joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c8542
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3b0
cmp dword [0x5383e4], 0
je 0x4c8574
push 0x118
mov eax, dword [0x5383e4]
push eax
lea ecx, [ebp - 0x13c]
push ecx
call fcn.0047fc00
add esp, 0xc
mov byte [ebp - 0x24], 0
jmp 0x4c85ef
call fcn.004c81dd
test eax, eax
je 0x4c85dd
lea edx, [ebp - 0x3ac]
push edx
push 0x118
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x3ac]
push eax
call fcn.004c86e6
add esp, 4
mov dword [ebp - 0x3b0], eax
cmp dword [ebp - 0x3b0], 0
je 0x4c85db
push 0x118
mov ecx, dword [ebp - 0x3b0]
push ecx
lea edx, [ebp - 0x13c]
push edx
call fcn.0047fc00
add esp, 0xc
mov byte [ebp - 0x24], 0
mov eax, dword [ebp - 0x3b0]
push eax
call fcn.004b7aa2
add esp, 4
jmp 0x4c85ef
lea ecx, [ebp - 0x13c]
push ecx
push 0x118
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea edx, [ebp - 0x13c]
push edx
call fcn.00481ea0
add esp, 4
mov dword [ebp - 4], eax
jmp 0x4c860c
mov eax, dword [ebp - 4]
sub eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jle 0x4c8624
mov ecx, dword [ebp - 4]
movsx edx, byte [ebp + ecx - 0x13d]
cmp edx, 0x5c
jne 0x4c8624
jmp 0x4c8603
mov eax, dword [ebp - 4]
mov byte [ebp + eax - 0x13c], 0
lea ecx, [ebp - 0x13c]
push ecx
push str._s_sqlite_
mov edx, dword [ebp + 8]
push edx
call fcn.004793a0
add esp, 0xc
mov eax, dword [ebp + 8]
push eax
call fcn.00481ea0
add esp, 4
mov dword [ebp - 0x140], eax
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x140]
push ecx
push 0xf
call fcn.004d5490
add esp, 8
mov dword [ebp - 4], 0
jmp 0x4c868e
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x140]
add eax, 1
mov dword [ebp - 0x140], eax
cmp dword [ebp - 4], 0xf
jge 0x4c86bd
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x140]
xor eax, eax
mov al, byte [ecx]
xor edx, edx
mov ecx, 0x3e
div ecx
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x140]
mov cl, byte [edx + str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789]
mov byte [eax], cl
jmp 0x4c8676
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0x140]
mov byte [edx], 0
mov eax, dword [ebp + 8]
push eax
call fcn.004c8229
add esp, 4
test eax, eax
jne 0x4c86db
jmp 0x4c86e0
jmp 0x4c862f
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x4c899c
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [ebp + 8], 0
jne 0x4c89ac
xor eax, eax
jmp 0x4c8a27
call fcn.004c81dd
test eax, eax
jne 0x4c89cc
mov eax, dword [ebp + 8]
push eax
call fcn.00481ea0
add esp, 4
cmp eax, 0x104
jbe 0x4c89cc
xor eax, eax
jmp 0x4c8a27
mov ecx, dword [ebp + 8]
push ecx
call fcn.004c8155
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4c89fc
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
push eax
call fcn.004b7aa2
add esp, 4
jmp 0x4c8a09
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x4c8a13
xor eax, eax
jmp 0x4c8a27
mov edx, dword [ebp - 8]
and edx, 0x10
cmp edx, 0x10
je 0x4c8a22
xor eax, eax
jmp 0x4c8a27
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x4c9024
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x5383ec], 0
jne 0x4c906e
call fcn.004c8f9c
cmp dword [0x5383ec], 0
jne 0x4c9069
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x5383d8], eax
cmp dword [0x5383d8], 0xffffffff
jne 0x4c905f
call fcn.004c8fae
xor eax, eax
jmp 0x4c9113
mov dword [0x5383ec], 1
call fcn.004c8fae
mov eax, dword [0x5383d8]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
jle 0x4c90cb
cmp dword [ebp - 4], 0
jne 0x4c90c9
push 0xc
call fcn.004c8060
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4c90c9
mov ecx, dword [ebp - 4]
mov edx, dword [0x50a530]
mov dword [ecx], edx
mov eax, dword [0x50a534]
mov dword [ecx + 4], eax
mov edx, dword [0x50a538]
mov dword [ecx + 8], edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [0x5383d8]
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
jmp 0x4c9110
cmp dword [ebp - 4], 0
je 0x4c9110
cmp dword [ebp + 8], 0
jge 0x4c9110
push 0xc
push 0x50a530
mov edx, dword [ebp - 4]
push edx
call fcn.0049cd80
add esp, 0xc
test eax, eax
jne 0x4c9110
mov eax, dword [ebp - 4]
push eax
call fcn.004c8095
add esp, 4
push 0
mov ecx, dword [0x5383d8]
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x4d6115
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [ebp + 0xc], 2
jge 0x4d612b
mov eax, 0x17
jmp 0x4d61dd
mov eax, dword [ebp + 8]
xor ecx, ecx
mov cl, byte [eax]
xor edx, edx
mov dl, byte [ecx + 0x50a3b8]
mov eax, edx
shl eax, 2
mov ecx, dword [ebp + 8]
add ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx - 1]
xor ecx, ecx
mov cl, byte [edx + 0x50a3b8]
imul ecx, ecx, 3
xor eax, ecx
xor eax, dword [ebp + 0xc]
cdq
mov ecx, 0x7f
idiv ecx
mov dword [ebp - 4], edx
mov edx, dword [ebp - 4]
xor eax, eax
mov al, byte [edx + str.Pk_]
sub eax, 1
mov dword [ebp - 8], eax
jmp 0x4d6189
mov ecx, dword [ebp - 8]
xor edx, edx
mov dl, byte [ecx + 0x50aaec]
sub edx, 1
mov dword [ebp - 8], edx
cmp dword [ebp - 8], 0
jl 0x4d61d8
mov eax, dword [ebp - 8]
xor ecx, ecx
mov cl, byte [eax + 0x50ab60]
cmp ecx, dword [ebp + 0xc]
jne 0x4d61d6
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
xor edx, edx
mov dx, word [ecx*2 + 0x50abd4]
add edx, str.ABORTABLEFTEMPORARYADDATABASELECTHENDEFAULTRANSACTIONATURALTERAISEACHECKEYAFTEREFERENCESCAPELSEXCEPTRIGGEREGEXPLAINITIALLYANALYZEXCLUSIVEXISTSTATEMENTANDEFERRABLEATTACHAVINGLOBEFOREIGNOREINDEXAUTOINCREMENTBEGINNERENAMEBETWEENOTNULLIKEBYCASCADEFERREDELETECASECASTCOLLATECOLUMNCOMMITCONFLICTCONSTRAINTERSECTCREATECROSSCURRENT_DATECURRENT_TIMESTAMPLANDESCDETACHDISTINCTDROPRAGMATCHFAILIMITFROMFULLGROUPDATEIFIMMEDIATEINSERTINSTEADINTOFFSETISNULLJOINORDEREPLACEOUTERESTRICTPRIMARYQUERYRIGHTROLLBACKROWHENUNIONUNIQUEUSINGVACUUMVALUESVIEWHERE
push edx
call fcn.004b7f74
add esp, 0xc
test eax, eax
jne 0x4d61d6
mov eax, dword [ebp - 8]
xor ecx, ecx
mov cl, byte [eax + 0x50acbc]
mov eax, ecx
jmp 0x4d61dd
jmp 0x4d6178
mov eax, 0x17
mov esp, ebp
pop ebp
ret
Function at 0x4dd270
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 8], 0
jne 0x4dd281
xor eax, eax
jmp 0x4dd3d5
push 1
push 0x44
call fcn.004b79e0
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4dd29d
xor eax, eax
jmp 0x4dd3d5
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov dl, byte [ecx + 5]
mov byte [eax + 5], dl
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call fcn.004dcec4
add esp, 4
mov edx, dword [ebp - 4]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
push ecx
call fcn.004dcffc
add esp, 4
mov edx, dword [ebp - 4]
mov dword [edx + 0xc], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x10]
push ecx
call fcn.004dcd50
add esp, 4
mov edx, dword [ebp - 4]
mov dword [edx + 0x10], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x14]
push ecx
call fcn.004dcec4
add esp, 4
mov edx, dword [ebp - 4]
mov dword [edx + 0x14], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x18]
push ecx
call fcn.004dcd50
add esp, 4
mov edx, dword [ebp - 4]
mov dword [edx + 0x18], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x1c]
push ecx
call fcn.004dcec4
add esp, 4
mov edx, dword [ebp - 4]
mov dword [edx + 0x1c], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov dl, byte [ecx + 4]
mov byte [eax + 4], dl
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x20]
push ecx
call fcn.004dd270
add esp, 4
mov edx, dword [ebp - 4]
mov dword [edx + 0x20], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x28]
push ecx
call fcn.004dcd50
add esp, 4
mov edx, dword [ebp - 4]
mov dword [edx + 0x28], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x2c]
push ecx
call fcn.004dcd50
add esp, 4
mov edx, dword [ebp - 4]
mov dword [edx + 0x2c], eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x30], 0xffffffff
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x34], 0xffffffff
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov cl, byte [eax + 6]
mov byte [edx + 6], cl
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov cl, byte [eax + 7]
mov byte [edx + 7], cl
mov edx, dword [ebp - 4]
mov byte [edx + 8], 0
mov eax, dword [ebp - 4]
mov byte [eax + 9], 0
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x24], 0
mov edx, dword [ebp - 4]
mov dword [edx + 0x38], 0xffffffff
mov eax, dword [ebp - 4]
mov dword [eax + 0x3c], 0xffffffff
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x40], 0xffffffff
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x10001df0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x10007040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, 0xffff
mov esi, ecx
cmp di, bx
jne 0x10001e27
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10002ebc
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
mov ecx, dword [eax]
test ecx, ecx
je 0x10001e61
mov edx, dword [esi + 0x30]
mov eax, dword [edx]
lea eax, [ecx + eax*2]
cmp ecx, eax
jae 0x10001e61
dec dword [edx]
mov ax, bx
mov edx, dword [esi + 0x20]
pop edi
mov esi, dword [edx]
lea ecx, [esi + 2]
mov dword [edx], ecx
mov word [esi], bx
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10002ebc
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x10001f34
mov ecx, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [ecx], eax
jne 0x10001e8e
mov eax, dword [esi + 0xc]
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
sar edx, 1
mov dword [eax], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x10001ec1
push dword [esi + 0x4c]
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputwc]
add esp, 8
movzx ecx, bx
cmp ax, di
cmove ecx, edi
pop edi
pop esi
mov ax, cx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10002ebc
mov esp, ebp
pop ebp
ret 4
movzx eax, bx
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x26]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_wchar_t__char__struct__Mbstatet_::out_struct__Mbstatet___wchar_t_const___wchar_t_const___wchar_t_const____char___char___char___const]
sub eax, 0
je 0x10001f00
sub eax, 1
je 0x10001f00
sub eax, 2
jne 0x10001f34
push dword [esi + 0x4c]
push dword [ebp - 0x28]
jmp 0x10001e99
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x24]
sub eax, ecx
mov dword [ebp - 0x34], eax
je 0x10001f24
push dword [esi + 0x4c]
push eax
mov eax, ecx
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp dword [ebp - 0x34], eax
jne 0x10001f34
lea ecx, [ebp - 0x28]
movzx eax, bx
cmp dword [ebp - 0x30], ecx
mov byte [esi + 0x3e], 1
cmovne edi, eax
mov ecx, dword [ebp - 4]
mov ax, di
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10002ebc
mov esp, ebp
pop ebp
ret 4
Function at 0x10002440
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x10007040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x10002504
cmp byte [esi + 0x3e], 0
je 0x10002504
mov eax, dword [esi]
push edi
push 0xffff
call dword [eax + 0xc]
mov ecx, 0xffff
cmp cx, ax
je 0x100024f2
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_wchar_t__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x100024b9
sub eax, 1
je 0x100024bd
sub eax, 2
jne 0x100024f2
mov byte [esi + 0x3e], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10002ebc
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3e], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x100024db
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x100024f2
cmp byte [esi + 0x3e], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10002ebc
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10002ebc
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.10002ebc
mov esp, ebp
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4039cf
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push esi
push edi
push str.StartServiceCtrlDispatcherA
push str.ADVAPI32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, str.Serpiei
mov edi, eax
push esi
call fcn.00403061
test eax, eax
pop ecx
je 0x403a23
and dword [ebp - 8], 0
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], esi
push eax
mov dword [ebp - 0xc], 0x403756
call edi
pop edi
xor eax, eax
pop esi
leave
ret 0x10
and byte [ebp - 0x114], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x113]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x114]
push eax
call fcn.00402ca7
lea eax, [ebp - 0x114]
push 1
push eax
push str.Microsoft_.NET_COM_Integration_with_SOAP
push str.Microsoft_.Net_Frameworek_COMi_Suppoot
push esi
call fcn.004031c0
add esp, 0x18
call fcn.00402217
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x438cb5
Capabilities:
Encode data using xor

Disassembly:
push 0x438a14
pop ecx
mov esi, 0xf678df8d
or edi, edi
call fcn.00438cf8
mov edi, edi
inc esi
xor dword [edx], ecx
sub edi, edi
mov edi, 0xa7c7c525
add edx, 1
add edi, esi
or edi, esi
mov esi, esi
cmp edx, ebx
jne fcn.00438cb5
sub esi, 1
add esi, edi
ret
Function at 0x40139f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 0xc], 0
xorps xmm0, xmm0
push ebx
push esi
mov esi, ecx
mov dword [ebp - 8], edx
push edi
movlpd qword [ebp - 0x10], xmm0
mov edx, dword [esi]
mov ebx, dword [esi + 4]
jl 0x401413
jg 0x4013c8
cmp dword [ebp + 8], 0
jbe 0x401413
mov eax, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov dword [ebp - 4], eax
inc dl
movzx edx, dl
mov ecx, dword [esi + edx*4 + 8]
lea eax, [ebx + ecx]
movzx ebx, al
mov eax, dword [esi + ebx*4 + 8]
mov dword [esi + edx*4 + 8], eax
mov dword [esi + ebx*4 + 8], ecx
add cl, al
movzx eax, cl
mov ecx, dword [ebp - 8]
mov al, byte [esi + eax*4 + 8]
xor byte [edi + ecx], al
add edi, 1
mov eax, dword [ebp - 4]
adc eax, 0
mov dword [ebp - 4], eax
cmp eax, dword [ebp + 0xc]
jl 0x4013d1
jg 0x401413
cmp edi, dword [ebp + 8]
jb 0x4013d1
pop edi
mov dword [esi + 4], ebx
mov dword [esi], edx
pop esi
pop ebx
leave
ret

Function at 0x4014b6
Capabilities:
Check mutex on windows

Disassembly:
push 0x5c
mov eax, 0x483e40
call fcn.0045e53f
mov esi, ecx
lea ecx, [ebp - 0x2c]
call fcn.0041b057
and dword [ebp - 4], 0
lea ecx, [ebp - 0x48]
push 0x49b610
call fcn.0041b66b
xor ebx, ebx
lea eax, [ebp - 0x44]
inc ebx
lea ecx, [ebp - 0x28]
push eax
mov byte [ebp - 4], bl
call fcn.0041e1ec
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 0
call fcn.0041baf2
lea eax, [esi + 4]
push eax
lea ecx, [ebp - 0x28]
call fcn.00408695
lea edx, [ebp - 0x54]
lea ecx, [ebp - 0x68]
call fcn.004209ed
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push 0
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
movzx ebx, bl
cmp eax, 5
cmove ebx, ecx
cmp eax, 0xb7
jne 0x401551
xor bl, bl
test esi, esi
je 0x401551
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x2c]
call fcn.0041baf2
mov al, bl
call fcn.0045e4e9
ret
Function at 0x4029c2
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
test esi, esi
jne 0x4029d4
push 0xffffffffffffff88
pop eax
jmp 0x402a66
push edi
push dword [ebp + 8]
movzx eax, dx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x4029ee
or eax, 0xffffffff
jmp 0x402a65
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4029ff
push 0xfffffffffffffffe
pop eax
jmp 0x402a65
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
jne 0x402a11
push 0xfffffffffffffffd
jmp 0x402a63
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test edi, edi
jle 0x402a61
mov ecx, dword [ebp + 0xc]
add ecx, 4
cmp dword [ecx + 0x14], 8
jb 0x402a2d
mov ecx, dword [ecx]
push 0x49b6cc
push ecx
call fcn.00465668
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x402a44
push 0xfffffffffffffffc
jmp 0x402a63
push esi
push 1
push edi
push ebx
call fcn.00465bdb
push esi
call fcn.00465854
push esi
call fcn.00465923
add esp, 0x18
xor eax, eax
jmp 0x402a64
push 0xfffffffffffffffa
pop eax
pop ebx
pop edi
pop esi
pop ebp
ret

Function at 0x403719
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
je 0x40375d
mov edi, dword [ebp + 0xc]
test edi, edi
jl 0x40375d
mov ebx, dword [ebp + 8]
jg 0x403735
test ebx, ebx
je 0x40375d
or edx, 0xffffffff
movzx eax, byte [esi]
add ebx, 0xffffffff
movzx ecx, dl
adc edi, 0xffffffff
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x49b738]
mov ecx, ebx
inc esi
or ecx, edi
jne 0x403738
not edx
mov eax, edx
jmp 0x40375f
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x403764
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov edx, ecx
test esi, esi
je 0x4037b8
push edi
mov edi, dword [ebp + 0x10]
test edi, edi
jl 0x4037b7
mov eax, dword [ebp + 0xc]
jg 0x403782
test eax, eax
je 0x4037b7
push ebx
mov ebx, dword [edx + 8]
add eax, 0xffffffff
movzx ecx, bl
mov dword [ebp + 8], eax
movzx eax, byte [esi]
adc edi, 0xffffffff
xor ecx, eax
shr ebx, 8
mov eax, dword [ebp + 8]
xor ebx, dword [ecx*4 + 0x49b738]
inc esi
or eax, edi
mov dword [edx + 8], ebx
mov eax, dword [ebp + 8]
jne 0x403786
add dword [edx], 0xffffffff
pop ebx
adc dword [edx + 4], 0xffffffff
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x404918
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
push 0x49be6c
mov edi, ecx
call esi
push str.psapi.dll
mov dword [ebp - 4], eax
call esi
push str.Wlanapi.dll
mov dword [ebp - 8], eax
call esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
xor eax, eax
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], eax
mov dword [edi + 0x2c], eax
mov dword [edi + 0x1c], eax
mov dword [edi + 0x20], eax
mov dword [edi + 0x24], eax
mov dword [edi + 0x28], eax
mov dword [edi + 0x30], eax
mov dword [edi + 0x34], eax
mov dword [edi + 0x38], eax
mov dword [edi + 0x3c], eax
mov dword [edi + 0x40], eax
mov dword [edi + 0x44], eax
mov dword [edi + 0x48], eax
mov dword [edi + 0x4c], eax
mov dword [edi + 0x50], eax
mov dword [edi + 0x54], eax
mov dword [edi + 0x58], eax
mov dword [edi + 0x5c], eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x4049fa
push str.CreateToolhelp32Snapshot
push eax
call esi
push str.Process32First
push dword [ebp - 4]
mov dword [edi], eax
call esi
push str.Process32Next
push dword [ebp - 4]
mov dword [edi + 4], eax
call esi
push str.Module32First
push dword [ebp - 4]
mov dword [edi + 8], eax
call esi
push str.Module32Next
push dword [ebp - 4]
mov dword [edi + 0xc], eax
call esi
push str.Thread32First
push dword [ebp - 4]
mov dword [edi + 0x10], eax
call esi
push str.Thread32Next
push dword [ebp - 4]
mov dword [edi + 0x14], eax
call esi
push str.GlobalMemoryStatusEx
push dword [ebp - 4]
mov dword [edi + 0x18], eax
call esi
mov dword [edi + 0x30], eax
mov eax, dword [ebp - 8]
test eax, eax
je 0x404a40
push str.EnumProcesses
push eax
call esi
push str.EnumProcessModules
push dword [ebp - 8]
mov dword [edi + 0x1c], eax
call esi
push str.EnumProcessModulesEx
push dword [ebp - 8]
mov dword [edi + 0x24], eax
call esi
push str.GetModuleFileNameExW
push dword [ebp - 8]
mov dword [edi + 0x28], eax
call esi
push str.GetProcessImageFileNameW
push dword [ebp - 8]
mov dword [edi + 0x20], eax
call esi
mov dword [edi + 0x2c], eax
test ebx, ebx
je 0x404abd
push str.WlanOpenHandle
push ebx
call esi
push str.WlanEnumInterfaces
push ebx
mov dword [edi + 0x34], eax
call esi
push str.WlanGetAvailableNetworkList
push ebx
mov dword [edi + 0x38], eax
call esi
push str.WlanGetProfile
push ebx
mov dword [edi + 0x3c], eax
call esi
push str.WlanCloseHandle
push ebx
mov dword [edi + 0x40], eax
call esi
push str.WlanFreeMemory
push ebx
mov dword [edi + 0x44], eax
call esi
push str.WlanDeleteProfile
push ebx
mov dword [edi + 0x48], eax
call esi
push str.WlanDisconnect
push ebx
mov dword [edi + 0x4c], eax
call esi
push str.WlanSetProfile
push ebx
mov dword [edi + 0x50], eax
call esi
push str.WlanConnect
push ebx
mov dword [edi + 0x54], eax
call esi
push str.WlanGetNetworkBssList
push ebx
mov dword [edi + 0x58], eax
call esi
mov dword [edi + 0x5c], eax
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret