joyce8/EMBER2024-capa huggingface dataset:
Function at 0x458f10
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f3588
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x53ac84]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, edx
mov dword [ebp - 0x3c], eax
mov esi, ecx
mov dword [ebp - 0x30], esi
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x34], ecx
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x38], ecx
test eax, eax
jne 0x458f62
mov dword [esi], edx
mov dword [esi + 4], edx
jmp 0x459085
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
push ecx
lea edx, [ebp - 0x2c]
mov dword [ebp - 4], 0
mov ecx, eax
call fcn.004162d0
add esp, 4
lea eax, [ebp - 0x2c]
cmp dword [ebp - 0x18], 0x10
cmovae eax, dword [ebp - 0x2c]
push 0x51b9a0
push eax
call fcn.004d98b2
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x45903b
push 2
push 0
push ebx
call fcn.004da439
add esp, 0xc
push ebx
call fcn.004d9fe6
add esp, 4
mov edi, eax
mov dword [ebp - 0x30], edi
push 0
push 0
push ebx
call fcn.004da439
add esp, 0xc
lea ecx, [edi + 1]
push ecx
call fcn.004cbbc6
mov edi, eax
add esp, 4
test edi, edi
je 0x459025
push ebx
push dword [ebp - 0x30]
push 1
push edi
call fcn.004da8b0
mov ecx, dword [ebp - 0x30]
add esp, 0x10
cmp eax, ecx
jne 0x459025
push ebx
mov byte [ecx + edi], 0
call fcn.004d9a0f
movss xmm2, dword [0x52080c]
add esp, 4
mov ecx, edi
call fcn.00454450
push edi
mov ebx, eax
call fcn.004cbbc1
add esp, 4
jmp 0x45903d
push ebx
call fcn.004d9a0f
add esp, 4
test edi, edi
je 0x45903b
push edi
call fcn.004cbbc1
add esp, 4
xor ebx, ebx
push dword [ebp - 0x38]
mov edx, ebx
mov ecx, esi
push dword [ebp - 0x34]
push dword [ebp + 8]
push dword [ebp - 0x3c]
call fcn.00458b10
mov edx, dword [ebp - 0x18]
add esp, 0x10
cmp edx, 0x10
jb 0x459085
mov ecx, dword [ebp - 0x2c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x45907b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4590a3
push edx
push ecx
call fcn.004c1e27
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004c20c9
mov esp, ebp
pop ebp
ret
call fcn.004c7d81
int3
Function at 0x460f30
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push esi
push edi
xor eax, eax
mov dword [ebp - 0x2c], 0
push eax
push 0x540bf0
push 0x540c30
mov esi, ecx
mov word [ebp - 0x1e], ax
push eax
push esi
mov dword [ebp - 8], eax
mov dword [ebp - 4], esi
call fcn.004c60c0
mov dword [ebp - 0x30], eax
add esp, 0x14
cmp dword [esi + 0x2ac], 8
lea eax, [esi + 0x298]
jb 0x460f76
mov eax, dword [eax]
mov ecx, dword [esi + 0x2b0]
mov edx, dword [ebp + 0x1c]
movss xmm0, dword [ebp + 0x18]
mov edi, dword [ebp + 0x20]
mov dword [ebp - 0xc], eax
mov eax, dword [ecx + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x34], eax
mov ax, word [ebp + 0x14]
mov word [ebp - 0x20], ax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x18], eax
xor eax, eax
test edx, edx
movss dword [ebp - 0x14], xmm0
sete al
cmp eax, edi
jne 0x460fce
mov eax, dword [ecx + 0xc0]
mov dword [ebp - 0x28], eax
mov eax, dword [ecx + 0xc4]
mov dword [ebp - 0x24], eax
jmp 0x460fd4
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x2c], eax
lea ecx, [ebp - 0x34]
mov eax, dword [esi]
push ecx
mov ecx, esi
call dword [eax + 0x74]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x476fa0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f4210
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x53ac84]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0x14], 8
mov eax, esi
mov dword [esi + 0x10], 0
jb 0x476fde
mov eax, dword [esi]
xor ecx, ecx
push ecx
mov word [eax], cx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x477139
mov edi, dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
push 0xd
call edi
test eax, eax
je 0x4770b1
push 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
mov edi, eax
cmp edi, 0xffffffff
je 0x477133
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ebx, eax
test ebx, ebx
je 0x477133
push edi
call dword [sym.imp.KERNEL32.dll_GlobalSize]
shr eax, 1
xor ecx, ecx
push eax
mov word [ebp - 0x28], cx
lea ecx, [ebp - 0x28]
push ebx
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
call fcn.00407020
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
cmp esi, eax
je 0x477070
cmp dword [ebp - 0x14], 8
mov ecx, esi
push dword [ebp - 0x18]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.00407020
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x477133
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x477129
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x477155
jmp 0x477129
push 1
call edi
test eax, eax
je 0x477133
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov edi, eax
cmp edi, 0xffffffff
je 0x477133
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ebx, eax
test ebx, ebx
je 0x477133
push edi
call dword [sym.imp.KERNEL32.dll_GlobalSize]
push eax
push ebx
lea ecx, [ebp - 0x40]
call fcn.00419590
push 0
mov edx, esi
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x40]
call fcn.00416250
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov edx, dword [ebp - 0x2c]
cmp edx, 0x10
jb 0x477133
mov ecx, dword [ebp - 0x40]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x477129
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x47715a
push edx
push ecx
call fcn.004c1e27
add esp, 8
call dword [sym.imp.USER32.dll_CloseClipboard]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004c20c9
mov esp, ebp
pop ebp
ret
call fcn.004c7d81
call fcn.004c7d81
int3
Function at 0x477160
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0
mov esi, ecx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x4771d5
push ebx
push edi
call dword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
je 0x4771cd
mov eax, dword [esi + 0x10]
lea ebx, [eax + eax]
lea eax, [ebx + 2]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x4771cd
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
cmp dword [esi + 0x14], 8
mov dword [ebp - 4], eax
jb 0x4771a9
mov esi, dword [esi]
push ebx
push esi
push eax
call fcn.004c4540
mov eax, dword [ebp - 4]
add esp, 0xc
xor ecx, ecx
push edi
mov word [ebx + eax], cx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x47eff0
Capabilities:
Create process on windows
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f4608
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x53ac84]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
push 0
push str.CommonProgramW6432
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, eax
mov dword [ebp - 0x18], 0
xor eax, eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 4], eax
test esi, esi
je 0x47f165
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.00409570
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push esi
cmovae eax, dword [ebp - 0x28]
push eax
push str.CommonProgramW6432
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x47f165
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
cmp word [eax + ecx*2 - 2], 0
jne 0x47f0de
lea eax, [ecx - 1]
push eax
push 0
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.00420190
push eax
lea ecx, [ebp - 0x28]
call fcn.00406050
mov edx, dword [ebp - 0x2c]
cmp edx, 8
jb 0x47f0de
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x47f0d4
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x47f1e3
push edx
push ecx
call fcn.004c1e27
add esp, 8
push str.microsoft_sharedinkTabTip.exe
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x40]
call fcn.00405760
mov esi, eax
add esp, 4
lea eax, [ebp - 0x28]
cmp eax, esi
je 0x47f125
mov ecx, eax
call fcn.004072c0
movups xmm0, xmmword [esi]
xor eax, eax
movups xmmword [ebp - 0x28], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [ebp - 0x18], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov edx, dword [ebp - 0x2c]
cmp edx, 8
jb 0x47f15f
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x47f155
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x47f1e8
push edx
push ecx
call fcn.004c1e27
add esp, 8
cmp dword [ebp - 0x18], 0
jne 0x47f174
push 0x3e
push str.C:Program_FilesCommon_Filesmicrosoft_sharedinkTabTip.exe
lea ecx, [ebp - 0x28]
call fcn.00407020
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0xa
cmovae eax, dword [ebp - 0x28]
push 0
push 0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x47f1c9
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x47f1bf
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x47f1ed
push edx
push ecx
call fcn.004c1e27
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004c20c9
mov esp, ebp
pop ebp
ret
call fcn.004c7d81
call fcn.004c7d81
call fcn.004c7d81
int3
Function at 0x482787
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
cmp byte [0x542dcc], 0
push esi
mov esi, ecx
je 0x4827af
push 0x800
push 0
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
jmp 0x482871
push ebx
push edi
test esi, esi
je 0x48286d
xor ebx, ebx
cmp word [esi], bx
je 0x48286d
mov edi, 0x200
lea eax, [ebp - 0x404]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov ecx, eax
test ecx, ecx
je 0x48286d
cmp ecx, edi
jae 0x48286d
push 0x5c
pop eax
mov word [ebp + ecx*2 - 0x404], ax
inc ecx
cmp ecx, edi
jae 0x48286d
movzx eax, word [esi]
test ax, ax
je 0x48281d
mov edx, eax
mov word [ebp + ecx*2 - 0x404], dx
inc ecx
cmp ecx, edi
jae 0x48286d
add esi, 2
movzx eax, word [esi]
mov edx, eax
test ax, ax
jne 0x482803
xor eax, eax
mov word [ebp + ecx*2 - 0x404], ax
mov eax, dword [0x542dc4]
test eax, eax
je 0x48283b
lea ecx, [ebp - 4]
push ecx
push ebx
call eax
mov esi, eax
jmp 0x482840
mov esi, 0xc000000d
push 8
push ebx
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test esi, esi
js 0x482869
mov ecx, dword [0x542dc4]
test ecx, ecx
je 0x482869
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
call ecx
mov eax, edi
jmp 0x48286f
xor eax, eax
pop edi
pop ebx
pop esi
leave
ret

Function at 0x482ba0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x53ac84]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x542dd9], 0
push esi
mov esi, dword [ebp + 8]
jne 0x482bf8
lea eax, [ebp - 0x1c]
mov byte [0x542dd9], 1
push eax
call fcn.00482c50
add esp, 4
lea eax, [ebp - 0x1c]
cmp dword [ebp - 8], 8
jb 0x482bdc
mov eax, dword [ebp - 0x1c]
push eax
call fcn.00482ad0
add esp, 4
test eax, eax
je 0x482bf0
mov byte [0x542dda], 1
lea ecx, [ebp - 0x1c]
call fcn.00407320
cmp byte [0x542dda], 0
je 0x482c3c
test esi, esi
je 0x482c3c
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x482c3c
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0
push eax
push esi
call fcn.00482990
add esp, 8
xor eax, eax
cmp dword [ebp - 0x20], 4
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c20c9
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.004c20c9
mov esp, ebp
pop ebp
ret

Function at 0x483d90
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x483de9
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x483de9
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x483dda
cmp esi, edx
jae 0x483de9
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x483dc8
cmp esi, edx
jae 0x483de9
cmp word [esi], 0
je 0x483de9
mov eax, esi
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret
Function at 0x484490
Capabilities:
Decode data using base64 via winapi

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f4740
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x53ac84]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, dword [ebp + 0xc]
mov eax, dword [esi]
mov dword [esi + 4], eax
mov edi, dword [ebp + 8]
test edi, edi
je 0x484518
mov dword [ebp + 0xc], 0
push 0
push 0
lea eax, [ebp + 0xc]
push eax
push 0
push 1
push 0
push edi
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
cmp dword [ebp + 0xc], 0
je 0x484518
mov dword [ebp - 4], 0
push esi
push dword [ebp + 0xc]
mov ecx, esi
call fcn.00483f90
push 0
push 0
lea eax, [ebp + 0xc]
push eax
push dword [esi]
push 1
push 0
push edi
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x485430
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, ecx
push edi
mov edi, 2
mov dword [esi], 0
lea ebx, [esi + 0x1c]
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
dec edi
call fcn.00483350
test eax, eax
je 0x485607
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebx], eax
add ebx, 4
test edi, edi
jne 0x485473
mov dword [esi + 0x3c], edi
or ebx, 0xffffffff
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x64], edi
mov dword [esi + 0x68], edi
mov dword [esi + 0x6c], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x74], edi
mov dword [esi + 0x78], edi
mov dword [esi + 0x80], edi
mov dword [esi + 0x88], edi
mov dword [esi + 0xa0], edi
mov dword [esi + 0xa8], edi
and dword [esi + 0xd8], 0xfffffffc
mov dword [esi + 0xc0], edi
mov dword [esi + 0xc4], edi
mov dword [esi + 0xc8], edi
mov dword [esi + 0xcc], edi
mov dword [esi + 0xd0], edi
mov dword [esi + 0xd4], edi
mov dword [esi + 0xdc], edi
mov dword [esi + 0xe0], edi
mov dword [esi + 0xe4], edi
cmp dword [esi + 8], edi
je 0x485537
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x48552c
lock inc dword [edi + 4]
mov eax, dword [ebp + 8]
mov dword [esi + 8], eax
mov eax, dword [ebp + 0xc]
jmp 0x48556e
call fcn.00486580
mov eax, dword [eax + 0x38]
test eax, eax
je 0x485547
call eax
jmp 0x485549
xor eax, eax
push 0x4861f0
push eax
lea ecx, [ebp - 8]
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
call fcn.004851d0
mov eax, dword [ebp - 8]
mov dword [esi + 8], eax
mov eax, dword [ebp - 4]
mov edi, dword [esi + 0xc]
mov dword [esi + 0xc], eax
test edi, edi
je 0x485597
mov eax, ebx
lock xadd dword [edi + 4], eax
jne 0x485597
mov eax, dword [edi]
mov ecx, edi
call dword [eax]
mov eax, ebx
lock xadd dword [edi + 8], eax
jne 0x485597
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 4]
mov eax, dword [esi + 8]
test eax, eax
je 0x4855c3
push 0x7530
push 0x9c
push eax
call fcn.00486240
push 0xea60
push 0x9b
push dword [esi + 8]
call fcn.00486240
add esp, 0x18
mov edi, dword [ebp + 0xc]
xor eax, eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
test edi, edi
je 0x4855fc
mov eax, ebx
lock xadd dword [edi + 4], eax
jne 0x4855fc
mov eax, dword [edi]
mov ecx, edi
call dword [eax]
lock xadd dword [edi + 8], ebx
dec ebx
jne 0x4855fc
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 4]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push 0x80004005
call fcn.004831b0
int3
Function at 0x4862d0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, ecx
push edi
cmp dword [esi + 8], 0
je 0x48645d
mov edi, dword [esi + 0x6c]
lea ebx, [esi + 0x6c]
test edi, edi
je 0x486316
push 0
lea eax, [ebp - 4]
mov dword [ebp - 8], 0
push eax
push 0
push edi
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x486316
call fcn.00486030
push 0
push ecx
mov dword [ebp - 4], esp
call fcn.00483350
mov ecx, eax
test ecx, ecx
je 0x486468
mov eax, dword [ecx]
call dword [eax + 0xc]
mov ecx, dword [ebp - 4]
add eax, 0x10
mov dword [ecx], eax
mov ecx, esi
call fcn.00486cc0
test eax, eax
jne 0x48645d
test edi, edi
je 0x486431
mov edi, dword [sym.imp.KERNEL32.dll_GetFileSize]
lea eax, [ebp - 4]
push eax
push dword [ebx]
call edi
mov ecx, eax
mov dword [ebp - 8], ecx
cmp ecx, 0xffffffff
jne 0x486377
call fcn.00486030
test eax, eax
js 0x48645d
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, ecx
or eax, edx
je 0x48645d
mov eax, dword [ebp + 8]
test eax, eax
je 0x486390
mov dword [eax], ecx
mov dword [eax + 4], edx
lea eax, [ebp - 4]
push eax
push ebx
call edi
push 0
push eax
push dword [ebp - 4]
mov dword [ebp - 8], eax
push 2
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ecx, eax
mov dword [esi + 0x88], ecx
test ecx, ecx
jne 0x4863c0
call fcn.00486030
mov edi, eax
jmp 0x48641e
mov eax, dword [ebp - 8]
push 0
push eax
push 0
push 0
push 4
push ecx
mov dword [esi + 0x84], eax
mov dword [esi + 0x98], 4
mov dword [esi + 0x90], 0
mov dword [esi + 0x94], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFileEx]
mov dword [esi + 0x80], eax
test eax, eax
jne 0x486422
call fcn.00486030
push dword [esi + 0x88]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x88], 0
test edi, edi
js 0x48645d
mov eax, dword [esi + 0x80]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [esi + 0x50]
mov eax, ecx
or eax, 0
je 0x48645d
mov eax, dword [ebp + 8]
test eax, eax
je 0x48644b
mov dword [eax], ecx
mov dword [eax + 4], 0
cmp dword [esi + 0x50], 0
jbe 0x486472
mov eax, dword [esi + 0x4c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.004831b0
push 0x80070057
call fcn.004831b0
int3

Function at 0x486610
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push str.360netbase.dll
push eax
call fcn.00494d60
add esp, 8
push dword [ebp - 4]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x486646
push dword [ebp - 4]
call fcn.004876b0
add esp, 4
test eax, eax
je 0x486646
xor esi, esi
jmp 0x48664b
mov esi, 2
mov eax, dword [ebp - 4]
or ecx, 0xffffffff
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x486666
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x486920
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, ecx
mov eax, dword [esi + 0x1c]
test eax, eax
jne 0x486a40
push edi
mov edi, dword [ebp + 8]
cmp ax, word [0x543028]
jne 0x4869e2
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
push 0x20019
push 0
push 0x4f98e8
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4869ce
lea eax, [ebp - 8]
mov dword [ebp - 0xc], 1
push eax
push 0x543028
lea eax, [ebp - 0xc]
mov dword [ebp - 8], 0x208
push eax
push 0
push str.Path
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, 0x543028
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4869a3
sub ecx, edx
sar ecx, 1
je 0x4869d0
cmp word [ecx*2 + 0x543026], 0x5c
je 0x4869d0
mov eax, 0x5c
mov word [ecx*2 + 0x543028], ax
jmp 0x4869d0
xor ecx, ecx
cmp word [0x543028], 0
mov dword [0x543024], ecx
je 0x486a04
jmp 0x4869e8
mov ecx, dword [0x543024]
push ecx
push 0x543028
push edi
call fcn.004c7fc9
add esp, 0xc
test eax, eax
jne 0x486a04
call fcn.00482e10
test eax, eax
jne 0x486a2d
call fcn.00486670
test eax, eax
je 0x486a36
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push edi
mov ecx, 0x538040
call fcn.00482cc0
test eax, eax
je 0x486a36
cmp dword [ebp - 4], 3
je 0x486a36
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
jmp 0x486a38
xor eax, eax
mov dword [esi + 0x1c], eax
pop edi
test eax, eax
je 0x486a90
push str.InitLibs
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
test ecx, ecx
je 0x486a80
lea eax, [esi + 0x20]
push eax
call ecx
add esp, 4
test eax, eax
js 0x486a80
mov eax, dword [esi + 0x84]
test eax, eax
je 0x486a80
push 2
call eax
add esp, 4
test eax, eax
jne 0x486a80
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 4
push dword [esi + 0x1c]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [esi + 0x1c], 0
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 4