esi + ecx + 1], 0xa
jne 0x476771
xor edx, edx
lea ebx, [edi + 0xc]
add esi, 2
mov dword [ebp - 4], edx
mov dword [ebp - 0x10], edx
cmp edi, ebx
je 0x476769
mov eax, dword [ebx]
mov ebx, dword [ebx + 4]
mov ecx, dword [edi]
sub ebx, eax
mov dword [ebp - 0xc], eax
mov eax, dword [edi + 8]
sub eax, ecx
mov dword [ebp - 8], ecx
cmp ebx, eax
jbe 0x476751
push ebx
mov ecx, edi
call fcn.00478130
mov ecx, dword [edi]
mov dword [ebp - 8], ecx
push ebx
push dword [ebp - 0xc]
push ecx
call fcn.004ad230
mov eax, dword [ebp - 8]
add esp, 0xc
mov edx, dword [ebp - 4]
add eax, ebx
mov dword [edi + 4], eax
cmp esi, dword [ebp + 0xc]
jge 0x4767dd
mov ebx, dword [ebp - 0x10]
inc edx
and edx, 0x800000ff
jns 0x476782
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
mov edx, dword [edi]
mov cl, byte [edx + eax]
movzx eax, cl
add ebx, eax
and ebx, 0x800000ff
jns 0x4767a2
dec ebx
or ebx, 0xffffff00
inc ebx
movzx eax, byte [edx + ebx]
mov edi, dword [ebp - 4]
mov byte [edx + edi], al
mov edi, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
mov byte [edx + ebx], cl
mov edx, dword [edi]
movzx eax, byte [edx + eax]
movzx ecx, byte [edx + ebx]
add ecx, eax
movzx eax, cl
mov ecx, dword [ebp + 8]
movzx eax, byte [eax + edx]
xor byte [esi + ecx], al
inc esi
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 4]
cmp esi, eax
jl 0x476702
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x478030
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x478089
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x478089
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x47807a
cmp esi, edx
jae 0x478089
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x478068
cmp esi, edx
jae 0x478089
cmp word [esi], 0
je 0x478089
mov eax, esi
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret
Function at 0x47efb0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 4]
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, eax
mov dword [ebp - 8], edx
cmp edx, 0xffffffff
jne 0x47efd8
call fcn.0047ead0
test eax, eax
js 0x47efe5
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov dword [eax], edx
mov dword [eax + 4], ecx
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x480370
Capabilities:
Extract resource via kernel32 functions
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x519390
push 0x4addf0
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x5203c4]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x2c], 0
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x4803bf
mov dword [eax], ebx
push 1
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov esi, eax
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x30], eax
cmp eax, 0xffffffff
je 0x480424
push 0
push 0
push 0
push 0x1000002
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov edi, eax
mov dword [ebp - 0x2c], edi
test edi, edi
je 0x480424
push 0
push 0
push 0
push 4
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ebx, eax
mov dword [ebp - 0x28], ebx
test ebx, ebx
je 0x480424
mov dword [ebp - 0x20], ebx
push esi
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
cmp dword [ebp - 0x20], 0
je 0x4804d3
mov dword [ebp - 4], 0
xor edi, edi
mov dword [ebp - 0x24], edi
push 0x10
push 1
mov esi, dword [ebp - 0x20]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp + 0xc], eax
test eax, eax
je 0x4804a3
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x4804a3
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4804a3
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x4804a3
movzx esi, word [eax]
cmp esi, dword [ebp - 0x1c]
ja 0x48049b
mov dword [ebp - 0x1c], esi
add esi, 3
and esi, 0xfffffffc
mov dword [ebp - 0x1c], esi
cmp dword [eax + 0x28], 0xfeef04bd
je 0x4804a8
mov edi, 0xd
mov dword [ebp - 0x24], edi
xor esi, esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], 0xfffffffe
jmp 0x4804d8
mov edi, 0xd
test ebx, ebx
je 0x4804e3
push ebx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [ebp - 0x2c]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x4804f3
push eax
call ebx
mov eax, dword [ebp - 0x30]
cmp eax, 0xffffffff
je 0x4804fe
push eax
call ebx
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
je 0x480522
lea eax, [esi*2 + 4]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret