joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43fcb0
Capabilities:
Hide graphical window

Disassembly:
cmp dword [esp + 0x18], 0
push ebx
push ebp
push esi
push edi
mov esi, ecx
jne 0x43fe59
mov ebx, dword [esp + 0x18]
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x1c]
cmp ebx, 0x110
jne 0x43fd36
cmp byte [esi + 0x75], 0
mov dword [esi + 0x70], 1
je 0x43fcf2
push 1
push str.IsExterior
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetPropW]
cmp byte [esi + 0x74], 0
je 0x43fd14
push 0xffffffffffffffec
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
or eax, 0x2000000
push eax
push 0xffffffffffffffec
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetWindowLongW]
sub esp, 0xc
lea ecx, [esi + 0x50]
call fcn.00440000
mov ecx, dword [esp + 0x24]
mov dword [esi + 0x70], 0
mov dword [ecx], 0
cmp dword [esi + 0x70], 0
jmp 0x43fdb1
cmp ebx, 2
jne 0x43fd67
push str.IsExterior
push dword [esi + 4]
mov dword [esi + 0x70], 1
call dword [sym.imp.USER32.dll_RemovePropW]
mov ecx, dword [esp + 0x24]
mov dword [esi + 0x70], 0
mov dword [ecx], 0
cmp dword [esi + 0x70], 0
jmp 0x43fdb1
cmp ebx, 0x4e
jne 0x43fdb7
cmp dword [edi + 8], 0xffffff38
jne 0x43fd8e
mov eax, dword [esi + 4]
mov dword [edi + 0xc], eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetParent]
push edi
push ebp
push ebx
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [esp + 0x28]
mov dword [esp + 0x28], 1
push eax
push edi
sub esp, 8
mov ecx, esi
call fcn.0043fe70
mov ecx, dword [esp + 0x24]
cmp dword [esp + 0x28], 0
mov dword [ecx], eax
jne 0x43fe4d
lea ecx, [esi + 0x50]
cmp ebx, 5
jne 0x43fe26
xor eax, eax
test ecx, ecx
cmove esi, eax
cmp byte [ecx + 0x1c], al
je 0x43fdf8
push 0xe801
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
cmp ebp, 2
jne 0x43fde9
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x43fdfd
test ebp, ebp
jne 0x43fdf8
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x43fdfd
cmp ebp, 1
je 0x43fe43
mov eax, edi
lea ecx, [esi + 0x50]
shr eax, 0x10
cwde
push eax
movsx eax, di
push eax
call fcn.00439c50
mov eax, dword [esp + 0x24]
pop edi
pop esi
pop ebp
mov dword [eax], 0
mov eax, 1
pop ebx
ret 0x18
cmp ebx, 0x24
jne 0x43fe59
cmp dword [ecx + 0x14], 0xffffffff
je 0x43fe43
cmp dword [ecx + 0x18], 0xffffffff
je 0x43fe43
mov eax, dword [ecx + 0x14]
mov dword [edi + 0x18], eax
mov eax, dword [ecx + 0x18]
mov dword [edi + 0x1c], eax
mov eax, dword [esp + 0x24]
mov dword [eax], 0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 0x18
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0x18
Function at 0x440b20
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x491af0
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x4c4074]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
call fcn.0041ecc0
mov ebx, dword [sym.imp.USER32.dll_GetParent]
push dword [edi + 4]
test al, al
je 0x440b65
call ebx
push eax
call ebx
push eax
call ebx
push 1
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, edi
call fcn.00440d10
lea ecx, [edi + 0x78]
call fcn.00464f50
push dword [edi + 4]
mov esi, dword [edi + 0xa0]
call ebx
mov ecx, dword [esi + 8]
mov dword [ecx + 8], eax
mov ecx, dword [ecx + 4]
test ecx, ecx
je 0x440b9d
push eax
call fcn.00444640
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x41d
push dword [edi + 4]
call esi
push 0
push eax
mov dword [edi + 0xb4], eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x40f
push dword [edi + 4]
lea ebx, [edi + 0xac]
call esi
push 0x4020
push 0
push 0x1036
push eax
mov dword [ebx], eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov edx, 0x85
lea ecx, [ebp - 0x28]
call fcn.00408e90
mov dword [ebp - 4], 0
sub esp, 0xc
push 0xfa
push ecx
push dword [ebp - 0x28]
mov ecx, ebx
push 0
call fcn.00437cc0
mov edx, 0xa3
lea ecx, [ebp - 0x24]
call fcn.00408e90
mov byte [ebp - 4], 1
sub esp, 0xc
push 0x64
push ecx
push dword [ebp - 0x24]
mov ecx, ebx
push 1
call fcn.00437cc0
mov byte [ebp - 4], 0
or esi, 0xffffffff
mov edx, dword [ebp - 0x24]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x440c4e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x28]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x440c6d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0x41c
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0xfffffffffffffff0
push eax
mov dword [edi + 0xb0], eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov ecx, eax
or ecx, 0x80
cmp eax, ecx
je 0x440ca5
push ecx
push 0xfffffffffffffff0
push dword [edi + 0xb0]
call dword [sym.imp.USER32.dll_SetWindowLongW]
lea eax, [ebp - 0x20]
push eax
push dword [ebx]
call dword [sym.imp.USER32.dll_GetClientRect]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x101d
push dword [ebx]
call esi
mov ecx, dword [ebp - 0x18]
sub ecx, eax
sub ecx, 3
movzx eax, cx
push eax
push 1
push 0x101e
push dword [ebx]
call esi
mov dword [edi + 0x9c], 0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046e38e
mov esp, ebp
pop ebp
ret 8
Function at 0x444420
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x492221
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x4c4074]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
lea edi, [esi + 0xc]
mov byte [esi], 1
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [ebp - 0x14], edi
call fcn.00403d50
mov ecx, eax
test ecx, ecx
je 0x4444f4
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov dword [ebp - 4], 1
lea edi, [esi + 0x18]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [ebp - 0x14], edi
call fcn.00403d50
mov ecx, eax
test ecx, ecx
je 0x4444fe
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov byte [ebp - 4], 3
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.004024c0
push 0x80004005
call fcn.004024c0
int3

Function at 0x444660
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, dword [esi + 0x14]
add eax, 4
push eax
push 0
push esi
push 0x444d00
push 0
push 0
call edi
mov ecx, dword [esi + 0x14]
mov dword [esi + 0x20], eax
mov ecx, dword [ecx + 4]
mov dword [esi + 0x24], ecx
test eax, eax
je 0x4446be
nop
mov esi, dword [esi + 4]
test esi, esi
je 0x4446c6
mov eax, dword [esi + 0x14]
add eax, 4
push eax
push 0
push esi
push 0x444d00
push 0
push 0
call edi
mov dword [esi + 0x20], eax
mov eax, dword [esi + 0x14]
mov eax, dword [eax + 4]
mov dword [esi + 0x24], eax
cmp dword [esi + 0x20], 0
jne 0x444690
pop edi
pop esi
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
xor eax, eax
pop esi
ret
Function at 0x447810
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x492f88
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x4c4074]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [ebp - 0x10]
xor bl, bl
push eax
call fcn.004484b0
mov dword [ebp - 4], 0
push dword [ebp - 0x10]
push 0
push 4
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov dword [esi + 0x1c], eax
test eax, eax
jne 0x44786b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x14], eax
jmp 0x44788a
push 0
push 0
push 0
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 0x20], eax
test eax, eax
jne 0x4478b6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0xffffffff
or edi, 0xffffffff
mov edx, dword [ebp - 0x10]
mov eax, edi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4478ae
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [ebp - 0x14], 0
jne 0x447917
jmp 0x4478da
mov dword [ebp - 4], 0xffffffff
or edi, 0xffffffff
mov edx, dword [ebp - 0x10]
mov eax, edi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4478da
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [esi + 0x20]
push ecx
add eax, 4
push eax
lea eax, [esi + 8]
push eax
call fcn.004487a0
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x447900
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x1c], 0
mov eax, dword [esi + 0x20]
test eax, eax
je 0x447915
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [esi + 0x20], 0
mov bl, 1
lea eax, [ebp - 0x1c]
mov ecx, esi
push eax
call fcn.00448550
mov dword [ebp - 4], 4
push dword [ebp - 0x1c]
push 0
push 2
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov esi, eax
mov dword [ebp - 0x18], 0x4a85d0
mov dword [ebp - 0x14], esi
mov byte [ebp - 4], 5
test esi, esi
je 0x447951
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov byte [ebp - 4], 4
mov dword [ebp - 0x18], 0x4a85d0
test esi, esi
je 0x44796e
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], edi
dec edi
test edi, edi
jg 0x44798d
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x451e10
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4949b8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x4c4074]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ecx + 0x158]
lea edi, [ecx + 0x158]
mov ecx, dword [eax - 0x10]
lea esi, [eax - 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ecx]
call dword [eax + 0x10]
cmp dword [esi + 0xc], 0
mov ecx, eax
lea eax, [esi + 0xc]
jl 0x451e66
cmp ecx, dword [esi]
jne 0x451e66
lock inc dword [eax]
jmp 0x451e92
mov eax, dword [ecx]
lea ebx, [esi + 4]
push 2
push dword [ebx]
call dword [eax]
mov esi, eax
test esi, esi
je 0x451f57
mov eax, dword [ebx]
lea ecx, [esi + 0x10]
mov dword [esi + 4], eax
mov edx, dword [ebx]
inc edx
push edx
push dword [ebp - 0x10]
call fcn.004024f0
add esp, 8
lea eax, [esi + 0x10]
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x10]
push 5
push str..part
call fcn.004023a0
lea ecx, [ebp - 0x10]
call fcn.0040df70
mov esi, dword [ebp - 0x10]
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileW]
test al, al
je 0x451ec6
push esi
call ebx
mov ecx, edi
call fcn.0040df70
test al, al
je 0x451ed5
push dword [edi]
call ebx
push 0x5c
push dword [edi]
call fcn.0046fb32
add esp, 8
or ebx, 0xffffffff
test eax, eax
je 0x451f27
sub eax, dword [edi]
sar eax, 1
cmp eax, ebx
je 0x451f27
push eax
lea eax, [ebp - 0x14]
mov ecx, edi
push eax
call fcn.00409b30
mov byte [ebp - 4], 3
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov byte [ebp - 4], 1
mov eax, ebx
mov edx, dword [ebp - 0x14]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x451f27
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x451f43
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.004024e0
int3
Function at 0x453fb0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x494df0
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x4c4074]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0xe4], 4
je 0x453ff7
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00403d50
mov ecx, eax
test ecx, ecx
je 0x4540f6
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 1
call fcn.00403d50
mov ecx, eax
test ecx, ecx
je 0x454100
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x10]
push 0x4a85e8
call fcn.004071f0
test al, al
jne 0x454056
push 0
push 0x4a85e8
lea ecx, [ebp - 0x10]
call fcn.00407350
mov byte [ebp - 4], 3
lea eax, [ebp - 0x14]
push eax
lea eax, [esi + 0x100]
push eax
lea eax, [esi + 0xfc]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x10c]
push eax
lea edx, [esi + 0xf8]
lea ecx, [esi + 0xf4]
call fcn.0041c840
add esp, 0x14
mov esi, eax
mov byte [ebp - 4], 1
or edi, 0xffffffff
mov edx, dword [ebp - 0x10]
mov ecx, edi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x4540ae
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test esi, esi
mov esi, dword [ebp - 0x14]
jne 0x4540c4
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4540c4
mov bl, 1
jmp 0x4540c6
xor bl, bl
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], edi
dec edi
test edi, edi
jg 0x4540e2
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.004024c0
push 0x80004005
call fcn.004024c0
int3
Function at 0x4563c0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4957a0
mov eax, dword fs:[0]
push eax
sub esp, 0x44
push ebx
push esi
push edi
mov eax, dword [0x4c4074]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
call fcn.004565c0
mov ecx, dword [esi + 0x10]
mov edi, eax
cmp dword [ecx - 0xc], 0
je 0x456464
mov eax, dword [esi + 4]
cmp eax, 6
je 0x456416
cmp eax, 7
je 0x456416
cmp eax, 8
je 0x456416
cmp eax, 9
je 0x456416
cmp eax, 0x12
jne 0x456464
xorps xmm0, xmm0
mov dword [ebp - 0x48], 0
lea eax, [ebp - 0x50]
movlpd qword [ebp - 0x3c], xmm0
push eax
movlpd qword [ebp - 0x30], xmm0
movlpd qword [ebp - 0x28], xmm0
movlpd qword [ebp - 0x20], xmm0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x50], 0x3c
mov dword [ebp - 0x4c], 0x8400
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x44], str.open
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
call fcn.00420c00
mov al, byte [eax + 0x1c]
test al, al
je 0x45655a
call fcn.00420c00
test byte [eax + 0x20], 8
je 0x45655a
call fcn.00420c00
mov ebx, eax
call fcn.00403d50
mov ecx, eax
test ecx, ecx
je 0x4565a8
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 2
lea ecx, [ebp - 0x14]
push 0x18
push str.Updater_finished._Mode:
call fcn.004023a0
push dword [esi + 4]
lea ecx, [ebp - 0x14]
call fcn.004207e0
mov esi, eax
push 0xf
push str.._Return_code:
mov ecx, esi
call fcn.004023a0
push edi
mov ecx, esi
call fcn.004207e0
mov esi, eax
call fcn.00403d50
mov ecx, eax
test ecx, ecx
je 0x4565b2
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x10]
push 0
push 0x4a85e8
call fcn.004023a0
push ecx
push esi
push ecx
lea eax, [ebp - 0x10]
mov ecx, ebx
push eax
call fcn.00420d60
mov byte [ebp - 4], 2
or esi, 0xffffffff
mov edx, dword [ebp - 0x10]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x45653b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x14]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x45655a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test edi, edi
je 0x456594
cmp edi, 0xe0000011
je 0x456594
cmp edi, 0xe0000027
je 0x456594
cmp edi, 0xe0000008
je 0x456594
cmp edi, 0x4c7
je 0x456594
cmp edi, 0x642
je 0x456594
cmp edi, 0xe0000029
je 0x456594
push edi
call fcn.0045d050
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.004024c0
push 0x80004005
call fcn.004024c0
int3
Function at 0x460970
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
lea ebp, [esp - 0x408]
sub esp, 0x408
push 0xffffffffffffffff
push 0x497190
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x4c4074]
xor eax, ebp
mov dword [ebp + 0x404], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [ebp + 0x410]
mov eax, dword [ebp + 0x414]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x418]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x28], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x24], 0
mov dword [ebp], 0
mov byte [ebp - 4], 1
push 0x60
push 0
push edi
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
call ebx
mov esi, eax
mov dword [ebp - 0x1c], esi
test esi, esi
jne 0x460a18
push 2
push eax
push edi
call ebx
mov esi, eax
mov dword [ebp - 0x1c], eax
test esi, esi
jne 0x460a18
call fcn.0045f050
mov edi, eax
jmp 0x460b20
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x460a35
call fcn.0045f050
jmp 0x460b13
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [ebp - 0x18], ebx
test ebx, ebx
jne 0x460a50
call fcn.0045f050
jmp 0x460b13
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov dword [ebp - 0x14], edi
lea eax, [edi + 1]
cmp eax, edi
jae 0x460a6e
mov edi, 0x8007000e
jmp 0x460b15
mov byte [ebp - 4], 2
mov ecx, 2
mul ecx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edx
test edx, edx
ja 0x460b62
jb 0x460a92
cmp eax, 0xffffffff
ja 0x460b62
cmp eax, 0x400
jbe 0x460aab
push eax
lea ecx, [ebp]
call fcn.0040a6a0
mov dword [ebp - 4], 1
jmp 0x460ad0
lea eax, [ebp + 4]
mov dword [ebp], eax
mov dword [ebp - 4], 1
jmp 0x460ad0
mov eax, dword [ebp]
test eax, eax
jne 0x460ade
mov edi, 0x8007000e
jmp 0x460b15
push edi
push eax
push edi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
jne 0x460af9
call fcn.0045f050
jmp 0x460b13
xor edx, edx
mov eax, dword [ebp]
mov word [eax + ecx*2], dx
push dword [ebp + 0x41c]
push dword [ebp]
lea ecx, [ebp - 0x24]
call fcn.00460810
mov edi, eax
test esi, esi
je 0x460b20
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov byte [ebp - 4], 0
lea eax, [ebp + 4]
cmp dword [ebp], eax
je 0x460b34
lea ecx, [ebp]
call fcn.0040a610
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x404]
xor ecx, ebp
call fcn.0046e38e
lea esp, [ebp + 0x408]
pop ebp
ret 0x10
push 0x80070216
call fcn.004024c0
int3
Function at 0x463f90
Capabilities:
Create directory
Hash data with md5

Disassembly:
push ebp
lea ebp, [esp - 0x94]
sub esp, 0x94
push 0xffffffffffffffff
push 0x497d28
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x4c4074]
xor eax, ebp
mov dword [ebp + 0x90], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov dword [ebp - 0x18], ecx
lea ecx, [ebp - 0x14]
call fcn.0040dbb0
mov dword [ebp - 4], 0
or ebx, 0xffffffff
mov edx, dword [eax]
mov esi, dword [edi]
sub esi, 0x10
lea ecx, [edx - 0x10]
cmp ecx, esi
je 0x464031
cmp dword [esi + 0xc], 0
lea ebx, [esi + 0xc]
jl 0x464023
mov eax, dword [ecx]
cmp eax, dword [esi]
jne 0x464023
call fcn.004025a0
mov dword [ebp - 0x10], eax
or ecx, 0xffffffff
lock xadd dword [ebx], ecx
dec ecx
test ecx, ecx
jg 0x46401c
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x10]
add eax, 0x10
mov dword [edi], eax
jmp 0x46402e
push dword [edx - 0xc]
mov ecx, edi
push edx
call fcn.00407350
or ebx, 0xffffffff
mov dword [ebp - 4], 0xffffffff
mov eax, ebx
mov edx, dword [ebp - 0x14]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x464052
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [edi]
cmp dword [eax - 0xc], 0
jne 0x464061
xor al, al
jmp 0x464140
call fcn.00403d50
mov ecx, eax
test ecx, ecx
je 0x464163
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 3
lea edx, [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
push 0
mov ecx, dword [ecx]
call fcn.0040cb90
mov esi, dword [ebp - 0x10]
add esp, 4
cmp dword [esi - 4], 1
jle 0x4640ab
push dword [esi - 0xc]
lea ecx, [ebp - 0x10]
call fcn.0040d4c0
mov esi, dword [ebp - 0x10]
xor eax, eax
mov byte [ebp + 0x68], 0
mov dword [ebp + 0x10], 0
mov dword [ebp + 0x14], 0
mov dword [ebp], 0x67452301
mov dword [ebp + 4], 0xefcdab89
mov dword [ebp + 8], 0x98badcfe
mov dword [ebp + 0xc], 0x10325476
cmp byte [esi], al
je 0x4640e7
nop
inc eax
cmp byte [eax + esi], 0
jne 0x4640e0
push eax
push esi
lea ecx, [ebp]
call fcn.0040f020
lea ecx, [ebp]
call fcn.0040f0f0
lea ecx, [ebp]
call fcn.0040f0f0
lea eax, [ebp + 0x6c]
push eax
lea ecx, [ebp]
call fcn.0040f1c0
lea eax, [ebp + 0x6c]
mov ecx, edi
push eax
call fcn.0040c520
push 0
push dword [edi]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x46413e
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x90]
xor ecx, ebp
call fcn.0046e38e
lea esp, [ebp + 0x94]
pop ebp
ret
push 0x80004005
call fcn.004024c0
int3