joyce8/EMBER2024-capa huggingface dataset:
Function at 0x436acb
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push ebx
call fcn.00437224
add esp, 8
mov ebx, eax
lea edx, [ebp - 8]
push edx
push esi
call fcn.00437224
add esp, 8
mov esi, eax
call fcn.0046a604
push esi
push ebx
call sub.KERNEL32.DLL_MoveFileA
mov ebx, eax
push 0
push ebx
call fcn.00437571
add esp, 8
call fcn.0046a5ff
cmp dword [ebp - 4], 0
je 0x436b24
push dword [ebp - 4]
call sym.SISCOM.EXE__hb_xfree
pop ecx
cmp dword [ebp - 8], 0
je 0x436b33
push dword [ebp - 8]
call sym.SISCOM.EXE__hb_xfree
pop ecx
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x436b3b
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push ebx
call fcn.00437224
add esp, 8
mov ebx, eax
call fcn.0046a604
push 0
push ebx
call sub.KERNEL32.DLL_CreateDirectoryA
mov ebx, eax
push 0
push ebx
call fcn.00437571
add esp, 8
call fcn.0046a5ff
cmp dword [ebp - 4], 0
je 0x436b80
push dword [ebp - 4]
call sym.SISCOM.EXE__hb_xfree
pop ecx
mov eax, ebx
pop ebx
pop ecx
pop ebp
ret

Function at 0x436b86
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push ebx
call fcn.00437224
add esp, 8
mov ebx, eax
call fcn.0046a604
push ebx
call sub.KERNEL32.DLL_SetCurrentDirectoryA
mov ebx, eax
push 0
push ebx
call fcn.00437571
add esp, 8
call fcn.0046a5ff
cmp dword [ebp - 4], 0
je 0x436bc9
push dword [ebp - 4]
call sym.SISCOM.EXE__hb_xfree
pop ecx
mov eax, ebx
pop ebx
pop ecx
pop ebp
ret

Function at 0x436bcf
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push ebx
call fcn.00437224
add esp, 8
mov ebx, eax
call fcn.0046a604
push ebx
call sub.KERNEL32.DLL_RemoveDirectoryA
mov ebx, eax
push 0
push ebx
call fcn.00437571
add esp, 8
call fcn.0046a5ff
cmp dword [ebp - 4], 0
je 0x436c12
push dword [ebp - 4]
call sym.SISCOM.EXE__hb_xfree
pop ecx
mov eax, ebx
pop ebx
pop ecx
pop ebp
ret
Function at 0x436c39
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov word [ebp - 2], di
mov byte [ebx], 0
test di, di
je 0x436c76
call fcn.00436db6
and eax, 0xff
inc eax
mov word [ebp - 2], ax
cmp di, word [ebp - 2]
je 0x436c76
mov edx, edi
add dl, 0xff
push edx
call fcn.00436d35
pop ecx
call fcn.0046a604
push ebx
push esi
call sub.KERNEL32.DLL_GetCurrentDirectoryA
push 0
push eax
call fcn.00437571
add esp, 8
call fcn.0046a5ff
call fcn.0043752e
mov word [ebp - 4], ax
cmp di, word [ebp - 2]
je 0x436cb9
mov cl, byte [ebp - 2]
add cl, 0xff
push ecx
call fcn.00436d35
pop ecx
mov ax, word [ebp - 4]
push eax
call fcn.0043755b
pop ecx
mov byte [ebx + esi - 1], 0
cmp word [ebp - 4], 0
jne 0x436d2b
cmp byte [ebx], 0
je 0x436d2b
mov edi, ebx
push ebx
call fcn.004d4a58
pop ecx
mov esi, eax
cmp byte [edi + 1], 0x3a
jne 0x436ce1
add edi, 2
sub esi, 2
movsx eax, byte [edi]
push eax
push 0x65a332
call fcn.004d4988
add esp, 8
test eax, eax
je 0x436cf8
inc edi
dec esi
test esi, esi
je 0x436d14
movsx edx, byte [edi + esi - 1]
push edx
push 0x65a332
call fcn.004d4988
add esp, 8
test eax, eax
je 0x436d14
dec esi
test esi, esi
je 0x436d27
cmp edi, ebx
je 0x436d27
push esi
push edi
push ebx
call fcn.004d485c
add esp, 0xc
mov byte [ebx + esi], 0
mov ax, word [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x436deb
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov al, byte [ebp + 8]
add al, 0x41
mov byte [ebp - 4], al
mov byte [ebp - 3], 0x3a
mov byte [ebp - 2], 0x5c
mov byte [ebp - 1], 0
call fcn.0046a604
lea edx, [ebp - 4]
push edx
call sub.KERNEL32.DLL_GetDriveTypeA
mov ebx, eax
call fcn.0046a5ff
test ebx, ebx
je 0x436e22
cmp ebx, 1
jne 0x436e28
mov ax, 0xffff
jmp 0x436e2a
xor eax, eax
mov ebx, eax
push 0
call fcn.0043755b
pop ecx
mov eax, ebx
pop ebx
pop ecx
pop ebp
ret

Function at 0x437190
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
mov byte [ebx], 0
push ebx
push esi
call sub.KERNEL32.DLL_GetCurrentDirectoryA
push 0
test eax, eax
setne al
and eax, 1
push eax
call fcn.00437571
add esp, 8
call fcn.0046a5ff
call fcn.0043752e
test ax, ax
je 0x4371ce
call fcn.0043752e
jmp 0x437220
mov eax, ebx
cmp byte [eax + 1], 0x3a
jne 0x4371d9
add eax, 2
cmp eax, ebx
je 0x4371e8
push esi
push eax
push ebx
call fcn.004d485c
add esp, 0xc
push ebx
call fcn.004d4a58
pop ecx
mov esi, eax
movsx eax, byte [ebx + esi - 1]
push eax
push 0x65a332
call fcn.004d4988
add esp, 8
test eax, eax
je 0x43720e
mov byte [ebx + esi], 0
jmp 0x43721e
push 0
push 0x65a336
push ebx
call fcn.004c1ff4
add esp, 0xc
xor eax, eax
pop esi
pop ebx
pop ebp
ret
Function at 0x437ff8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 4], 0x63
mov byte [ebx], 0
cmp dword [ebp + 8], 0
je 0x43802f
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x43802f
push 0x107
push dword [ebp + 8]
push ebx
call fcn.004c2970
add esp, 0xc
jmp 0x438045
push ebx
push 0x107
call sub.KERNEL32.DLL_GetTempPathA
test eax, eax
jne 0x438045
mov byte [ebx], 0x2e
mov byte [ebx + 1], 0
cmp byte [ebx], 0
je 0x438061
push ebx
call fcn.004d4a58
pop ecx
cmp byte [ebx + eax - 1], 0x5c
je 0x438061
mov byte [ebx + eax], 0x5c
mov byte [ebx + eax + 1], 0
cmp dword [ebp + 0xc], 0
je 0x438078
push 0x107
push dword [ebp + 0xc]
push ebx
call fcn.004c29ab
add esp, 0xc
push ebx
call fcn.004d4a58
pop ecx
mov edi, eax
cmp edi, 0x101
jle 0x438091
or eax, 0xffffffff
jmp 0x43812d
call fcn.0043e6cb
fstp qword [ebp - 0x10]
xor edx, edx
mov dword [ebp - 8], edx
fld qword [ebp - 0x10]
fmul dword [0x438134]
fstp qword [ebp - 0x10]
fld qword [ebp - 0x10]
call fcn.004d9190
mov esi, eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call fcn.004d95ac
add esp, 0xc
fstp qword [ebp - 0x10]
mov ecx, esi
cmp esi, 9
jle 0x4380d4
mov al, 0x57
jmp 0x4380d6
mov al, 0x30
add cl, al
mov byte [ebx + edi], cl
inc edi
inc dword [ebp - 8]
cmp dword [ebp - 8], 6
jl 0x43809e
mov byte [ebx + edi], 0
cmp dword [ebp + 0x18], 0
je 0x438100
push 0x107
push dword [ebp + 0x18]
push ebx
call fcn.004c29ab
add esp, 0xc
push 0
push ebx
call fcn.00437224
add esp, 8
push 0x410
push dword [ebp + 0x10]
push ebx
call fcn.00435f03
add esp, 0xc
cmp eax, 0xffffffff
jne 0x43812d
dec dword [ebp - 4]
jne 0x43800b
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x438138
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
mov ebx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x438168
cmp byte [eax], 0
je 0x438168
push 0x107
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.004c2970
add esp, 0xc
jmp 0x43818d
lea edx, [ebp - 0x108]
push edx
push 0x108
call sub.KERNEL32.DLL_GetTempPathA
test eax, eax
jne 0x43818d
push 0
push 0
call fcn.00437571
add esp, 8
xor eax, eax
jmp 0x4381bb
mov byte [ebp - 1], 0
push dword [ebp + 8]
push 0
test ebx, ebx
jne 0x43819f
mov ebx, 0x65a3cc
push ebx
lea eax, [ebp - 0x108]
push eax
call sub.KERNEL32.DLL_GetTempFileNameA
mov ebx, eax
push 0
push ebx
call fcn.00437571
add esp, 8
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x439d54
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, dword [0x65a480]
mov dword [ebp - 8], eax
mov eax, dword [0x65a484]
mov dword [ebp - 4], eax
push 7
call sym.SISCOM.EXE__hb_xgrab
pop ecx
mov ebx, eax
push 0
push dword [ebp + 0xc]
push ebx
call fcn.004c2039
add esp, 0xc
push 0
push 0x65a48c
push ebx
call fcn.004c1ff4
add esp, 0xc
lea eax, [ebp - 0x148]
push eax
push ebx
call sub.KERNEL32.DLL_FindFirstFileA
mov esi, eax
cmp esi, 0xffffffff
je 0x439df6
test byte [ebp - 0x148], 0x10
je 0x439ddf
lea eax, [ebp - 0x134]
push eax
lea edx, [ebp - 8]
push edx
call sub.KERNEL32.DLL_CompareFileTime
dec eax
jne 0x439ddf
mov ecx, dword [ebp - 0x134]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0x130]
mov dword [ebp - 4], ecx
lea eax, [ebp - 0x148]
push eax
push esi
call sub.KERNEL32.DLL_FindNextFileA
test eax, eax
jne 0x439db1
push esi
call sub.KERNEL32.DLL_FindClose
push ebx
call sym.SISCOM.EXE__hb_xfree
pop ecx
mov edx, dword [ebp - 8]
mov dword [edi], edx
mov edx, dword [ebp - 4]
mov dword [edi + 4], edx
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43a29a
Capabilities:
Enumerate files on windows
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
push 0x140
call sym.SISCOM.EXE__hb_xgrab
pop ecx
mov edi, eax
xor eax, eax
mov dword [edi + 0x13c], eax
push 0x258
call sym.SISCOM.EXE__hb_xgrab
pop ecx
mov dword [edi + 0x13c], eax
mov ebx, dword [edi + 0x13c]
cmp dword [ebp + 0xc], 8
jne 0x43a35a
mov eax, dword [0x65a488]
mov dword [ebp - 8], eax
push 3
push dword [ebp + 8]
lea edx, [ebp - 8]
push edx
call fcn.004c2970
add esp, 0xc
mov dword [ebx], 0xffffffff
cmp byte [ebp - 6], 0
jne 0x43a302
mov byte [ebp - 6], 0x5c
push 0
push 0
lea ecx, [ebp - 4]
push ecx
push 0
push 0
push 0x104
lea eax, [ebx + 0x14c]
push eax
lea edx, [ebp - 8]
push edx
call sub.KERNEL32.DLL_GetVolumeInformationA
test eax, eax
je 0x43a353
lea ecx, [ebp - 8]
push ecx
lea eax, [ebx + 0x250]
push eax
call fcn.00439d54
add esp, 8
mov esi, 1
push dword [ebp + 0xc]
call fcn.00439ea9
pop ecx
mov dword [ebx + 0x144], eax
jmp 0x43a45b
xor esi, esi
jmp 0x43a45b
push dword [ebp + 8]
call fcn.004d4a58
pop ecx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
add eax, 4
push eax
call sym.SISCOM.EXE__hb_xgrab
pop ecx
mov dword [ebp - 0xc], eax
mov dword [ebx], 0xffffffff
xor esi, esi
cmp dword [ebp - 0xc], 0
je 0x43a45b
push 0
push dword [ebp + 8]
push dword [ebp - 0xc]
call fcn.004c2039
add esp, 0xc
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
cmp byte [eax + edx - 1], 0x5c
jne 0x43a3b7
push 0
push 0x65a48c
push dword [ebp - 0xc]
call fcn.004c1ff4
add esp, 0xc
lea ecx, [ebx + 4]
push ecx
push dword [ebp - 0xc]
call sub.KERNEL32.DLL_FindFirstFileA
mov dword [ebx], eax
push dword [ebp + 0xc]
call fcn.00439ea9
pop ecx
mov dword [ebx + 0x144], eax
cmp dword [ebx], 0xffffffff
je 0x43a452
cmp dword [ebx + 0x144], 0
je 0x43a3f9
cmp dword [ebx + 4], 0
je 0x43a3f9
test byte [ebx + 4], 0x80
jne 0x43a3f9
mov eax, dword [ebx + 0x144]
and eax, dword [ebx + 4]
je 0x43a400
mov esi, 1
jmp 0x43a452
test byte [ebx + 4], 0x10
jne 0x43a411
mov eax, dword [ebx + 0x144]
and eax, dword [ebx + 4]
je 0x43a418
mov esi, 1
jmp 0x43a452
xor esi, esi
jmp 0x43a443
cmp dword [ebx + 0x144], 0
je 0x43a43c
cmp dword [ebx + 4], 0
je 0x43a43c
test byte [ebx + 4], 0x80
jne 0x43a43c
mov eax, dword [ebx + 0x144]
and eax, dword [ebx + 4]
je 0x43a443
mov esi, 1
jmp 0x43a452
lea eax, [ebx + 4]
push eax
push dword [ebx]
call sub.KERNEL32.DLL_FindNextFileA
test eax, eax
jne 0x43a41c
push dword [ebp - 0xc]
call sym.SISCOM.EXE__hb_xfree
pop ecx
push 0
push esi
call fcn.00437571
add esp, 8
test esi, esi
je 0x43a473
push edi
call fcn.0043a0e7
pop ecx
jmp 0x43a47c
push edi
call fcn.0043a4f9
pop ecx
xor edi, edi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43e964
Capabilities:
Set global application hook

Disassembly:
push ebp
mov ebp, esp
push 0x8007
call sub.KERNEL32.DLL_SetErrorMode
mov dword [0x65a76c], eax
push 0x43e8d1
call sub.KERNEL32.DLL_SetUnhandledExceptionFilter
call sub.KERNEL32.DLL_GetCurrentThreadId
push eax
push 0
push 0x43e8eb
push 3
call sub.USER32.DLL_SetWindowsHookExA
mov dword [0x65a768], eax
push 1
push 0x43e949
call sub.KERNEL32.DLL_SetConsoleCtrlHandler
pop ebp
ret

Function at 0x44c46d
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff58
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
xor esi, esi
mov dword [ebp - 0xa8], 0x94
lea eax, [ebp - 0xa8]
push eax
call sub.KERNEL32.DLL_GetVersionExA
cmp dword [ebp - 0x98], 2
jne 0x44c4db
cmp dword [ebp - 0xa4], 5
jb 0x44c4db
push str.winspool.drv
call sub.KERNEL32.DLL_LoadLibraryA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x44c4db
push str.GetDefaultPrinterA
push dword [ebp - 4]
call sub.KERNEL32.DLL_GetProcAddress
test eax, eax
je 0x44c4d3
push edi
push ebx
call eax
mov esi, eax
push dword [ebp - 4]
call sub.KERNEL32.DLL_FreeLibrary
test esi, esi
jne 0x44c520
push dword [edi]
push ebx
push 0x65b02c
push str.device
push str.windows
call sub.KERNEL32.DLL_GetProfileStringA
test eax, eax
je 0x44c51d
cmp eax, dword [edi]
jae 0x44c51d
xor eax, eax
jmp 0x44c503
inc eax
cmp byte [ebx + eax], 0
je 0x44c50f
cmp byte [ebx + eax], 0x2c
jne 0x44c502
mov byte [ebx + eax], 0
inc eax
mov dword [edi], eax
mov esi, 1
jmp 0x44c520
inc eax
mov dword [edi], eax
test esi, esi
jne 0x44c5c6
cmp dword [ebp - 0x98], 1
jne 0x44c5c6
lea edx, [ebp - 0xc]
push edx
lea ecx, [ebp - 8]
push ecx
push 0
push 0
push 2
push 0
push 1
call sub.WINSPOOL.DRV_EnumPrintersA
test eax, eax
je 0x44c5c6
cmp dword [ebp - 8], 0
jbe 0x44c5c6
push dword [ebp - 8]
call sym.SISCOM.EXE__hb_xgrab
pop ecx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x44c5c6
lea eax, [ebp - 0xc]
push eax
lea edx, [ebp - 8]
push edx
push dword [ebp - 8]
push dword [ebp - 0x10]
push 2
push 0
push 1
call sub.WINSPOOL.DRV_EnumPrintersA
test eax, eax
je 0x44c5bd
cmp dword [ebp - 0xc], 0
jbe 0x44c5bd
mov ecx, dword [ebp - 0x10]
push dword [ecx + 4]
call sub.KERNEL32.DLL_lstrlenA
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x44c5bd
mov eax, dword [edi]
cmp eax, dword [ebp - 0x14]
jbe 0x44c5bd
mov edx, dword [ebp - 0x10]
push dword [edx + 4]
push ebx
call sub.KERNEL32.DLL_lstrcpyA
mov ecx, dword [ebp - 0x14]
inc ecx
mov dword [edi], ecx
mov esi, 1
push dword [ebp - 0x10]
call sym.SISCOM.EXE__hb_xfree
pop ecx
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44cb17
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 8
add esp, 0xfffff004
push eax
dec eax
jne 0x44cb20
mov eax, dword [ebp - 4]
add esp, 0xffffffec
push ebx
push esi
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call sub.WINSPOOL.DRV_OpenPrinterA
test eax, eax
je 0x44cc31
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x8018], edx
xor ecx, ecx
mov dword [ebp - 0x8014], ecx
mov dword [ebp - 0x8010], 0x65b09e
lea eax, [ebp - 0x8018]
push eax
push 1
push dword [ebp - 4]
call sub.WINSPOOL.DRV_StartDocPrinterA
test eax, eax
je 0x44cc22
push dword [ebp - 4]
call sub.WINSPOOL.DRV_StartPagePrinter
test eax, eax
je 0x44cc13
push 0
push 0x80
push 3
push 0
push 1
push accept
push dword [ebp + 0xc]
call sub.KERNEL32.DLL_CreateFileA
mov esi, eax
cmp esi, 0xffffffff
je 0x44cc04
jmp 0x44cbd5
mov eax, dword [ebp - 8]
cmp byte [ebp + eax - 0x800d], 0x1a
jne 0x44cbbf
dec dword [ebp - 8]
lea edx, [ebp - 0xc]
push edx
push dword [ebp - 8]
lea ecx, [ebp - 0x800c]
push ecx
push dword [ebp - 4]
call sub.WINSPOOL.DRV_WritePrinter
push 0
lea eax, [ebp - 8]
push eax
push 0x8000
lea edx, [ebp - 0x800c]
push edx
push esi
call sub.KERNEL32.DLL_ReadFile
test eax, eax
je 0x44cbf7
cmp dword [ebp - 8], 0
ja 0x44cbaf
mov ebx, 1
push esi
call sub.KERNEL32.DLL_CloseHandle
jmp 0x44cc09
mov ebx, 0xfffffffa
push dword [ebp - 4]
call sub.WINSPOOL.DRV_EndPagePrinter
jmp 0x44cc18
mov ebx, 0xfffffffc
push dword [ebp - 4]
call sub.WINSPOOL.DRV_EndDocPrinter
jmp 0x44cc27
mov ebx, 0xfffffffd
push dword [ebp - 4]
call sub.WINSPOOL.DRV_ClosePrinter
jmp 0x44cc36
mov ebx, 0xfffffffe
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x464e68
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff40
movzx eax, word [ebp + 8]
cmp eax, 0x68
jg 0x464ec9
je 0x464fb8
cmp eax, 4
jg 0x464ead
je 0x464f76
sub eax, 1
jb 0x464f1b
je 0x464f2f
dec eax
je 0x464f4e
dec eax
je 0x464f62
jmp 0x465022
sub eax, 0x65
je 0x464f7d
dec eax
je 0x464f97
dec eax
je 0x464fa1
jmp 0x465022
cmp eax, 0x3ec
jg 0x464efd
je 0x464fe0
sub eax, 0x69
je 0x464fbc
sub eax, 0x380
je 0x464fc0
dec eax
je 0x464fc8
dec eax
je 0x464fcc
jmp 0x465022
sub eax, 0x3ed
je 0x464ffa
dec eax
je 0x46501e
dec eax
je 0x464fc4
jmp 0x465022
lea edx, [ebp - 0x20]
push edx
call sub.KERNEL32.DLL_GlobalMemoryStatus
mov eax, dword [ebp - 0x14]
shr eax, 0xa
jmp 0x465024
lea edx, [ebp - 0x40]
push edx
call sub.KERNEL32.DLL_GlobalMemoryStatus
cmp dword [ebp - 0x34], 0xffffffff
jae 0x464f43
mov eax, dword [ebp - 0x34]
jmp 0x464f46
or eax, 0xffffffff
shr eax, 0xa
jmp 0x465024
lea edx, [ebp - 0x60]
push edx
call sub.KERNEL32.DLL_GlobalMemoryStatus
mov eax, dword [ebp - 0x54]
shr eax, 0xa
jmp 0x465024
lea edx, [ebp - 0x80]
push edx
call sub.KERNEL32.DLL_GlobalMemoryStatus
mov eax, dword [ebp - 0x64]
shr eax, 0xa
jmp 0x465024
xor eax, eax
jmp 0x465024
lea edx, [ebp - 0xa0]
push edx
call sub.KERNEL32.DLL_GlobalMemoryStatus
mov eax, dword [ebp - 0x98]
shr eax, 0xa
jmp 0x465024
mov eax, 1
jmp 0x465024
lea edx, [ebp - 0xc0]
push edx
call sub.KERNEL32.DLL_GlobalMemoryStatus
mov eax, dword [ebp - 0xac]
shr eax, 0xa
jmp 0x465024
xor eax, eax
jmp 0x465024
xor eax, eax
jmp 0x465024
xor eax, eax
jmp 0x465024
xor eax, eax
jmp 0x465024
xor eax, eax
jmp 0x465024
cmp dword [0x672080], 0
je 0x464fdc
mov eax, dword [0x6895c8]
jmp 0x465024
xor eax, eax
jmp 0x465024
cmp dword [0x672080], 0
je 0x464ff6
mov eax, dword [0x6895c8]
shl eax, 3
lea eax, [eax + eax*2]
jmp 0x465024
xor eax, eax
jmp 0x465024
cmp dword [0x672080], 0
je 0x46501a
mov eax, dword [0x6895c0]
sub eax, dword [0x6895bc]
test eax, eax
jns 0x465015
add eax, 3
sar eax, 2
jmp 0x465024
xor eax, eax
jmp 0x465024
xor eax, eax
jmp 0x465024
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x469c46
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff54
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push edi
push 0
call fcn.0046963a
add esp, 8
mov esi, eax
push 0
push esi
call sym.SISCOM.EXE__hb_fsOpen
add esp, 8
mov ebx, eax
push esi
call sym.SISCOM.EXE__hb_xfree
pop ecx
cmp ebx, 0xffffffff
jne 0x469d65
push str.I18N
push edi
push 0
call sub.KERNEL32.DLL_FindResourceA
test eax, eax
jne 0x469c97
xor eax, eax
jmp 0x469e22
push eax
push 0
call sub.KERNEL32.DLL_LoadResource
test eax, eax
jne 0x469caa
xor eax, eax
jmp 0x469e22
push eax
call sub.KERNEL32.DLL_LockResource
mov ebx, eax
push 0xac
push ebx
lea eax, [ebp - 0xac]
push eax
call fcn.004d4838
add esp, 0xc
push 0x6725d6
lea edx, [ebp - 0xac]
push edx
call fcn.004d49dc
add esp, 8
test eax, eax
je 0x469cfe
push 0x6725db
lea ecx, [ebp - 0xac]
push ecx
call fcn.004d49dc
add esp, 8
test eax, eax
je 0x469cfe
xor eax, eax
jmp 0x469e22
push dword [ebp - 4]
add ebx, 0xac
push ebx
call fcn.00469a0b
add esp, 8
mov ebx, eax
test ebx, ebx
je 0x469d5e
push 0xf
push edi
push 0x68adbc
call fcn.004c2970
add esp, 0xc
push 0x32
lea eax, [ebp - 0x75]
push eax
push 0x68adcc
call fcn.004c2970
add esp, 0xc
cmp dword [0x67259c], 0
je 0x469d4e
push dword [0x67259c]
call fcn.0047fbd2
pop ecx
mov dword [0x67259c], ebx
mov eax, 1
jmp 0x469e22
xor eax, eax
jmp 0x469e22
push 0xac
lea edx, [ebp - 0xac]
push edx
push ebx
call sym.SISCOM.EXE__hb_fsRead
add esp, 0xc
cmp ax, 0xac
je 0x469d8e
push ebx
call sym.SISCOM.EXE__hb_fsClose
pop ecx
xor eax, eax
jmp 0x469e22
push 0x6725d6
lea edx, [ebp - 0xac]
push edx
call fcn.004d49dc
add esp, 8
test eax, eax
je 0x469dc9
push 0x6725db
lea ecx, [ebp - 0xac]
push ecx
call fcn.004d49dc
add esp, 8
test eax, eax
je 0x469dc9
push ebx
call sym.SISCOM.EXE__hb_fsClose
pop ecx
xor eax, eax
jmp 0x469e22
push dword [ebp - 4]
push ebx
call fcn.00469899
add esp, 8
mov ebx, eax
test ebx, ebx
je 0x469e20
push 0xf
push edi
push 0x68adbc
call fcn.004c2970
add esp, 0xc
push 0x32
lea edx, [ebp - 0x75]
push edx
push 0x68adcc
call fcn.004c2970
add esp, 0xc
cmp dword [0x67259c], 0
je 0x469e13
push dword [0x67259c]
call fcn.0047fbd2
pop ecx
mov dword [0x67259c], ebx
mov eax, 1
jmp 0x469e22
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x47d29c
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
push esi
mov ebx, dword [ebp + 8]
lea esi, [ebp - 0x10c]
xor eax, eax
mov dword [esi], eax
xor eax, eax
jmp 0x47d2c2
mov edx, dword [esi + eax*4 + 4]
cmp edx, dword [ebx + 4]
je 0x47d2c6
inc eax
cmp eax, dword [esi]
jb 0x47d2b8
cmp eax, dword [esi]
jne 0x47d2d8
cmp dword [esi], 0x40
jae 0x47d2d8
mov ecx, dword [ebx + 4]
mov dword [esi + eax*4 + 4], ecx
inc dword [esi]
cmp dword [ebx + 0x24], 0xffffffff
jne 0x47d2f7
push 0
push 0
push 0
push esi
mov eax, dword [ebx + 4]
inc eax
push eax
call sub.WSOCK32.DLL_select
test eax, eax
jge 0x47d334
xor eax, eax
jmp 0x47d33d
mov eax, dword [ebx + 0x24]
mov ecx, 0x3e8
cdq
idiv ecx
mov dword [ebp - 8], eax
mov eax, dword [ebx + 0x24]
mov ecx, 0x3e8
cdq
idiv ecx
imul eax, edx, 0x3e8
mov dword [ebp - 4], eax
lea edx, [ebp - 8]
push edx
push 0
push 0
push esi
mov ecx, dword [ebx + 4]
inc ecx
push ecx
call sub.WSOCK32.DLL_select
test eax, eax
jge 0x47d334
xor eax, eax
jmp 0x47d33d
push esi
push dword [ebx + 4]
call sub.WSOCK32.DLL___WSAFDIsSet
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x47d343
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
push esi
mov ebx, dword [ebp + 8]
lea esi, [ebp - 0x10c]
xor eax, eax
mov dword [esi], eax
xor eax, eax
jmp 0x47d369
mov edx, dword [esi + eax*4 + 4]
cmp edx, dword [ebx + 4]
je 0x47d36d
inc eax
cmp eax, dword [esi]
jb 0x47d35f
cmp eax, dword [esi]
jne 0x47d37f
cmp dword [esi], 0x40
jae 0x47d37f
mov ecx, dword [ebx + 4]
mov dword [esi + eax*4 + 4], ecx
inc dword [esi]
cmp dword [ebx + 0x24], 0xffffffff
jne 0x47d39e
push 0
push 0
push esi
push 0
mov eax, dword [ebx + 4]
inc eax
push eax
call sub.WSOCK32.DLL_select
test eax, eax
jge 0x47d3db
xor eax, eax
jmp 0x47d3e4
mov eax, dword [ebx + 0x24]
mov ecx, 0x3e8
cdq
idiv ecx
mov dword [ebp - 8], eax
mov eax, dword [ebx + 0x24]
mov ecx, 0x3e8
cdq
idiv ecx
imul eax, edx, 0x3e8
mov dword [ebp - 4], eax
lea edx, [ebp - 8]
push edx
push 0
push esi
push 0
mov ecx, dword [ebx + 4]
inc ecx
push ecx
call sub.WSOCK32.DLL_select
test eax, eax
jge 0x47d3db
xor eax, eax
jmp 0x47d3e4
push esi
push dword [ebx + 4]
call sub.WSOCK32.DLL___WSAFDIsSet
pop esi
pop ebx
mov esp, ebp
pop ebp
ret