joyce8/EMBER2024-capa huggingface dataset:
Function at 0x447772
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x44783f
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x447812
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x4477f5
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x4477de
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jg 0x4477f3
push 0
push 1
call fcn.00473bd5
pop ecx
pop ecx
jmp 0x4477d3
jmp 0x447810
push 0x112f
push 0
push 0x26a6
push 0x4cf
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x44783d
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
push 0x7f31
push dword [ebp - 0x24]
push 1
push 0x213
push 0x258
push 1
push 0
push 0x7b77
call fcn.00444ae2
add esp, 0x20
jmp 0x447850
push 0x1934
push 0
push 1
call fcn.00441fa1
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x447e10
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x447f25
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x30], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x447ea0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x447e80
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x447e7e
push 0
call fcn.0044d4f9
pop ecx
jmp 0x447e9b
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x447e9b
push 0x2402
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
jmp 0x447f23
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test eax, eax
je 0x447f0c
mov dword [ebp - 8], 0xfffffffe
mov dword [ebp - 0xc], 1
mov dword [ebp - 0x44], 1
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
push 0x64cd
push 0x5de5
push 0
push 0x4859
push 0x2485
push 0xe74
push 1
push 0x30a0
lea eax, [ebp - 0xc]
push eax
push 0
push 0x6e4f
call fcn.00475610
add esp, 0x30
jmp 0x447f23
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x10]
mov dword [ecx], eax
jmp 0x447f3e
push 0x5f84
push 1
push 0x11a4
push 0x3dae
call fcn.00439d83
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x448f17
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
movzx eax, byte [ebp + 0x20]
test eax, eax
je 0x448f35
push 1
push 1
call fcn.00449097
pop ecx
pop ecx
jmp 0x449093
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x24], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x449085
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x449068
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x58]
mov dword [eax], 0xffff
mov eax, dword [ebp - 0x5c]
mov dword [eax], 0xffff
xor eax, eax
inc eax
cmp eax, 0x6941fc9a
je 0x448ff0
mov dword [ebp - 0xc], 1
jmp 0x448ff4
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
cmp dword [eax], ecx
jge 0x449011
mov dword [ebp - 8], 1
jmp 0x449015
and dword [ebp - 8], 0
mov eax, dword [ebp - 8]
sub eax, 0x177
cmp eax, 1
jne 0x44902b
mov dword [ebp - 0x10], 1
jmp 0x44902f
and dword [ebp - 0x10], 0
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x10]
jl 0x449040
mov dword [ebp - 0x14], 1
jmp 0x449044
and dword [ebp - 0x14], 0
cmp dword [ebp - 0x14], 0x780e
jge 0x449056
mov dword [ebp - 0x18], 1
jmp 0x44905a
and dword [ebp - 0x18], 0
imul eax, dword [ebp - 0x18], 0x9e88
mov ecx, dword [ebp - 0x60]
mov dword [ecx], eax
jmp 0x449083
push 0x112f
push 0
push 0x26a6
push 0x4cf
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x449093
push 0x20f5
push 0
call fcn.00438424
pop ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x449f3e
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x449fde
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x449fad
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
push dword [ebp - 0x1c]
push 0xf26
push 0
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push 0x118e
push 0x6f5c
push 0x1c46
call fcn.0044e2e7
add esp, 0x20
jmp 0x449fd9
push 0x4d44
push 0
push 0x3d06
push 0x5b75
push 0x5c82
push 0x7197
push 0x13d5
push 1
push 1
call fcn.0043cc4b
add esp, 0x24
jmp 0x44a082
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x2c], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x30], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x44a046
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x44a02d
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x44a02b
push 0x1076
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
jmp 0x44a044
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
jmp 0x44a082
push 0x62ae
push 0x1565
push 0x2925
push 0x5b15
push 0x488d
push 0x5273
push 0x518d
push 0x3346
push 0x7341
push 0x44a7
push 0
call fcn.00438109
add esp, 0x2c
mov esp, ebp
pop ebp
ret
Function at 0x44d55d
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x44d5e7
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x44d5d0
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x44d5c6
mov byte [ebp - 1], 0
push 1
push 0
push 1
push 0x5054
push 0x20c9
push 0x6fe0
push 1
push 1
push 1
lea eax, [ebp - 1]
push eax
push 1
call fcn.00442269
add esp, 0x2c
jmp 0x44d5ce
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
jmp 0x44d5e5
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
push 0
push 0
push dword [ebp - 0x18]
call fcn.00441fc3
add esp, 0xc
jmp 0x44d606
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
push dword [ebp - 0x1c]
push 0
push 0x3a31
push 0x4250
push 1
call fcn.00444cf0
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x471fe8
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
movzx eax, byte [ebp + 0x2c]
test eax, eax
je 0x472089
lea eax, [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x28]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x47206b
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x472045
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x472043
push 0
push 0x8bb
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
jmp 0x472069
mov byte [ebp - 2], 0
movzx eax, byte [ebp - 2]
test eax, eax
je 0x472069
push 1
push 0
push 0x1e95
push 1
push 0x6ad7
call fcn.00447772
add esp, 0x14
jmp 0x472087
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
push dword [ebp - 0x18]
push 0
push 1
push 1
push 0x44f8
call fcn.0044edd6
add esp, 0x14
jmp 0x4720c9
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x1c], eax
push dword [ebp - 0x1c]
push 1
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
call fcn.0043617c
add esp, 0x1c
mov esp, ebp
pop ebp
ret
Function at 0x473c04
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
movzx eax, byte [ebp + 0x24]
test eax, eax
je 0x473c96
lea eax, [ebp + 0x20]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x473c36
push 1
call fcn.00473d85
pop ecx
jmp 0x473c91
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x473c87
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x473c85
push 0
push 1
push 0x1486
push 0x3059
push 0x47d4
push 1
push 0x652e
push 1
push 0x4d93
push 0x78c7
push 0x34ce
call fcn.00439a63
add esp, 0x2c
jmp 0x473c91
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x473d81
lea eax, [ebp + 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x473d0d
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x473d03
mov byte [ebp - 2], 0
push 0x324
push 1
push 1
lea eax, [ebp - 2]
push eax
push 0
push 1
push 0x766e
push 0x792f
call fcn.00473daf
add esp, 0x20
jmp 0x473d0b
push 0
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
jmp 0x473d81
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x473d59
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x4c]
mov ecx, dword [ecx]
mov dword [eax], ecx
jmp 0x473d81
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x60]
mov eax, dword [eax]
movzx eax, word [eax]
sar eax, 0xc
mov ecx, dword [ebp - 0x64]
mov dword [ecx], eax
mov esp, ebp
pop ebp
ret
Function at 0x4740aa
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x474154
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x474126
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x474104
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x474102
push 0
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x474124
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x474124
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x474152
push 1
push 0x4f26
push 0x233c
push 0x539a
push 0x60d9
push 1
push 0x1dc4
push 0x5f3b
push 1
call fcn.0043ecee
add esp, 0x24
jmp 0x474179
mov eax, dword [ebp + 8]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x2c], eax
push dword [ebp - 0x24]
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
call fcn.00439d83
add esp, 0x10
mov esp, ebp
pop ebp
ret

Function at 0x47450b
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x47455a
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x14], eax
push 0x5f9d
push 1
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push dword [ebp - 0x18]
call fcn.004745ef
add esp, 0x1c
jmp 0x4745eb
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x24], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x4745c2
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x4745a5
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
jmp 0x4745c0
push 0x112f
push 0
push 0x26a6
push 0x4cf
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x4745eb
push 0x6bb8
push 0
push 0x4df0
push 0x53c5
push 1
push 1
push 1
push 0x2d11
push 0x128b
call fcn.0043dd68
add esp, 0x24
mov esp, ebp
pop ebp
ret
Function at 0x474bbc
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x474c88
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x34]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x474c2d
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
push 1
push dword [ebp - 0x18]
push 0x3f42
push 0x1a58
push 0x5057
push 0x7214
push dword [ebp - 0x1c]
push 0xb65
call fcn.00474d84
add esp, 0x20
jmp 0x474c83
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x474c67
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x474c65
push 0x11cb
push 0x5598
push 1
push 0
call fcn.0043c001
add esp, 0x10
jmp 0x474c83
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x474c83
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
jmp 0x474d80
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x40], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x38], eax
lea eax, [ebp + 0x30]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x74], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test eax, eax
je 0x474d5c
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
movzx eax, byte [eax]
test eax, eax
je 0x474d1c
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x60], eax
mov eax, 0x9b76
test eax, eax
je 0x474d0e
mov eax, dword [ebp - 0x60]
cmp dword [eax], 0
je 0x474d0e
mov dword [ebp - 8], 1
jmp 0x474d12
and dword [ebp - 8], 0
mov eax, dword [ebp - 0x64]
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
jmp 0x474d5a
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x70]
movzx eax, byte [eax]
test eax, eax
je 0x474d5a
push 0x2e1e
push 0x6252
push 0
push 1
push 1
push 1
push 0
push 0x10c
push 1
push 0x4c5a
call fcn.00473c04
add esp, 0x28
jmp 0x474d80
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x78], eax
push 0
push dword [ebp - 0x78]
push 0x3087
push 0
push 0x45b4
push 0x2c90
call fcn.00473451
add esp, 0x18
mov esp, ebp
pop ebp
ret
Function at 0x475484
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x4754ff
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x4754e5
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x4754d9
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x4754d7
push 0x2a6e
push 1
push 1
push 1
call fcn.00473ea9
add esp, 0x10
jmp 0x4754e3
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
jmp 0x4754fd
push 1
push 0x54c7
push 1
push 0x4ad2
push 0
call fcn.00438c04
add esp, 0x14
jmp 0x47553f
lea eax, [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x475529
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
push 1
push dword [ebp - 0x1c]
call fcn.0043f8a8
pop ecx
pop ecx
jmp 0x47553f
push 0x1bdf
push 0x6a50
push 1
push 0
call fcn.0043c001
add esp, 0x10
mov esp, ebp
pop ebp
ret

Function at 0x4758c9
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x475907
lea eax, [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x4758f1
push 1
call fcn.00475989
pop ecx
jmp 0x475905
push 0x7afa
push 0
push 0x1341
call fcn.004761de
add esp, 0xc
jmp 0x475985
lea eax, [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x47593d
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
push dword [ebp - 0x14]
push 0xd98
push 1
call fcn.0044ef47
add esp, 0xc
jmp 0x475985
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x47596c
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x47596a
push 0
push 0
push 0x1a94
push 0
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
jmp 0x475985
mov byte [ebp - 2], 0
movzx eax, byte [ebp - 2]
test eax, eax
je 0x475985
push 0x9d2
push 0
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov esp, ebp
pop ebp
ret