joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47a89d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
je 0x47a929
cmp dword [esi + 0x20], 0
je 0x47a929
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x47a929
cmp dword [ebp + 8], 0
je 0x47a929
xor edi, edi
mov ebx, edi
call fcn.00481371
push 0x5f8aa0
push dword [ebp + 8]
mov eax, dword [eax + 0xc]
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 8], eax
test eax, eax
je 0x47a90d
mov ebx, dword [ebp - 4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp - 8]
mov edi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x47a929
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
push edi
push ebx
push esi
call fcn.00502156
mov edi, eax
add esp, 0xc
test edi, edi
je 0x47a925
mov ecx, esi
call fcn.0047a63b
mov eax, edi
jmp 0x47a92b
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x47f284
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x5e54a6
call fcn.005affb6
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x74], ebx
jne 0x47f2aa
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x47f304
lea ecx, [ebp - 0x10]
call fcn.004023f3
mov edi, dword [edi + 0x74]
lea ecx, [ebp - 0x10]
push ecx
mov dword [ebp - 4], ebx
mov eax, dword [edi]
mov esi, dword [eax + 0x8c]
mov ecx, esi
call dword [0x5f5a78]
mov ecx, edi
call esi
mov esi, dword [ebp + 8]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push esi
call fcn.005c0e56
push eax
call fcn.0040327e
add esp, 0x14
test esi, esi
je 0x47f2f7
push esi
call fcn.005b95f9
pop ecx
mov ebx, eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.004023d1
mov eax, ebx
call fcn.005aff84
ret 8

Function at 0x4816a5
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x84], ebx
test ebx, 0xffff0000
jne 0x4816d0
cmp dword [edi + 0x80], 0
jne 0x4816d0
movzx eax, bx
mov dword [edi + 0x80], eax
call fcn.00481371
push 5
push ebx
mov esi, dword [eax + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ecx, edi
push eax
call fcn.0048195a
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x4816fd
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, ecx
xor esi, esi
call fcn.00481371
push 5
push dword [ebp + 8]
mov edi, dword [eax + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x481730
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
push edi
push dword [ebp + 0xc]
mov ecx, ebx
push esi
call fcn.00481743
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x4832f9
Capabilities:
Connect to http server

Disassembly:
push 4
mov eax, 0x5e6766
call fcn.005affb6
mov esi, ecx
mov dword [ebp - 0x10], esi
push dword [ebp + 0x1c]
mov edi, dword [ebp + 0xc]
push dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
push edi
push ebx
call fcn.004833e3
and dword [ebp - 4], 0
lea ecx, [esi + 0x18]
mov dword [esi], vtable.CHttpConnection.0
call fcn.004023f3
mov byte [ebp - 4], 1
test edi, edi
jne 0x48333b
xor eax, eax
jmp 0x483342
push edi
call fcn.005b95f9
pop ecx
push eax
push edi
lea ecx, [esi + 0x18]
call fcn.00402193
push dword [esi + 8]
push 0
push 3
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push edi
push dword [ebx + 8]
call dword [sym.imp.WININET.dll_InternetConnectW]
mov dword [esi + 4], eax
test eax, eax
je 0x483385
push dword [esi + 0xc]
mov ecx, 0x66ac5c
push eax
call fcn.00484516
mov eax, esi
call fcn.005aff84
ret 0x18
push 0
push dword [esi + 8]
call fcn.00483aff
int3

Function at 0x4834fc
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
mov esi, ecx
and dword [esi + 0x10], 0
and dword [esi + 0xc], 0
mov dword [esi + 4], eax
mov eax, dword [ebp + 8]
mov dword [esi], vtable.CInternetSession.0
test eax, eax
jne 0x483525
call fcn.00481371
mov eax, dword [eax + 0x10]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [esi + 8], eax
test eax, eax
je 0x483552
push esi
push eax
mov ecx, 0x66ac5c
call fcn.00484516
mov eax, esi
pop esi
pop ebp
ret 0x18
push 0
push dword [esi + 4]
call fcn.00483aff
int3
Function at 0x484328
Capabilities:
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x40], ebx
jne 0x484369
push 0x1000
call fcn.0048457b
test eax, eax
je 0x484381
lea eax, [ebp - 4]
push eax
push dword [esi + 0x38]
push dword [esi + 0x40]
push dword [esi + 0x18]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x48440e
mov eax, dword [ebp - 4]
mov dword [esi + 0x44], eax
mov dword [esi + 0x3c], ebx
mov eax, dword [ebp + 0xc]
mov ecx, dword [esi + 0x40]
mov edx, dword [esi + 0x3c]
add ecx, edx
push edi
mov edi, dword [ebp + 8]
lea ebx, [eax*2 - 2]
jmp 0x4843ca
xor eax, eax
jmp 0x4843e4
cmp edx, dword [esi + 0x44]
jb 0x4843b2
lea eax, [ebp - 4]
push eax
push dword [esi + 0x38]
push dword [esi + 0x40]
push dword [esi + 0x18]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x48440a
mov eax, dword [ebp - 4]
mov dword [esi + 0x44], eax
test eax, eax
je 0x4843ea
and dword [esi + 0x3c], 0
mov ecx, dword [esi + 0x40]
mov al, byte [ecx]
cmp al, 0xd
je 0x4843bc
mov byte [edi], al
inc edi
dec ebx
mov edx, dword [esi + 0x3c]
inc edx
mov dword [esi + 0x3c], edx
mov al, byte [ecx]
inc ecx
cmp al, 0xa
je 0x4843ce
test ebx, ebx
jne 0x484385
and ebx, 1
add ebx, 2
push ebx
push 0
push edi
call fcn.005b3720
mov eax, dword [ebp + 8]
add esp, 0xc
pop edi
pop esi
pop ebx
leave
ret 8
and ebx, 1
add ebx, 2
push ebx
push 0
push edi
call fcn.005b3720
sub edi, dword [ebp + 8]
add esp, 0xc
neg edi
sbb edi, edi
and edi, dword [ebp + 8]
mov eax, edi
jmp 0x4843e3
push 0
jmp 0x48440f
push ebx
push dword [esi + 0x20]
call fcn.00483aff
int3

Function at 0x484626
Capabilities:
Send data

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x1c], 1
je 0x4846cd
mov ecx, dword [esi + 0x18]
test ecx, ecx
je 0x4846cd
cmp dword [esi + 0x34], 0
mov edi, dword [ebp + 0xc]
jne 0x48466a
lea eax, [ebp - 4]
push eax
push edi
push dword [ebp + 8]
push ecx
call dword [sym.imp.WININET.dll_InternetWriteFile]
test eax, eax
je 0x4846d1
cmp dword [ebp - 4], edi
jne 0x4846d1
pop edi
pop esi
leave
ret 8
mov edx, dword [esi + 0x30]
lea eax, [edx + edi]
cmp eax, dword [esi + 0x2c]
jb 0x48468e
lea eax, [ebp - 4]
push eax
push edx
push dword [esi + 0x34]
push ecx
call dword [sym.imp.WININET.dll_InternetWriteFile]
test eax, eax
je 0x4846d1
and dword [esi + 0x30], 0
xor edx, edx
mov ecx, dword [esi + 0x2c]
cmp edi, ecx
jb 0x4846ac
lea eax, [ebp - 4]
push eax
push edi
push dword [ebp + 8]
push dword [esi + 0x18]
call dword [sym.imp.WININET.dll_InternetWriteFile]
test eax, eax
jne 0x484664
jmp 0x4846d1
lea eax, [edx + edi]
cmp eax, ecx
ja 0x484664
mov eax, dword [esi + 0x34]
sub ecx, edx
push edi
push dword [ebp + 8]
add eax, edx
push ecx
push eax
call fcn.0040cded
add esp, 0x10
add dword [esi + 0x30], edi
jmp 0x484664
push 6
jmp 0x4846d3
push 0
push dword [esi + 0x20]
call fcn.00483aff
int3
Function at 0x486687
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
xor eax, eax
mov dword [ebp - 8], ecx
inc eax
inc ebx
mov dword [ebp - 4], eax
cmp dword [edi + 8], ebx
jle 0x4866fe
mov edx, dword [ebp + 0xc]
test edx, edx
je 0x4866c4
mov eax, dword [ecx + 0x10]
cmp dword [eax + ebx*8 + 4], edx
je 0x4866c4
mov eax, dword [edi + 0xc]
cmp dword [eax + ebx*4], 0
je 0x4866f1
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x4866f4
mov eax, dword [edi + 0xc]
mov eax, dword [eax + ebx*4]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x4866ea
mov eax, dword [eax]
push 1
mov esi, dword [eax]
mov ecx, esi
call dword [0x5f5a78]
mov ecx, dword [ebp - 0xc]
call esi
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 0xc]
mov eax, dword [edi + 0xc]
and dword [eax + ebx*4], 0
mov eax, dword [ebp - 4]
inc ebx
cmp ebx, dword [edi + 8]
jl 0x4866a7
test eax, eax
je 0x486745
lea esi, [ecx + 0x1c]
mov ebx, edi
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [ebp - 8]
push edi
add ecx, 0x14
call fcn.00486976
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push dword [ebx + 0xc]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [edi]
push 1
mov esi, dword [eax]
mov ecx, esi
call dword [0x5f5a78]
mov ecx, edi
call esi
mov eax, dword [ebp - 8]
push 0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x49a0a1
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
push edi
test esi, esi
jne 0x49a0ba
call fcn.00481371
mov esi, dword [eax + 0xc]
push 0x5fa474
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x49a0fc
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x49a0fc
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x49a0fc
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 4]
push eax
push ebx
call fcn.0049a105
jmp 0x49a0fe
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x503bab
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
mov dword [ebp - 4], ebx
test byte [edi + 4], 1
mov esi, dword [edi + 0xc]
jne 0x503c01
push 5
push esi
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x503bda
call fcn.004802b4
push esi
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
jne 0x503bef
call fcn.004802b4
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x503c01
call fcn.004802b4
call fcn.00481371
cmp dword [eax + 0x3c], 0
je 0x503c16
push esi
mov ecx, ebx
call fcn.005032d1
mov esi, eax
push dword [ebp + 0xc]
push esi
call fcn.00503dfc
mov ebx, eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x88]
test ecx, ecx
je 0x503c3f
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 4]
and dword [eax + 0x88], 0
test ebx, ebx
je 0x503c4b
mov esi, ebx
mov dword [eax + 0x88], ebx
or dword [edi + 4], 1
mov dword [edi + 0xc], esi
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x50bf1e
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
mov ecx, dword [esi + 4]
call fcn.0047ee61
push 0xfffffffffffffff0
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
push dword [ebp + 0xc]
and eax, 3
mov ecx, esi
cmp al, 3
je 0x50bf5a
call fcn.0050c13b
mov dword [esi + 0xc], 1
jmp 0x50bf5f
call fcn.0050c13b
cmp dword [esi], 0
je 0x50bfaa
push edi
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov esi, dword [ebp + 0x10]
mov edi, eax
mov ecx, esi
test edi, edi
jle 0x50bf85
push edi
call fcn.0046800b
lea ecx, [edi + 1]
push ecx
jmp 0x50bf94
push 0xff
call fcn.004020df
push 0x100
push eax
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0xffffffffffffffff
mov ecx, esi
call fcn.0046802e
pop edi
jmp 0x50bfce
mov esi, dword [ebp + 0x10]
push dword [esi]
push 0xffffffffffffffff
push 0x14d
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
jne 0x50bfce
push dword [esi]
push dword [ebp - 4]
call fcn.00487e17
pop esi
leave
ret 0xc

Function at 0x50c092
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
push edi
push dword [ebp + 0xc]
call fcn.0050c13b
cmp dword [esi], 0
mov edi, eax
mov dword [esi + 0xc], 1
je 0x50c0da
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.0046800b
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.0046802e
jmp 0x50c0e5
mov eax, dword [ebp + 0x10]
push dword [eax]
push edi
call fcn.00487e17
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x50c9ba
Capabilities:
Get file attributes
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x663000]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
push 0x230
xor edi, edi
push edi
push esi
call fcn.005b3720
push 0xffffffffffffffff
push dword [ebx + 0xc]
lea eax, [esi + 0x24]
push 0x104
push eax
call fcn.005c0e56
push eax
call fcn.0040327e
mov eax, dword [ebx + 4]
add esp, 0x20
cmp eax, dword [0x603168]
je 0x50cb18
lea ecx, [ebp - 0x48]
push ecx
lea ecx, [ebp - 0x40]
push ecx
lea ecx, [ebp - 0x38]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
je 0x50cb2c
lea eax, [ebp - 0x30]
push eax
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x50cb2c
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x2c]
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], ecx
mov eax, dword [ebx + 0xc]
cmp dword [eax - 0xc], edi
je 0x50ca76
mov ecx, dword [ebx + 0x10]
test ecx, ecx
je 0x50ca6a
lea edx, [ebp - 0x28]
push edx
push edi
push eax
call fcn.0050c76b
neg eax
sbb eax, eax
and eax, dword [ebp - 0x28]
jmp 0x50ca71
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x50ca78
mov eax, edi
mov ecx, esi
mov dword [ecx + 0x20], eax
lea eax, [ebp - 0x38]
push eax
call fcn.0050cc6b
test eax, eax
je 0x50ca9f
push 0xffffffffffffffff
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x50]
call fcn.0048358f
mov ecx, dword [eax]
mov eax, dword [eax + 4]
jmp 0x50caa3
mov ecx, edi
mov eax, edi
mov dword [esi], ecx
mov dword [esi + 4], eax
lea eax, [ebp - 0x40]
push eax
call fcn.0050cc6b
test eax, eax
je 0x50caca
push 0xffffffffffffffff
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x50]
call fcn.0048358f
mov ecx, dword [eax]
mov eax, dword [eax + 4]
jmp 0x50cace
mov ecx, edi
mov eax, edi
mov dword [esi + 0x10], ecx
mov dword [esi + 0x14], eax
lea eax, [ebp - 0x48]
push eax
call fcn.0050cc6b
test eax, eax
je 0x50caf6
push 0xffffffffffffffff
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x50]
call fcn.0048358f
mov edi, dword [eax]
mov ecx, dword [eax + 4]
jmp 0x50caf8
mov ecx, edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], ecx
mov eax, dword [esi]
or eax, dword [esi + 4]
jne 0x50cb0a
mov dword [esi], edi
mov dword [esi + 4], ecx
mov eax, dword [esi + 0x10]
or eax, dword [esi + 0x14]
jne 0x50cb18
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], ecx
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005af765
leave
ret 4
xor eax, eax
jmp 0x50cb1b
Function at 0x534928
Capabilities:
Create process on windows

Disassembly:
push esi
mov esi, dword [ecx + 0x14]
cmp dword [esi - 0xc], 0
je 0x53495e
push ebx
mov ebx, dword [ecx + 8]
push edi
mov edi, dword [ecx + 0xc]
call fcn.00466c66
test eax, eax
je 0x534946
mov eax, dword [eax + 0x20]
push 1
push edi
push ebx
push esi
push 0
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
pop edi
sbb eax, eax
pop ebx
inc eax
pop esi
ret
xor eax, eax
pop esi
ret

Function at 0x5762c0
Capabilities:
Extract resource via kernel32 functions
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x576406
mov ecx, 0x662bd4
call fcn.00486821
mov esi, eax
test esi, esi
je 0x5763fb
xor eax, eax
cmp word [esi + 8], ax
jne 0x5763c5
push str.comctl32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ebx, eax
test ebx, ebx
je 0x576381
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov edi, dword [ebp + 0x10]
mov ecx, 0x3ff
and ax, cx
cmp ax, 0x11
jne 0x576347
push 0x615988
call fcn.00576444
pop ecx
test eax, eax
je 0x576347
mov eax, edi
neg eax
push 0xfc11
sbb eax, eax
and eax, 0xe
add eax, 0x3ee
push eax
push 5
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
test eax, eax
jne 0x576362
neg edi
push 5
sbb edi, edi
and edi, 0xe
add edi, 0x3ee
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x576381
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
test eax, eax
je 0x576387
push ebx
push edi
push eax
call fcn.00504850
add esp, 0xc
jmp 0x576387
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov eax, dword [edi]
push 2
mov eax, dword [eax - 0xc]
inc eax
push eax
call fcn.00461000
pop ecx
pop ecx
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ecx, eax
mov dword [esi + 4], ecx
test ecx, ecx
je 0x576400
mov eax, dword [edi]
push eax
mov eax, dword [eax - 0xc]
inc eax
push eax
push ecx
call fcn.00485e41
mov ax, word [ebx]
add esp, 0xc
mov word [esi + 8], ax
xor eax, eax
jmp 0x5763c8
mov ebx, dword [ebp + 0xc]
mov edi, dword [esi + 4]
test edi, edi
je 0x5763d6
push edi
call fcn.005b95f9
pop ecx
mov ecx, dword [ebp + 8]
push eax
push edi
call fcn.00402193
movzx ecx, word [esi + 8]
mov edx, 0xffff
xor eax, eax
mov word [ebx], cx
pop edi
cmp cx, dx
pop esi
setne al
pop ebx
pop ebp
ret 0xc
call fcn.004665cc
call fcn.004665e6
int3
Function at 0x5777d6
Capabilities:
Get file system object information

Disassembly:
push 0x6f8
mov eax, 0x5f0ba2
call fcn.005affe9
mov ebx, ecx
mov ecx, dword [ebp + 0x14]
xor esi, esi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x700], edi
test ecx, ecx
je 0x577967
mov eax, dword [ebp + 0x10]
sub eax, esi
je 0x577939
sub eax, 1
je 0x577855
sub eax, 1
je 0x57782d
sub eax, 1
je 0x577855
push 0x62de00
mov ecx, edi
call fcn.0040303e
mov eax, edi
call fcn.005aff98
ret 0x10
push 0x408
push 0x2b4
lea eax, [ebp - 0x6fc]
push eax
push esi
push dword [ecx + 4]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x577817
lea eax, [ebp - 0x4e8]
push eax
jmp 0x57781c
lea eax, [ebp - 0x218]
push eax
push dword [ecx + 4]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x577817
push esi
lea eax, [ebp - 0x448]
mov dword [ebp - 0x448], esi
push eax
lea eax, [ebp - 0x218]
mov dword [ebp - 0x444], esi
push eax
mov dword [ebp - 0x440], esi
mov dword [ebp - 0x43c], esi
mov dword [ebp - 0x438], esi
mov dword [ebp - 0x434], esi
call fcn.0050cb30
test eax, eax
je 0x577817
lea ecx, [ebp - 0x700]
call fcn.004023f3
cmp dword [ebp + 0x10], 1
mov dword [ebp - 4], esi
jne 0x5778ef
test byte [ebp - 0x428], 0x18
jne 0x577911
mov eax, dword [ebx]
lea ecx, [ebp - 0x700]
push ecx
push dword [ebp - 0x42c]
mov esi, dword [eax + 0x1a0]
mov ecx, esi
push dword [ebp - 0x430]
call dword [0x5f5a78]
mov ecx, ebx
call esi
jmp 0x577911
mov eax, dword [ebx]
lea ecx, [ebp - 0x700]
push ecx
lea ecx, [ebp - 0x440]
push ecx
mov esi, dword [eax + 0x1a4]
mov ecx, esi
call dword [0x5f5a78]
mov ecx, ebx
call esi
mov eax, dword [ebp - 0x700]
add eax, 0xfffffff0
push eax
call fcn.004022dd
pop ecx
mov ecx, dword [ebp - 0x700]
add eax, 0x10
mov dword [edi], eax
lea ecx, [ecx - 0x10]
call fcn.004023d1
jmp 0x577823
push 0x208
push 0x2b4
lea eax, [ebp - 0x6fc]
push eax
push esi
push dword [ecx + 4]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x577817
lea eax, [ebp - 0x6f0]
jmp 0x577852
call fcn.004665cc
int3

Function at 0x577ad5
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, ecx
call fcn.005aadea
call fcn.004813c5
cmp dword [eax + 0x14], 0
jne 0x577af0
mov ecx, esi
pop esi
jmp fcn.00576df8
pop esi
ret

Function at 0x584553
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c0
mov eax, dword [0x663000]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x2bc], esi
test eax, eax
je 0x5845bd
push 0x208
push 0x2b4
lea ecx, [ebp - 0x2b8]
push ecx
push 0
push dword [eax + 4]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov ecx, esi
test eax, eax
je 0x5845a2
lea eax, [ebp - 0x2ac]
push eax
jmp 0x5845a7
push 0x617c20
call fcn.0040303e
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.005af765
leave
ret 8
call fcn.004665cc
int3

Function at 0x584aa2
Capabilities:
Get common file path
Get file system object information

Disassembly:
push esi
mov esi, ecx
call fcn.00401fb0
call fcn.004813c5
cmp dword [eax + 0x14], 0
jne 0x584abd
mov ecx, esi
pop esi
jmp fcn.005842fd
pop esi
ret
Function at 0x588b32
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
call fcn.005c6fb9
pop ecx
test eax, eax
jne 0x588b74
push dword [ebp - 4]
push dword [ebp + 0xc]
push dword [ebp + 8]
push str._s_s_X.tmp
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.004767cd
add esp, 0x18
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x588b3a
leave
ret
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
leave
ret
Function at 0x5b06f5
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x5b0734
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x5b0734
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x5b0734
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x5b0734
cmp dword [ecx + 0x74], 0xe
jbe 0x5b0734
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x5d10aa
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005d0d5b

Function at 0x5d10b5
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005d0ee5

Function at 0x5d26e3
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005d2360

Function at 0x5da050
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x5da07d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x5da07d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x40197d
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov eax, dword [esp + 8]
mov dword [0x4040d0], eax
xor eax, eax
mov ebp, esp
mov ecx, 0xa
push eax
dec ecx
jne 0x401990
push esp
mov dword [ebp - 0x24], 0x4016f4
mov eax, dword [0x4040d0]
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], str.solienty
call dword [sym.imp.USER32.dll_RegisterClassA]
xor eax, eax
push eax
push dword [0x4040d0]
push eax
push eax
push 0x190
push 0x2b2
push 0x640
push 0x9c4
push 0
push str.absent
push str.solienty
push eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x4040d8], eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x401a2f
mov esi, dword [sym.imp.USER32.dll_TranslateMessage]
mov edi, dword [sym.imp.USER32.dll_DispatchMessageA]
lea eax, [ebp - 0x1c]
push eax
call esi
lea ecx, [ebp - 0x1c]
push ecx
call edi
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jne 0x401a10
pop ebp
ret 0x10