joyce8/EMBER2024-capa huggingface dataset:
Function at 0x462e04
Capabilities:
Encode data using xor

Disassembly:
push 0x6c
mov eax, 0x4dffd3
call fcn.004b5257
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
xor ebx, ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x54], edi
cmp dword [esi + 0x14], ebx
jne 0x462e3e
mov ecx, edi
call fcn.0040c310
mov dword [ebp - 4], ebx
mov dword [ebp - 0x58], 1
mov eax, edi
jmp 0x462f38
cmp eax, ebx
jne 0x462e47
mov eax, str.Experience
push eax
lea ecx, [ebp - 0x78]
call fcn.0040c330
xor edi, edi
inc edi
mov dword [ebp - 4], edi
push eax
lea ecx, [ebp - 0x4c]
call fcn.00460cfd
mov byte [ebp - 4], 0
push ebx
push edi
lea ecx, [ebp - 0x78]
call fcn.0040d2f0
push 0xf
pop ebx
push 0
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x14], ebx
call fcn.0040d1d0
mov dword [ebp - 4], 2
lea eax, [ebp - 0x2c]
push eax
push esi
lea ecx, [ebp - 0x4c]
call fcn.004612b1
push 0
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x30], ebx
call fcn.0040d1d0
mov byte [ebp - 4], 3
mov eax, dword [esi + 0x14]
dec eax
push eax
mov ecx, esi
call fcn.00431b50
movsx ebx, byte [eax]
mov eax, dword [ebp - 0x18]
and dword [ebp - 0x4c], 0
mov dword [ebp - 0x50], eax
test eax, eax
jbe 0x462eeb
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x2c]
call fcn.0043fd28
mov cl, bl
add cl, byte [ebp - 0x4c]
xor cl, byte [eax]
mov byte [ebp - 0x5c], cl
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x48]
push edi
call fcn.00432b50
inc dword [ebp - 0x4c]
mov eax, dword [ebp - 0x4c]
cmp eax, dword [ebp - 0x50]
jb 0x462ebf
mov eax, dword [esi + 0x14]
dec eax
push eax
mov ecx, esi
call fcn.00431b50
mov al, byte [eax]
mov byte [ebp - 0x50], al
push dword [ebp - 0x50]
lea ecx, [ebp - 0x48]
push edi
call fcn.00432b50
mov ecx, dword [ebp - 0x54]
lea eax, [ebp - 0x48]
push eax
call fcn.0040c370
mov dword [ebp - 0x58], edi
mov byte [ebp - 4], 2
push 0
push edi
lea ecx, [ebp - 0x48]
call fcn.0040d2f0
mov byte [ebp - 4], 0
push 0
push edi
lea ecx, [ebp - 0x2c]
call fcn.0040d2f0
mov eax, dword [ebp - 0x54]
call fcn.004b52da
ret
Function at 0x462f3e
Capabilities:
Encode data using xor

Disassembly:
push 0x70
mov eax, 0x4e0029
call fcn.004b5257
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
xor edi, edi
mov dword [ebp - 0x58], edi
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x50], eax
cmp dword [esi + 0x14], edi
jne 0x462f7b
mov ecx, ebx
call fcn.0040c310
mov dword [ebp - 4], edi
mov dword [ebp - 0x58], 1
mov eax, ebx
jmp 0x46305c
push edi
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x14], 0xf
call fcn.0040d1d0
xor ebx, ebx
inc ebx
mov dword [ebp - 4], ebx
mov eax, dword [esi + 0x14]
dec eax
push eax
mov ecx, esi
call fcn.00431b50
movsx eax, byte [eax]
and dword [ebp - 0x4c], 0
mov dword [ebp - 0x60], eax
mov eax, dword [esi + 0x14]
lea edi, [eax - 1]
test edi, edi
jbe 0x462fda
push dword [ebp - 0x4c]
mov ecx, esi
call fcn.00431b50
mov cl, byte [ebp - 0x60]
add cl, byte [ebp - 0x4c]
xor cl, byte [eax]
mov byte [ebp - 0x5c], cl
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x2c]
push ebx
call fcn.00432b50
inc dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], edi
jb 0x462fb1
mov eax, dword [ebp - 0x50]
test eax, eax
jne 0x462fe6
mov eax, str.Experience
push eax
lea ecx, [ebp - 0x7c]
call fcn.0040c330
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x50]
call fcn.00460cfd
mov byte [ebp - 4], bl
xor esi, esi
push esi
push ebx
lea ecx, [ebp - 0x7c]
call fcn.0040d2f0
push esi
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x30], 0xf
call fcn.0040d1d0
mov byte [ebp - 4], 3
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x50]
call fcn.004613b4
mov ecx, dword [ebp - 0x54]
lea eax, [ebp - 0x48]
push eax
call fcn.0040c370
mov dword [ebp - 0x58], ebx
mov byte [ebp - 4], bl
push esi
push ebx
lea ecx, [ebp - 0x48]
call fcn.0040d2f0
mov byte [ebp - 4], 0
push esi
push ebx
lea ecx, [ebp - 0x2c]
call fcn.0040d2f0
mov eax, dword [ebp - 0x54]
call fcn.004b52da
ret
Function at 0x46366e
Capabilities:
Delete registry value

Disassembly:
push 0x80
mov eax, 0x4e01c1
call fcn.004b5257
mov esi, dword [ebp + 8]
cmp dword [esi + 0x14], 0
jne 0x4636f3
xor eax, eax
mov edi, str.software360TotalSecurity
cmp eax, edi
je 0x4636ec
mov ebx, 0x4fc4f8
cmp eax, ebx
je 0x4636ec
mov esi, str.Hash
cmp eax, esi
je 0x4636ec
lea ecx, [ebp - 0x74]
call fcn.004413bb
and dword [ebp - 4], 0
push ebx
push edi
lea eax, [ebp - 0x74]
push str._s_s
push eax
call fcn.00461c09
add esp, 0x10
push esi
push dword [ebp - 0x74]
mov bl, 1
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueA]
test eax, eax
je 0x4636d9
xor bl, bl
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x74]
call fcn.0044209e
mov al, bl
jmp 0x4637d8
xor al, al
jmp 0x4637d8
push 0
lea ecx, [ebp - 0x8c]
call fcn.004a9d93
xor ebx, ebx
inc ebx
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x6c]
call fcn.004a6c0b
mov byte [ebp - 4], 2
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x74], esp
push esi
call fcn.004aae1c
mov byte [ebp - 4], 3
push str.hash
lea ecx, [ebp - 0x8c]
call fcn.004ad7fd
mov byte [ebp - 4], 2
mov ecx, eax
call fcn.004aa542
lea eax, [ebp - 0x8c]
push eax
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x6c]
call fcn.004ad27c
mov byte [ebp - 4], 4
mov esi, str.Hash
push esi
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.00462e04
add esp, 0xc
mov byte [ebp - 4], 5
cmp dword [ebp - 0x14], 0x10
mov eax, dword [ebp - 0x28]
jae 0x46377c
lea eax, [ebp - 0x28]
mov ecx, dword [ebp - 0x18]
push 0x80000002
push str.software360TotalSecurity
inc ecx
push ecx
push eax
push esi
push 0x4fc4f8
call fcn.00462185
add esp, 0x18
mov byte [ebp - 0x6d], al
mov byte [ebp - 4], 4
push 0
push ebx
lea ecx, [ebp - 0x2c]
call fcn.0040d2f0
mov byte [ebp - 4], 2
push 0
push ebx
lea ecx, [ebp - 0x48]
call fcn.0040d2f0
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x6c]
call fcn.00460d6f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8c]
call fcn.004aa4f7
mov al, byte [ebp - 0x6d]
call fcn.004b52da
ret

Function at 0x463ca5
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
cmp dword [ebp + 0x10], esi
je 0x463cfc
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
push edi
mov dword [ebp - 8], eax
lea eax, [ebp + 0x10]
push eax
push esi
lea eax, [ebp - 0xc]
push eax
push 0x463c80
push esi
push esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov edi, eax
cmp edi, esi
je 0x463cf6
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
pop edi
jmp 0x463d06
push esi
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_FindWindowW]
pop esi
leave
ret
Function at 0x4652ce
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0x44
mov eax, 0x4e06a5
call fcn.004b5257
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x50], edi
mov dword [ebp - 0x40], ebx
cmp esi, ebx
jne 0x465302
mov ecx, edi
call fcn.0040c5e0
mov dword [ebp - 4], ebx
mov dword [ebp - 0x40], 1
jmp 0x4653fb
push ebx
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x24], 7
call fcn.0040daa0
xor eax, eax
inc eax
mov dword [ebp - 4], eax
push ebx
push 0x80
push 3
push ebx
push eax
push 0x80000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x48], eax
cmp eax, 0xffffffff
je 0x4653dd
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, ebx
je 0x4653d1
push 0x541444
push esi
call fcn.004b60d0
mov edi, eax
pop ecx
pop ecx
cmp edi, ebx
je 0x4653d1
push esi
push ebx
push edi
call fcn.004b4620
add esp, 0xc
push ebx
lea eax, [ebp - 0x44]
push eax
push esi
push edi
push dword [ebp - 0x48]
mov dword [ebp - 0x44], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4653ca
cmp dword [ebp - 0x44], esi
jne 0x4653ca
push 0x10
lea eax, [ebp - 0x20]
push ebx
push eax
call fcn.004b4620
lea eax, [ebp - 0x20]
push eax
push esi
push edi
call fcn.00466647
add esp, 0x18
test eax, eax
je 0x4653ca
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x20]
call fcn.00461b49
mov byte [ebp - 4], 2
push dword [eax]
lea ecx, [ebp - 0x3c]
call fcn.0040c660
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x4c]
call fcn.0040d610
push edi
call fcn.004b5d21
pop ecx
push dword [ebp - 0x48]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 0x50]
lea eax, [ebp - 0x3c]
push eax
mov ecx, edi
call fcn.0040c600
xor eax, eax
inc eax
mov dword [ebp - 0x40], eax
mov byte [ebp - 4], bl
push ebx
push eax
lea ecx, [ebp - 0x3c]
call fcn.0040d590
mov eax, edi
call fcn.004b52da
ret

Function at 0x465410
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
cmp dword [ebp + 8], 1
push esi
jne 0x465424
mov esi, 0x4fc6c0
jmp 0x46543c
cmp dword [ebp + 8], 3
jne 0x465431
mov esi, str.EnableKP
jmp 0x46543c
cmp dword [ebp + 8], 2
jne 0x46548c
mov esi, 0x4fc698
lea eax, [ebp + 8]
push eax
push 2
push ebx
push str.Software360TotalSecuritydeepscan
push 0x80000002
mov dword [ebp + 8], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x465469
cmp dword [ebp + 8], ebx
jne 0x465469
cmp eax, 2
jne 0x465488
xor ebx, ebx
inc ebx
jmp 0x465488
push esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x46547c
cmp eax, 2
jne 0x46547f
xor ebx, ebx
inc ebx
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x46548e
xor eax, eax
pop esi
pop ebx
pop ebp
ret 4
Function at 0x4654ad
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x5382cc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x4654cc
xor eax, eax
jmp 0x46553a
push esi
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebx
call esi
test eax, eax
jne 0x465539
push edi
mov edi, 0x208
push edi
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.004b4620
push ebx
push str._s.bak
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.00411380
add esp, 0x1c
lea eax, [ebp - 0x20c]
push eax
call esi
lea eax, [ebp - 0x20c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
pop edi
test eax, eax
je 0x465533
push 4
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
jmp 0x465539
push ebx
call fcn.00465494
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.004b46ff
leave
ret 4

Function at 0x4655ce
Capabilities:
Check if file exists
Check os version
Create directory
Get common file path

Disassembly:
push 0x10
mov eax, 0x4e06fb
call fcn.004b51ee
xor edi, edi
mov dword [ebp - 0x18], edi
cmp dword [0x53edfc], edi
jne 0x4655fc
push 0x53edf8
mov dword [0x53edf8], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [0x53edfc]
cmp eax, 6
ja 0x465611
jne 0x465686
cmp dword [0x53ee00], 2
jb 0x465686
lea eax, [ebp - 0x14]
push eax
call fcn.00465549
pop ecx
xor ebx, ebx
inc ebx
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x14]
cmp dword [eax - 0xc], edi
jne 0x465645
mov ecx, dword [ebp + 8]
push 0x50ea0c
call fcn.0044bc85
mov dword [ebp - 0x18], ebx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
jmp 0x465712
mov esi, str.temp_
push esi
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00445250
add esp, 0xc
mov byte [ebp - 4], 2
mov eax, dword [eax]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x1c]
call fcn.0040d610
push esi
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 8]
call fcn.00445250
add esp, 0xc
jmp 0x465636
lea ecx, [ebp - 0x10]
call fcn.0040c7d0
mov dword [ebp - 4], 3
push 0x400
lea ecx, [ebp - 0x10]
call fcn.00444b2e
xor ebx, ebx
inc ebx
push ebx
push 0x23
mov esi, eax
push esi
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x4656c2
push 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push str.360Safe
push esi
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.0040c8c0
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4656ef
push edi
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0x4f8b70
lea ecx, [ebp - 0x10]
call fcn.00444b0f
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.004420c1
mov dword [ebp - 0x18], ebx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.0040d610
mov eax, dword [ebp + 8]
call fcn.004b52c6
ret
Function at 0x465720
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push 0x270
mov eax, 0x4e0737
call fcn.004b5257
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0x14]
mov dword [ebp - 0x274], ecx
test eax, eax
jne 0x465749
xor eax, eax
call fcn.004b52da
ret 0x10
push eax
lea ecx, [ebp - 0x264]
call fcn.0044bc85
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x264]
mov eax, dword [eax - 0xc]
test eax, eax
jne 0x465777
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x264]
call fcn.0040d610
jmp 0x46573f
dec eax
push eax
lea ecx, [ebp - 0x264]
call fcn.0040c870
cmp ax, 0x5c
je 0x465797
push 0x5c
lea ecx, [ebp - 0x264]
call fcn.004452a8
lea eax, [ebp - 0x264]
push eax
lea ecx, [ebp - 0x26c]
call fcn.004420c1
mov byte [ebp - 4], 1
push 0x4fc718
lea ecx, [ebp - 0x26c]
call fcn.00444b0f
lea eax, [ebp - 0x260]
push eax
push dword [ebp - 0x26c]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x270], eax
cmp eax, 0xffffffff
jne 0x4657ef
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x26c]
call fcn.0040d610
jmp 0x465766
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileW]
cmp word [ebp - 0x234], 0x2e
jne 0x465833
cmp word [ebp - 0x232], 0
je 0x46581d
cmp word [ebp - 0x232], 0x2e
jne 0x465833
cmp word [ebp - 0x230], 0
jne 0x465833
lea eax, [ebp - 0x260]
push eax
push dword [ebp - 0x270]
call ebx
mov edi, eax
jmp 0x4658ed
lea eax, [ebp - 0x264]
push eax
lea ecx, [ebp - 0x268]
call fcn.004420c1
mov byte [ebp - 4], 2
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x268]
call fcn.00444b0f
test byte [ebp - 0x260], 0x10
je 0x46587e
mov ecx, dword [ebp - 0x274]
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 0x268]
call fcn.00465720
jmp 0x4658cd
push 0x80
push dword [ebp - 0x268]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test esi, esi
je 0x4658ae
mov ecx, dword [ebp - 0x244]
xor eax, eax
lea edi, [ebp - 0x27c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp - 0x240]
add dword [esi], eax
adc dword [esi + 4], ecx
cmp dword [ebp + 0xc], 0
push dword [ebp - 0x268]
je 0x4658c7
mov ecx, dword [ebp - 0x274]
call fcn.004654ad
jmp 0x4658cd
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x260]
push eax
push dword [ebp - 0x270]
call ebx
mov edi, eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x268]
call fcn.0040d610
test edi, edi
jne 0x4657f5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 0x270]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp esi, 0x12
je 0x465935
xor esi, esi
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x26c]
call fcn.0040d610
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x264]
call fcn.0040d610
mov eax, esi
jmp 0x465741
push dword [ebp - 0x264]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
xor esi, esi
inc esi
jmp 0x465910
Function at 0x46698e
Capabilities:
Check for time delay via gettickcount
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x328
push ebx
push edi
xor ebx, ebx
mov edi, ecx
mov dword [ebp - 0xc], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 4]
push eax
push dword [edi + 4]
mov dword [ebp - 4], 1
call fcn.00466913
pop ecx
pop ecx
cmp dword [ebp - 4], ebx
je 0x466ada
push esi
mov esi, 0x104
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x14]
mov ecx, edi
mov dword [ebp - 8], eax
call fcn.0046670a
test eax, eax
jne 0x466ad9
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 8]
ja 0x466ad9
push esi
lea eax, [ebp - 0x328]
push ebx
push eax
call fcn.004b4620
push esi
lea eax, [ebp - 0x120]
push ebx
push eax
call fcn.004b4620
push esi
lea eax, [ebp - 0x224]
push ebx
push eax
call fcn.004b4620
mov eax, dword [edi + 4]
or dword [ebp - 0x10], 0xffffffff
add esp, 0x24
mov dword [ebp - 0x328], ebx
mov dword [ebp - 0x120], ebx
mov dword [ebp - 0x224], ebx
mov dword [ebp - 8], eax
call fcn.004437ed
mov eax, dword [eax + 0x98]
cmp eax, ebx
je 0x466a6d
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x224]
push ecx
lea ecx, [ebp - 0x120]
push ecx
lea ecx, [ebp - 0x328]
push ecx
push dword [ebp - 8]
call eax
add esp, 0x14
mov eax, dword [ebp - 0x10]
cmp eax, 0xffffffff
jne 0x466a8b
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 4]
push eax
push dword [edi + 4]
call fcn.00466913
jmp 0x466ace
lea ecx, [ebp - 0x1c]
push ecx
lea ecx, [ebp - 0x224]
push ecx
lea ecx, [ebp - 0x120]
push ecx
lea ecx, [ebp - 0x328]
push ecx
inc eax
push eax
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], 0x186a0
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
je 0x466ad0
lea eax, [ebp - 4]
push eax
push dword [edi + 4]
call fcn.00466913
mov dword [ebp - 0xc], 1
pop ecx
pop ecx
cmp dword [ebp - 4], ebx
jne 0x4669cd
pop esi
mov ecx, edi
call fcn.0046670a
test eax, eax
je 0x466ae8
mov dword [ebp - 0xc], ebx
mov eax, dword [ebp - 0xc]
pop edi
pop ebx
leave
ret 4
Function at 0x466cd7
Capabilities:
Check if file exists

Disassembly:
push 0x214
mov eax, 0x4e0899
call fcn.004b5257
call fcn.004437ed
mov ebx, eax
test ebx, ebx
je 0x466dac
and dword [ebp - 0x21c], 0
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.004b4620
add esp, 0xc
mov esi, 0x104
push esi
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0x4f8b74
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x466d86
lea eax, [ebp - 0x220]
push eax
call fcn.00466c52
pop ecx
and dword [ebp - 4], 0
push dword [eax]
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.0040b640
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x220]
call fcn.0040d610
lea eax, [ebp - 0x218]
push eax
mov ecx, ebx
call fcn.0043eab8
test eax, eax
je 0x466da6
xor eax, eax
inc eax
cmp dword [ebx + 0x18], eax
jne 0x466da6
mov dword [ebp - 0x21c], eax
mov eax, dword [ebp - 0x21c]
call fcn.004b52da
ret
Function at 0x468d16
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x18
mov eax, 0x4e0d4c
call fcn.004b51ee
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], 0x60
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], ebx
mov esi, dword [ebp + 8]
cmp dword [ebp + 0x10], ebx
je 0x468d76
call fcn.0046894f
cmp byte [eax + 0xc], bl
je 0x468d76
push ecx
movzx ecx, word [ebp + 0x10]
mov eax, esp
mov dword [ebp + 8], esp
push ecx
mov dword [eax], ecx
mov eax, esp
lea ecx, [ebp - 0x1c]
mov dword [ebp + 0x10], esp
mov dword [eax], esi
call fcn.00467e58
cmp al, 1
jne 0x468d72
mov dword [ebp - 0x14], 0xf0
cmp al, bl
jne 0x468d92
push ecx
movzx ecx, word [ebp + 0xc]
mov eax, esp
mov dword [ebp + 0x10], esp
push ecx
mov dword [eax], ecx
mov eax, esp
lea ecx, [ebp - 0x1c]
mov dword [ebp + 0x10], esp
mov dword [eax], esi
call fcn.00467e58
cmp al, 1
jne 0x468eae
push dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [0x541380]
call esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp + 0x10], eax
cmp eax, ebx
je 0x468eae
push dword [ebp - 0x18]
push dword [0x541380]
call esi
push dword [ebp - 0x1c]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push eax
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push eax
call fcn.004b4a20
add esp, 0xc
mov dword [ebp + 8], ebx
mov byte [ebp - 4], 2
lea eax, [ebp + 8]
push eax
push ebx
push dword [ebp + 0x10]
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jl 0x468e91
push ebx
push dword [ebp + 8]
call fcn.00468033
mov esi, eax
pop ecx
pop ecx
cmp esi, ebx
je 0x468e91
mov ecx, esi
call fcn.00467ee4
mov ecx, esi
mov dword [ebp - 0x24], eax
call fcn.00467f09
push ebx
mov dword [ebp - 0x20], eax
movzx eax, word [edi + 0x18]
push ebx
push ebx
push eax
push dword [ebp - 0x14]
lea eax, [ebp - 0x24]
push eax
call fcn.0046894f
mov ecx, eax
call fcn.0046808c
test al, al
je 0x468e6c
push ebx
push 1
push ebx
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push esi
call fcn.0046e0db
mov edi, eax
add esp, 0x18
cmp edi, ebx
je 0x468e6c
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
mov esi, edi
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp + 0xc]
push eax
mov ecx, esi
mov dword [ebp + 0xc], ebx
call fcn.00468069
test eax, eax
je 0x468e85
mov dword [ebp - 0x10], ebx
cmp esi, ebx
je 0x468e91
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov byte [ebp - 4], bl
lea ecx, [ebp + 8]
call fcn.00486aaf
mov esi, dword [ebp - 0x10]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.00467e9a
mov eax, esi
call fcn.004b52c6
ret 0xc