joyce8/EMBER2024-capa huggingface dataset:
Function at 0x457ea0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, eax
xor eax, eax
push ebp
push 0x45807e
push dword fs:[eax]
mov dword fs:[eax], esp
cmp edx, 4
jb 0x458040
mov ebx, dword [esi + 0x20]
cmp byte [ebx], 2
jne 0x458040
movzx eax, word [ebx + 2]
movzx ecx, ax
add ecx, 4
cmp edx, ecx
jne 0x458040
movzx edx, byte [ebx + 1]
sub dl, 1
jb 0x457ef8
sub dl, 4
jb 0x457f5a
jmp 0x458040
movzx eax, ax
cmp eax, 0x14
jne 0x458040
mov eax, dword [esi + 0x24]
push esi
lea edi, [esi + 0x70]
mov esi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
mov dl, 1
mov eax, dword [0x457630]
call fcn.00405568
mov edx, eax
test edx, edx
je 0x457f28
sub edx, 0xfffffff4
lea eax, [ebp - 4]
call fcn.0040a2d0
lea eax, [esi + 0x70]
push eax
mov eax, dword [ebp - 4]
push eax
push 0
push 0
push 0
xor ecx, ecx
mov dl, 1
mov eax, dword [0x457934]
call fcn.00458350
mov edx, eax
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 4]
jmp 0x458040
mov edx, dword [esi + 0x64]
mov dword [ebp - 8], edx
movzx edi, ax
add edi, dword [ebp - 8]
mov eax, dword [esi + 0x5c]
test eax, eax
je 0x457f72
sub eax, 4
mov eax, dword [eax]
cmp edi, eax
jle 0x457f8d
lea eax, [esi + 0x5c]
xor ecx, ecx
mov edx, edi
call fcn.004075ac
lea eax, [esi + 0x5c]
call fcn.004071b8
mov dword [esi + 0x60], eax
mov dword [esi + 0x64], edi
movzx eax, word [ebx + 2]
test ax, ax
jbe 0x457fac
mov edx, dword [esi + 0x60]
mov ecx, dword [ebp - 8]
add edx, ecx
movzx ecx, ax
mov eax, dword [esi + 0x24]
call fcn.00404f38
movzx eax, byte [ebx + 1]
cmp al, 2
je 0x457fbc
cmp al, 4
jne 0x458040
cmp al, 2
jne 0x457fc4
mov bl, 3
jmp 0x457fc6
mov bl, 2
cmp dword [esi + 0x64], 0
jle 0x457ff9
mov eax, dword [esi + 0x64]
push eax
lea eax, [esi + 0x5c]
call fcn.004071b8
mov ecx, eax
mov dl, 1
mov eax, dword [0x457880]
call fcn.00458530
mov edx, eax
test edx, edx
je 0x457fef
sub edx, 0xffffffe8
lea eax, [ebp - 4]
call fcn.0040a2d0
jmp 0x458016
mov dl, 1
mov eax, dword [0x457630]
call fcn.00405568
mov edx, eax
test edx, edx
je 0x45800e
sub edx, 0xfffffff4
lea eax, [ebp - 4]
call fcn.0040a2d0
lea eax, [esi + 0x70]
push eax
mov eax, dword [ebp - 4]
push eax
push 0
push 0
push 0
mov ecx, ebx
mov dl, 1
mov eax, dword [0x457934]
call fcn.00458350
xor edx, edx
mov dword [esi + 0x64], edx
mov edx, eax
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 4]
push fcn.00457ba0
lea eax, [esi + 0x2c]
push eax
mov eax, dword [esi + 0x28]
push eax
mov eax, dword [esi + 0x20]
push eax
mov eax, dword [esi + 0x6c]
push eax
call sub.KERNEL32.DLL_ReadFileEx
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
je 0x458068
mov byte [esi + 4], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x458085
lea eax, [ebp - 4]
call fcn.0040a2b8
ret
Function at 0x45c0b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 4
push 0
push 0
dec ecx
jne 0x45c0b9
push ecx
xchg dword [ebp - 4], ecx
push ebx
test dl, dl
je 0x45c0d1
add esp, 0xfffffff0
call fcn.00405874
mov dword [ebp - 0xc], ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45c227
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
mov dword [eax + 4], edx
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00405568
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.0045c250
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
add eax, 8
call fcn.00406fd8
mov eax, dword [ebp - 4]
call fcn.0045c420
mov edx, dword [ebp - 4]
mov byte [edx + 0xc], al
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.0045c670
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
add eax, 0x10
call fcn.00406fd8
mov eax, dword [ebp - 4]
call fcn.0045c6e0
mov edx, dword [ebp - 4]
mov dword [edx + 0x14], eax
mov eax, dword [ebp - 4]
call fcn.0045c760
mov edx, dword [ebp - 4]
mov dword [edx + 0x18], eax
mov eax, dword [ebp - 4]
call fcn.0045c8e0
mov edx, dword [ebp - 4]
mov dword [edx + 0x1c], eax
mov eax, dword [ebp - 4]
call fcn.0045c9d0
mov edx, dword [ebp - 4]
mov byte [edx + 0x20], al
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.0045ca40
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
add eax, 0x24
call fcn.00406fd8
mov eax, dword [ebp - 4]
call fcn.0045cab0
mov edx, dword [ebp - 4]
mov byte [edx + 0x28], al
mov eax, dword [ebp - 4]
call fcn.0045cb30
mov edx, dword [ebp - 4]
mov byte [edx + 0x29], al
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.0045cbb0
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
add eax, 0x2c
call fcn.00406fd8
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 4]
call fcn.0045cc30
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 4]
add eax, 0x30
call fcn.00406fd8
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 4]
call fcn.0045ccb0
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 4]
add eax, 0x34
call fcn.00406fd8
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 4]
call fcn.0045cd20
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.00406fd8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45c22e
lea eax, [ebp - 0x28]
mov edx, 7
call fcn.00406ca4
ret
Function at 0x45efd0
Capabilities:
Read file on windows
Read pipe

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbf4
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x45f0ce
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
call fcn.00406c68
push 0
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
call sub.KERNEL32.DLL_PeekNamedPipe
test eax, eax
je 0x45f0a4
cmp dword [ebp - 8], 0
jbe 0x45f0a4
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0x40c]
mov edx, 0x400
call fcn.00423e10
push 0
lea eax, [ebp - 8]
push eax
push 0x400
lea eax, [ebp - 0x40c]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
call sub.KERNEL32.DLL_ReadFile
cmp dword [ebp - 8], 0
jbe 0x45f097
mov eax, dword [ebp - 0xc]
call fcn.004070f4
inc eax
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
call fcn.004070f4
mov edx, eax
add edx, dword [ebp - 8]
lea eax, [ebp - 0xc]
xor ecx, ecx
call fcn.004075ac
lea eax, [ebp - 0xc]
call fcn.004071b8
mov edx, dword [ebp - 4]
lea edx, [eax + edx - 1]
lea eax, [ebp - 0x40c]
mov ecx, dword [ebp - 8]
call fcn.00404f38
cmp dword [ebp - 8], 0x400
jae 0x45eff4
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 0xc]
call fcn.004072c4
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45f0d5
lea eax, [ebp - 0xc]
call fcn.00406c68
ret
Function at 0x45f710
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45f7e3
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
call fcn.0045f610
push 1
call sub.KERNEL32.DLL_SetErrorMode
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x45f7be
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1c]
call fcn.00406c44
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1c]
mov edx, 0x105
call fcn.00407880
push 0
push 0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 0x1c]
call fcn.004070e8
push eax
mov eax, dword [ebp - 0x1c]
call fcn.00407780
push eax
mov eax, dword [ebp - 0xc]
call fcn.00407780
push eax
call sub.KERNEL32.DLL_GetVolumeInformationW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45f7c5
mov eax, dword [ebp - 0x10]
push eax
call sub.KERNEL32.DLL_SetErrorMode
ret

Function at 0x460670
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdbc
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], edx
mov byte [ebp - 1], al
xor eax, eax
push ebp
push 0x4607e0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.00406c44
push 0
push 2
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x4607ca
xor eax, eax
push ebp
push 0x4607c3
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x244]
mov edx, 0x22c
call fcn.00423e10
mov dword [ebp - 0x244], 0x22c
lea eax, [ebp - 0x244]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_Process32FirstW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0xd], al
mov byte [ebp - 0x15], 0
jmp 0x4607a2
lea eax, [ebp - 0x14]
lea edx, [ebp - 0x220]
mov ecx, 0x104
call fcn.00407814
cmp byte [ebp - 1], 0
je 0x46076f
cmp byte [ebp - 0x15], 0
jne 0x46076f
xor ecx, ecx
mov edx, dword [ebp - 0x14]
mov eax, 0x4607f8
call fcn.00424850
test al, al
je 0x46076f
xor ecx, ecx
mov edx, dword [ebp - 0x14]
mov eax, 0x46080c
call fcn.004249d0
test al, al
je 0x46076f
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0x14]
push eax
call fcn.0045e9b0
mov ecx, 0x47692c
mov edx, 0x35a
call fcn.00455870
mov byte [ebp - 0x15], 1
mov eax, dword [ebp - 8]
push dword [eax]
push dword [ebp - 0x14]
push 0x460824
mov eax, dword [ebp - 8]
mov edx, 3
call fcn.004079e0
lea eax, [ebp - 0x244]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_Process32NextW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
jne 0x4606fa
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4607ca
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_CloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4607e7
lea eax, [ebp - 0x14]
call fcn.00406c44
ret
Function at 0x460a40
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x460b94
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 4]
call fcn.00407020
mov eax, dword [ebp - 0x18]
call fcn.004070e8
test eax, eax
jle 0x460aae
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 1
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x1c]
cmp word [eax + edx*2 - 2], 0x40
jne 0x460aa6
lea eax, [ebp - 0x18]
call fcn.004071b0
mov edx, dword [ebp - 0x1c]
mov word [eax + edx*2 - 2], 0x2e
inc dword [ebp - 0x1c]
dec dword [ebp - 0x20]
jne 0x460a86
mov eax, dword [ebp - 0x18]
push eax
push 0xa
mov ecx, dword [0x473620]
mov dl, 1
mov eax, dword [0x422f1c]
call fcn.00428230
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x460b72
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
mov ecx, dword [ebp - 4]
mov edx, dword [0x476954]
call fcn.00407958
mov eax, dword [ebp - 0x10]
call fcn.00426eb0
test al, al
je 0x460b51
cmp byte [ebp - 5], 0
jne 0x460b19
xor edx, edx
mov eax, dword [ebp - 0x10]
call fcn.00425e10
cmp edx, 0
jne 0x460b10
cmp eax, 0
jbe 0x460b19
jmp 0x460b12
jle 0x460b19
call fcn.00406434
jmp 0x460b79
mov eax, dword [ebp - 0x10]
call fcn.00426f60
test al, al
jne 0x460b51
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 0x10]
call fcn.00460970
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
call fcn.00426f30
test al, al
je 0x460b51
push 4
push 0
mov eax, dword [ebp - 0x14]
call fcn.00407780
push eax
call sub.KERNEL32.DLL_MoveFileExW
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.00460830
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x460b79
mov eax, dword [ebp - 0xc]
call fcn.00405598
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x460b9b
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00406ca4
ret
Function at 0x463240
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00463190
pop ecx
test al, al
je 0x463263
mov byte [ebp - 5], 1
jmp 0x46332b
mov eax, dword [ebp - 4]
call fcn.00425e50
mov byte [ebp - 5], 0
mov dl, byte [0x463334]
mov eax, dword [ebp - 4]
call fcn.004244d0
test al, al
jne 0x46332b
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004520a0
mov eax, dword [ebp - 4]
call fcn.00407780
push eax
call sub.KERNEL32.DLL_GetFileAttributesW
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x4632c7
test byte [ebp - 0xc], 1
je 0x4632c7
mov eax, dword [ebp - 0xc]
and eax, 0xfffffffe
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
call fcn.00407780
push eax
call sub.KERNEL32.DLL_SetFileAttributesW
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00463190
pop ecx
test al, al
je 0x4632de
mov byte [ebp - 5], 1
jmp 0x46332b
mov eax, dword [ebp - 4]
call fcn.00425e50
mov dl, byte [0x463334]
mov eax, dword [ebp - 4]
call fcn.004244d0
test al, al
jne 0x46332b
xor edx, edx
mov al, 3
call fcn.00426280
test al, al
je 0x46332b
call fcn.004518b0
test al, al
je 0x46332b
call fcn.00451810
test al, al
jne 0x46332b
call fcn.00462da0
test al, al
je 0x46332b
mov eax, dword [ebp + 8]
mov byte [eax - 1], 0
mov byte [ebp - 5], 1
mov al, byte [ebp - 5]
mov esp, ebp
pop ebp
ret
Function at 0x401000
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x5adf10]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
push 0x103
lea eax, [ebp - 0x10f]
push 0
push eax
mov byte [ebp - 0x110], 0
call fcn.005344b0
add esp, 0xc
lea ecx, [ebp - 0x110]
call fcn.004178d0
lea ecx, [ebp - 0x110]
call fcn.004195d0
cmp eax, 1
je 0x40105c
push 0
lea ecx, [ebp - 0x110]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push str.APPDATA
push 0x517
mov ebx, 0x5856f4
lea ecx, [ebp - 0x110]
call fcn.004011d0
push str.APPDATA
push 0x518
mov ebx, str.LngCHT.ini
lea ecx, [ebp - 0x110]
call fcn.004011d0
push str.APPDATA
push 0x519
mov ebx, str.LngENU.ini
lea ecx, [ebp - 0x110]
call fcn.004011d0
push str.APPDATA
push 0x51a
mov ebx, 0x585720
lea ecx, [ebp - 0x110]
call fcn.004011d0
push 0xff
lea edx, [ebp - 0x20f]
push 0
push edx
mov byte [ebp - 0x210], 0
call fcn.005344b0
add esp, 0xc
lea edi, [ebp - 0x210]
call fcn.00414710
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4010f1
sub eax, edx
cmp eax, 0x2d
jae 0x401119
push str.APPDATA
push 0x51b
mov ebx, 0x585730
lea ecx, [ebp - 0x110]
call fcn.004011d0
push str.APPDATA
push 0x51c
mov ebx, 0x58573c
lea ecx, [ebp - 0x110]
call fcn.004011d0
push str.APPDATA
push 0x51d
mov ebx, str.ver.TXT
lea ecx, [ebp - 0x110]
call fcn.004011d0
push str.APPDATA
push 0x51e
mov ebx, 0x585750
lea ecx, [ebp - 0x110]
call fcn.004011d0
push 0x585770
push 0x51f
mov ebx, 0x58575c
lea ecx, [ebp - 0x110]
call fcn.004011d0
push 0x585770
push 0x53e
mov ebx, 0x585774
lea ecx, [ebp - 0x110]
call fcn.004011d0
push 0x585770
push 0x532
mov ebx, 0x58578c
lea ecx, [ebp - 0x110]
call fcn.004011d0
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.0052d75c
mov esp, ebp
pop ebp
ret
Function at 0x401930
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x558b16
mov eax, dword fs:[0]
push eax
sub esp, 0x164
mov eax, dword [0x5adf10]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
push 0x103
lea eax, [ebp - 0x15f]
push ebx
push eax
mov byte [ebp - 0x160], bl
call fcn.005344b0
add esp, 0xc
lea ecx, [ebp - 0x160]
call fcn.004178d0
lea ecx, [ebp - 0x160]
push ecx
lea ecx, [ebp - 0x164]
call fcn.00405fd0
push 0xc
push str.Options.ini
lea ecx, [ebp - 0x164]
mov dword [ebp - 4], ebx
call fcn.00405be0
mov eax, dword [ebp - 0x164]
xor edi, edi
mov dword [ebp - method.CIni.virtual_0], vtable.CIni.0
mov dword [ebp - 0x168], edi
cmp eax, ebx
je 0x4019da
push eax
call fcn.005302e4
mov edi, eax
add esp, 4
mov dword [ebp - 0x168], edi
push 0x40
lea edx, [ebp - 0x57]
push ebx
push edx
mov byte [ebp - 4], 1
call fcn.005344b0
add esp, 0xc
push str.AutoUpdate
push str.Options
lea eax, [ebp - 0x16c]
mov byte [ebp - 0x58], bl
push eax
xor ebx, ebx
call fcn.0041a210
push 0x40
mov esi, eax
push esi
lea ecx, [ebp - 0x58]
push 0x40
push ecx
call fcn.005308e4
push esi
call fcn.0042debb
add esp, 0x14
cmp byte [ebp - 0x58], bl
je 0x401a39
push 0xa
lea edx, [ebp - 0x58]
push ebx
push edx
call fcn.00530b57
add esp, 0xc
test eax, eax
je 0x401a59
lea eax, [ebp - 0x168]
push eax
push 0
push 0
push 0x417c90
push 0
push 0
mov dword [ebp - 0x168], ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
test edi, edi
je 0x401a66
push edi
call fcn.0052f68b
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x164]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x401a8f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0052d75c
mov esp, ebp
pop ebp
ret
Function at 0x405280
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x557e16
mov eax, dword fs:[0]
push eax
sub esp, 0x110
mov eax, dword [0x5adf10]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x103
lea eax, [ebp - 0x113]
push 0
push eax
mov byte [ebp - 0x114], 0
call fcn.005344b0
add esp, 0xc
lea edi, [ebp - 0x11c]
call fcn.00417420
lea esi, [ebp - 0x114]
mov dword [ebp - 4], 0
call fcn.00417600
push 0x586bff
lea ecx, [ebp - 0x118]
call fcn.00405fd0
push 0xc
push str.explorer.exe
lea ecx, [ebp - 0x118]
mov byte [ebp - 4], 1
call fcn.00405be0
push 2
push 0x5868b4
lea ecx, [ebp - 0x118]
call fcn.00405be0
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x405324
sub eax, edx
push eax
lea ecx, [ebp - 0x114]
push ecx
lea ecx, [ebp - 0x118]
call fcn.00405be0
mov edx, dword [ebp - 0x118]
push 1
push edx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x118]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x405375
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x11c]
test eax, eax
je 0x405388
push eax
call fcn.0052fd5f
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0052d75c
mov esp, ebp
pop ebp
ret

Function at 0x405d20
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x405d3b
pop edi
pop ebx
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x405d72
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
add eax, esi
and ecx, 0xf
jbe 0x405d6e
jmp 0x405d60
cmp esi, eax
jae 0x405d72
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x405d60
cmp esi, eax
jb 0x405d79
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x406460
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5572e6
mov eax, dword fs:[0]
push eax
sub esp, 0x124
mov eax, dword [0x5adf10]
xor eax, esp
mov dword [esp + 0x11c], eax
push ebx
push esi
mov eax, dword [0x5adf10]
xor eax, esp
push eax
lea eax, [esp + 0x130]
mov dword fs:[0], eax
xor ebx, ebx
push 0x103
lea eax, [esp + 0x21]
push ebx
push eax
mov dword [esp + 0x1c], ebx
mov byte [esp + 0x28], bl
call fcn.005344b0
add esp, 0xc
lea ecx, [esp + 0x1c]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
call fcn.0043c63a
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x4064e6
push 0x80004005
call fcn.004063a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
mov dword [esp + 0x138], ebx
call fcn.0043c63a
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x406517
push 0x80004005
call fcn.004063a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x18], eax
push 0x13
push str.cnsrbankAssist_HTML
lea ecx, [esp + 0x1c]
mov byte [esp + 0x140], 1
call fcn.00406280
mov ecx, dword [esp + 0x14]
push ecx
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x20]
push 0x586ca4
push eax
call fcn.00405bc0
mov esi, dword [esp + 0x28]
add esp, 0x10
mov ecx, esi
call fcn.004195d0
cmp eax, 1
je 0x406583
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x4065aa
mov ecx, esi
call fcn.004195d0
cmp eax, 1
jne 0x4065aa
push esi
push 0x100
push edi
mov dword [esp + 0x1c], 1
call fcn.0052df52
push 0x586cac
push 0x100
push edi
call fcn.0052dfb1
add esp, 0x18
lea eax, [esi - 0x10]
mov byte [esp + 0x138], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4065cd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x138], 0xffffffff
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4065f8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x130]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.0052d75c
mov esp, ebp
pop ebp
ret