joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43cec0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x14], ecx
movzx eax, word [ebp + 8]
push eax
mov ecx, dword [ebp - 0x14]
add ecx, 0xe8
call fcn.00442700
movzx ecx, al
test ecx, ecx
jne 0x43ceea
xor al, al
jmp 0x43d07e
mov ecx, dword [ebp - 0x14]
add ecx, 0x78
call fcn.004409b0
cmp eax, 1
jne 0x43cf01
xor al, al
jmp 0x43d07e
mov edx, dword [ebp - 0x14]
movsx eax, byte [edx + 0xe4]
test eax, eax
je 0x43cf16
xor al, al
jmp 0x43d07e
mov ecx, dword [ebp - 0x14]
add ecx, 0x20
call fcn.00441b40
movzx ecx, word [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x14]
add ecx, 0xe8
call fcn.00442730
mov ecx, dword [ebp - 0x14]
call fcn.0043d150
mov ecx, eax
call fcn.00445030
movzx edx, al
test edx, edx
je 0x43cf83
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x10]
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], 0
jne 0x43cf60
xor al, al
jmp 0x43d07e
mov ecx, dword [ebp - 0x14]
call fcn.0043f5f0
mov ecx, dword [ebp - 0x14]
call fcn.0043f6e0
movzx edx, al
test edx, edx
jne 0x43cf81
push 0xffffffffffffff94
mov ecx, dword [ebp - 0x14]
call fcn.0043cbd0
jmp 0x43cf8c
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x10]
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x14]
call fcn.0043d150
mov dx, word [eax + 0xe]
mov word [ebp - 4], dx
movzx eax, word [ebp - 4]
test eax, eax
je 0x43cfb7
movzx ecx, word [ebp - 4]
cmp ecx, 8
je 0x43cfb7
push 0xffffffffffffff9b
mov ecx, dword [ebp - 0x14]
call fcn.0043cbd0
movzx edx, word [ebp - 4]
cmp edx, 8
jne 0x43d00d
mov eax, dword [ebp - 0x14]
movzx ecx, byte [eax + 4]
test ecx, ecx
je 0x43cfd9
mov edx, dword [ebp - 0x14]
add edx, 0xc8
mov dword [ebp - 0x18], edx
jmp 0x43cfe0
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
mov dword [eax + 0x50], ecx
push 0x38
push 0x499200
push 0xfffffffffffffff1
mov edx, dword [ebp - 0x14]
add edx, 0x28
push edx
call fcn.00482930
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x14]
call fcn.0043d120
mov ecx, dword [ebp - 0x14]
call fcn.0043d150
mov ecx, dword [ebp - 0x14]
mov edx, dword [eax + 0x18]
mov dword [ecx + 0x64], edx
mov ecx, dword [ebp - 0x14]
call fcn.0043d150
mov ecx, eax
call fcn.00445030
movzx eax, al
test eax, eax
je 0x43d043
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0x64]
sub edx, 0xc
mov eax, dword [ebp - 0x14]
mov dword [eax + 0x64], edx
mov ecx, dword [ebp - 0x14]
call fcn.0043d150
mov ecx, dword [ebp - 0x14]
mov edx, dword [eax + 0x1c]
mov dword [ecx + 0x60], edx
mov eax, dword [ebp - 0x14]
mov dword [eax + 0x68], 0
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x3c], 0
mov edx, dword [ebp - 0x14]
mov dword [edx + 0x2c], 0
mov eax, dword [ebp - 0x14]
mov byte [eax + 0xe4], 0xff
mov al, 1
mov esp, ebp
pop ebp
ret 4
Function at 0x43d580
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48c5d0
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x270
mov eax, dword [0x4bcb20]
xor eax, ebp
mov dword [ebp - 0x18], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x274], ecx
mov eax, dword [ebp - 0x274]
movsx ecx, byte [eax + 0xe4]
cmp ecx, 0xffffffff
je 0x43d5d1
xor eax, eax
jmp 0x43d7ff
mov dword [ebp - 0x14], 1
movzx edx, byte [ebp + 0xc]
test edx, edx
jne 0x43d7b4
mov eax, dword [ebp - 0x274]
cmp dword [eax + 0x60], 0
jne 0x43d618
mov ecx, dword [ebp - 0x274]
call fcn.0043d150
mov ecx, dword [ebp - 0x274]
mov edx, dword [ecx + 0x68]
cmp edx, dword [eax + 0x14]
je 0x43d616
push 0xffffffffffffff9a
mov ecx, dword [ebp - 0x274]
call fcn.0043cbd0
jmp 0x43d61f
mov dword [ebp - 0x14], 0xffffffff
mov ecx, dword [ebp - 0x274]
call fcn.0043d150
movzx eax, word [eax + 0xe]
cmp eax, 8
jne 0x43d642
mov ecx, dword [ebp - 0x274]
add ecx, 0x28
push ecx
call fcn.004828e0
cmp dword [ebp + 8], 0
je 0x43d7b4
mov dword [ebp - 4], 0
mov dword [ebp - 0x248], 0
mov dword [ebp - 0x244], 0
lea edx, [ebp - 0x240]
mov dword [ebp - 0x264], edx
mov eax, dword [ebp - 0x264]
mov dword [eax], 0
mov dword [eax + 4], 0
lea ecx, [ebp - 0x238]
mov dword [ebp - 0x268], ecx
mov edx, dword [ebp - 0x268]
mov dword [edx], 0
mov dword [edx + 4], 0
push 0
call fcn.0046ac78
add esp, 4
mov dword [ebp - 0x270], eax
mov dword [ebp - 0x26c], edx
mov eax, dword [ebp - 0x270]
mov dword [ebp - 0x254], eax
mov ecx, dword [ebp - 0x26c]
mov dword [ebp - 0x250], ecx
mov edx, dword [ebp - 0x254]
mov eax, dword [ebp - 0x250]
mov dword [ebp - 0x238], edx
mov dword [ebp - 0x234], eax
mov ecx, dword [ebp - 0x238]
mov dword [ebp - 0x248], ecx
mov edx, dword [ebp - 0x234]
mov dword [ebp - 0x244], edx
mov byte [ebp - 0x228], 0
mov ecx, dword [ebp - 0x274]
call fcn.0043d150
mov dword [ebp - 0x278], eax
lea eax, [ebp - 0x25c]
push eax
mov ecx, dword [ebp - 0x278]
call fcn.00444540
mov dword [ebp - 0x27c], eax
mov ecx, dword [ebp - 0x27c]
mov edx, dword [ecx]
mov eax, dword [ecx + 4]
mov dword [ebp - 0x240], edx
mov dword [ebp - 0x23c], eax
lea ecx, [ebp - 0x248]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004466b3
mov ecx, dword [ebp - 0x274]
call fcn.0043d150
mov dword [ebp - 0x280], eax
mov eax, dword [ebp - 0x280]
mov ecx, dword [eax + 0x24]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x43d78a
mov dword [ebp - 0x14], 0xfffffffe
jmp 0x43d7b4
mov dword [ebp - 4], 0xffffffff
jmp 0x43d7c5
mov ecx, dword [ebp - 0x274]
add ecx, 0xe8
call fcn.00442860
mov eax, dword [ebp - 0x274]
mov byte [eax + 0xe4], 0
mov ecx, dword [ebp - 0x274]
add ecx, 0x6c
call fcn.00441c20
mov ecx, dword [ebp - 0x274]
call fcn.0043fc50
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.00469030
mov esp, ebp
pop ebp
ret 8
Function at 0x43e110
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48c729
mov eax, dword fs:[0]
push eax
sub esp, 0x78
mov eax, dword [0x4bcb20]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x28], 0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x10]
call fcn.0041afa0
mov dword [ebp - 4], 0
push 0x4a1380
lea ecx, [ebp - 0x10]
call fcn.00422270
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x44], ecx
mov edx, dword [ebp - 0x44]
push edx
lea eax, [ebp - 0x18]
push eax
call fcn.0043dd40
add esp, 8
mov dword [ebp - 0x7c], eax
mov ecx, dword [ebp - 0x7c]
mov dword [ebp - 0x4c], ecx
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x28]
or edx, 1
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x48]
push ecx
mov ecx, dword [ebp - 0x4c]
call fcn.00419ec0
neg eax
sbb eax, eax
add eax, 1
movzx edx, al
test edx, edx
jne 0x43e1c8
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x50], eax
mov ecx, dword [ebp - 0x50]
push ecx
call fcn.0043e2e0
add esp, 4
cmp eax, 0xffffffff
je 0x43e1c8
mov dword [ebp - 0x80], 0
jmp 0x43e1cf
mov dword [ebp - 0x80], 1
mov dl, byte [ebp - 0x80]
mov byte [ebp - 0x11], dl
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x28]
and eax, 1
je 0x43e1f0
and dword [ebp - 0x28], 0xfffffffe
lea ecx, [ebp - 0x18]
call fcn.004204e0
movzx ecx, byte [ebp - 0x11]
test ecx, ecx
je 0x43e213
mov byte [ebp - 0x19], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.004204e0
mov al, byte [ebp - 0x19]
jmp 0x43e2cd
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x5c], edx
mov eax, dword [ebp - 0x5c]
push eax
lea ecx, [ebp - 0x20]
push ecx
call fcn.0043dd40
add esp, 8
mov dword [ebp - 0x84], eax
mov edx, dword [ebp - 0x84]
mov dword [ebp - 0x60], edx
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x60]
mov ecx, dword [eax]
mov dword [ebp - 0x64], ecx
mov edx, dword [ebp - 0x64]
push edx
call fcn.0043e110
add esp, 4
movzx eax, al
neg eax
sbb eax, eax
add eax, 1
mov byte [ebp - 0x1a], al
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x20]
call fcn.004204e0
movzx ecx, byte [ebp - 0x1a]
test ecx, ecx
je 0x43e289
mov byte [ebp - 0x21], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.004204e0
mov al, byte [ebp - 0x21]
jmp 0x43e2cd
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x70], edx
push 0
mov eax, dword [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x43e2b7
mov byte [ebp - 0x22], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.004204e0
mov al, byte [ebp - 0x22]
jmp 0x43e2cd
mov byte [ebp - 0x23], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.004204e0
mov al, byte [ebp - 0x23]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x43f040
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 8]
push ecx
call fcn.0043f090
add esp, 8
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
xor edx, edx
cmp eax, 2
sete dl
mov byte [ebp - 1], dl
lea ecx, [ebp - 8]
call fcn.004204e0
mov al, byte [ebp - 1]
mov esp, ebp
pop ebp
ret
Function at 0x441630
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48cc48
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x4bcb20]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x4c], ecx
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x4c]
mov edx, dword [ecx + 0x1c]
mov eax, dword [ebp - 0x4c]
mov ecx, dword [eax + 0x1c]
mov edx, dword [edx]
mov eax, dword [edx + 0x18]
call eax
mov dword [ebp - 0x50], eax
mov ecx, dword [ebp - 0x50]
mov dword [ebp - 0x34], ecx
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x34]
mov eax, dword [edx]
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x38]
push ecx
lea edx, [ebp - 0x30]
push edx
call fcn.0043f090
add esp, 8
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov ecx, dword [eax]
mov dword [ebp - 0x40], ecx
lea edx, [ebp - 0x20]
push edx
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x24]
push edx
mov eax, dword [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
neg eax
sbb eax, eax
add eax, 1
mov byte [ebp - 0x25], al
lea ecx, [ebp - 0x30]
call fcn.004204e0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.004204e0
movzx ecx, byte [ebp - 0x25]
test ecx, ecx
je 0x4416e9
xor eax, eax
jmp 0x4416ff
mov edx, dword [ebp - 0x24]
imul edx, dword [ebp - 0x14]
imul edx, dword [ebp - 0x10]
xor eax, eax
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x4466b3
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
push dword [ebp + 8]
xor esi, esi
mov dword [ebp - 8], esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x4466e5
push dword [ebp + 8]
call edi
push eax
call fcn.00457d44
mov ebx, dword [ebp + 0xc]
movzx eax, byte [ebx + 0x20]
cmp eax, dword [ebp - 4]
je 0x446710
test byte [ebp - 4], 1
je 0x446710
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x446710
push dword [ebp + 8]
call edi
push eax
call fcn.00457d44
lea eax, [ebx + 8]
mov ecx, dword [eax]
or ecx, dword [eax + 4]
je 0x4467ca
lea ecx, [ebp - 0x20]
push ecx
push eax
call fcn.00446615
pop ecx
lea eax, [ebx + 0x10]
pop ecx
mov ecx, dword [eax]
or ecx, dword [eax + 4]
je 0x446746
lea ecx, [ebp - 0x10]
push ecx
push eax
call fcn.00446615
pop ecx
lea eax, [ebp - 0x10]
pop ecx
mov dword [ebp - 8], eax
mov eax, dword [ebx]
or eax, dword [ebx + 4]
je 0x44675c
lea eax, [ebp - 0x18]
push eax
push ebx
call fcn.00446615
pop ecx
pop ecx
lea esi, [ebp - 0x18]
push 0
push 0x80
push 3
push 0
push 1
push 0xc0000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x446789
push dword [ebp + 8]
call edi
push eax
call fcn.00457d44
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 8]
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileTime]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x4467b5
call edi
push ebx
mov dword [ebp - 8], eax
call esi
push dword [ebp + 8]
push dword [ebp - 8]
call fcn.00457d44
push ebx
call esi
test eax, eax
jne 0x4467c7
push dword [ebp + 8]
call edi
push eax
call fcn.00457d44
mov ebx, dword [ebp + 0xc]
movzx eax, byte [ebx + 0x20]
cmp eax, dword [ebp - 4]
je 0x4467f2
test byte [ebp - 4], 1
jne 0x4467f2
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x4467f2
push dword [ebp + 8]
call edi
push eax
call fcn.00457d44
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x44c665
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x44c6ac
call fcn.00450ae2
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x44c6ac
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x44c6c8
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.0044c1dd
mov esi, eax
test edi, edi
je 0x44c6c6
test ebx, ebx
je 0x44c6c6
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x44de04
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x48d3f4
call fcn.0046e3c1
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x44de29
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x44de6f
lea ecx, [ebp - 0x10]
call fcn.0041a240
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004457b2
add esp, 0x10
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.004199e0
mov eax, esi
call fcn.0046e499
ret 8

Function at 0x44ffaf
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x58], ebx
test ebx, 0xffff0000
jne 0x44ffd3
cmp dword [edi + 0x54], 0
jne 0x44ffd3
movzx eax, bx
mov dword [edi + 0x54], eax
call fcn.00450ae2
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.0044ff70
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x4548a3
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x274
mov eax, dword [0x4bcb20]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0x800
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0x234], eax
mov esi, ecx
lea eax, [ebp - 0xc]
jne 0x45493b
push 0x49b764
push 4
push eax
call fcn.0046e225
push eax
call fcn.00419880
add esp, 0x10
push ebx
push edi
call fcn.0046e50d
mov edi, dword [eax]
call fcn.0046e50d
xor ebx, ebx
mov dword [eax], ebx
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x234]
lea eax, [ebp - 0x230]
push esi
push 0x111
mov esi, 0x112
push esi
push eax
call fcn.0046b3f1
add esp, 0x18
mov dword [ebp - 0x234], eax
call fcn.0046e50d
cmp dword [eax], ebx
je 0x454952
call fcn.0046e50d
push dword [eax]
call fcn.00446af3
pop ecx
jmp 0x454959
push 4
push eax
push 3
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x4548e6
jmp 0x4549e0
call fcn.0046e50d
mov dword [eax], edi
cmp dword [ebp - 0x234], 0xffffffff
je 0x4549dc
cmp dword [ebp - 0x234], esi
jae 0x4549dc
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push 0x3c
mov esi, eax
lea eax, [ebp - 0x270]
push ebx
push eax
mov dword [ebp - 0x274], 0x40
call fcn.004683b0
add esp, 0xc
push 0x49aa9c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp eax, ebx
je 0x4549cb
push str.FindActCtxSectionStringW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x4549cb
lea ecx, [ebp - 0x274]
push ecx
push esi
push 2
push ebx
push ebx
call eax
test eax, eax
je 0x4549cb
push ebx
push ebx
push esi
jmp 0x4549d4
push ebx
push ebx
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
jmp 0x4549de
xor eax, eax
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00469030
leave
ret

Function at 0x455b16
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
cmp dword [ebp + 0xc], ebx
je 0x455b5e
call fcn.00450ae2
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x455b5e
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
test eax, eax
je 0x455ba1
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
test ebx, ebx
je 0x455b8a
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x455b8a
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x455b9e
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x465d62
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x4bcb20]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x105
push esi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x465d97
xor eax, eax
jmp 0x465dea
lea eax, [ebp - 0x210]
push eax
call fcn.0046c7e2
cmp word [ebp + eax*2 - 0x212], 0x5c
pop ecx
je 0x465dc8
push 0x4a1380
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.0046c1f8
add esp, 0xc
test eax, eax
jne 0x465d93
push edi
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.0046c1f8
add esp, 0xc
test eax, eax
jne 0x465d93
lea eax, [ebp - 0x210]
push eax
call fcn.0044585d
pop ecx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00469030
leave
ret

Function at 0x469030
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4bcb20]
jne 0x46903a
repz ret
jmp fcn.00473d6c

Function at 0x47a56b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0046fc69
and dword [ebp - 4], 0
cmp dword [0x4c5f6c], 0
mov ebx, eax
jne 0x47a61c
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x47a6cd
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x47a6cd
push eax
call fcn.0046fbf7
mov dword [esp], 0x49e1b0
push edi
mov dword [0x4c5f6c], eax
call esi
push eax
call fcn.0046fbf7
mov dword [esp], 0x49e19c
push edi
mov dword [0x4c5f70], eax
call esi
push eax
call fcn.0046fbf7
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4c5f74], eax
call esi
push eax
call fcn.0046fbf7
pop ecx
mov dword [0x4c5f7c], eax
test eax, eax
je 0x47a61c
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0046fbf7
pop ecx
mov dword [0x4c5f78], eax
mov eax, dword [0x4c5f78]
cmp eax, ebx
je 0x47a674
cmp dword [0x4c5f7c], ebx
je 0x47a674
push eax
call fcn.0046fc72
push dword [0x4c5f7c]
mov esi, eax
call fcn.0046fc72
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x47a674
test edi, edi
je 0x47a674
call esi
test eax, eax
je 0x47a66b
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x47a66b
test byte [ebp - 0xc], 1
jne 0x47a674
or dword [ebp + 0x10], 0x200000
jmp 0x47a6ad
mov eax, dword [0x4c5f70]
cmp eax, ebx
je 0x47a6ad
push eax
call fcn.0046fc72
pop ecx
test eax, eax
je 0x47a6ad
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x47a6ad
mov eax, dword [0x4c5f74]
cmp eax, ebx
je 0x47a6ad
push eax
call fcn.0046fc72
pop ecx
test eax, eax
je 0x47a6ad
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4c5f6c]
call fcn.0046fc72
pop ecx
test eax, eax
je 0x47a6cd
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x47a6cf
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x482f30
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
jne 0x482f3f
xor eax, eax
pop esi
ret 0xc
mov eax, dword [0x4be00c]
test eax, eax
je 0x482f4d
call fcn.00482ed0
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
cmp edx, 8
push ebx
not eax
jb 0x48304f
push edi
mov edi, edx
shr edi, 3
mov ecx, eax
xor ebx, ebx
mov bl, byte [esi]
and ecx, 0xff
xor ecx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [ecx*4 + 0x4c5fd0]
sub edx, 8
xor eax, ebx
inc esi
mov ecx, eax
xor ebx, ebx
mov bl, byte [esi]
and ecx, 0xff
xor ecx, ebx
xor ebx, ebx
mov bl, byte [esi + 1]
mov ecx, dword [ecx*4 + 0x4c5fd0]
shr eax, 8
xor ecx, eax
inc esi
mov eax, ecx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [esi + 1]
mov eax, dword [eax*4 + 0x4c5fd0]
shr ecx, 8
xor eax, ecx
inc esi
mov ecx, eax
and ecx, 0xff
xor ecx, ebx
xor ebx, ebx
mov bl, byte [esi + 1]
mov ecx, dword [ecx*4 + 0x4c5fd0]
shr eax, 8
xor ecx, eax
inc esi
mov eax, ecx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [esi + 1]
mov eax, dword [eax*4 + 0x4c5fd0]
shr ecx, 8
xor eax, ecx
inc esi
mov ecx, eax
and ecx, 0xff
xor ecx, ebx
xor ebx, ebx
mov bl, byte [esi + 1]
mov ecx, dword [ecx*4 + 0x4c5fd0]
shr eax, 8
xor ecx, eax
inc esi
mov eax, ecx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [esi + 1]
mov eax, dword [eax*4 + 0x4c5fd0]
shr ecx, 8
xor eax, ecx
inc esi
mov ecx, eax
and ecx, 0xff
xor ecx, ebx
shr eax, 8
mov ecx, dword [ecx*4 + 0x4c5fd0]
xor eax, ecx
inc esi
dec edi
jne 0x482f67
pop edi
test edx, edx
je 0x483071
mov ecx, eax
xor ebx, ebx
mov bl, byte [esi]
and ecx, 0xff
xor ecx, ebx
shr eax, 8
mov ecx, dword [ecx*4 + 0x4c5fd0]
xor eax, ecx
inc esi
dec edx
jne 0x483053
pop ebx
pop esi
not eax
ret 0xc