joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42b6e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 8]
xor esi, esi
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 4], eax
test eax, eax
jne 0x42b705
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push ebx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
test ebx, ebx
je 0x42b72c
push dword [ebp - 4]
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
test eax, eax
jne 0x42b735
pop ebx
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push ebx
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x42b7ad
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x42b7a6
push ebx
push dword [ebp - 4]
push eax
call fcn.006b3670
add esp, 0xc
mov dword [ebp - 4], esi
lea eax, [ebp - 4]
push eax
push 0
push edi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jne 0x42b79f
mov ecx, dword [ebp - 4]
call fcn.0042aef0
mov ecx, dword [ebp - 4]
mov esi, eax
push ecx
mov edx, dword [ecx]
call dword [edx + 8]
test esi, esi
je 0x42b79f
mov eax, dword [esi + 8]
mov dword [esi + 8], 0
test eax, eax
je 0x42b79f
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax]
xor esi, esi
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop ebx
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x42b7c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0x10
call dword [sym.imp.gdiplus.dll_GdipAlloc]
mov edi, dword [ebp + 0x14]
mov esi, eax
mov ebx, dword [ebp + 0xc]
test esi, esi
je 0x42b827
lea eax, [ebp - 4]
mov dword [esi], vtable.Gdiplus::Bitmap.0
push eax
push ebx
push edi
mov dword [ebp - 4], 0
call dword [sym.imp.gdiplus.dll_GdipCreateBitmapFromResource]
mov dword [esi + 8], eax
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
mov eax, dword [esi + 8]
mov dword [esi + 8], 0
test eax, eax
jne 0x42b827
mov ecx, dword [ebp + 8]
push esi
mov ecx, dword [ecx]
call fcn.0042ed00
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax]
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp + 0x10]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x42b841
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
test ebx, ebx
je 0x42b838
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x42b838
push ebx
push eax
push dword [ebp + 8]
call fcn.0042b990
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42bfd0
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], edi
test edi, edi
je 0x42c15b
mov edx, dword [ebp + 0x18]
test edx, edx
je 0x42c15b
mov eax, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
add eax, ebx
mov esi, dword [ebp + 0xc]
add esi, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 0
mov dword [ebp - 8], esi
mov ecx, dword [eax]
cmp ecx, dword [ebp + 0x24]
mov eax, dword [eax + 4]
cmovg ecx, dword [ebp - 0x10]
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp + 0x28]
cmp eax, ecx
cmovg eax, dword [ebp - 4]
cmp dword [ebp + 0x24], 0
mov dword [ebp - 4], eax
je 0x42c15b
test ecx, ecx
je 0x42c15b
cmp dword [ebp - 0x18], 0
je 0x42c0cf
sub ebx, dword [ebp - 0x10]
mov edi, dword [ebp - 0xc]
mov dword [ebp + 8], ebx
cmp ebx, edi
jge 0x42c15b
sub dword [ebp + 0xc], eax
mov eax, edi
mov edi, dword [ebp + 0xc]
sub eax, ebx
cmp dword [ebp + 0x24], eax
cmovl eax, dword [ebp + 0x24]
mov dword [ebp - 0x10], eax
cmp edi, esi
jge 0x42c0bc
mov dword [ebp - 4], 0x1ff0000
mov esi, dword [ebp - 4]
mov ebx, dword [ebp - 8]
push esi
sub ebx, edi
cmp ecx, ebx
cmovl ebx, ecx
push ebx
push eax
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push edx
push ebx
push eax
push edi
push dword [ebp + 8]
push dword [ebp - 0x14]
call dword [sym.imp.MSIMG32.dll_AlphaBlend]
mov eax, dword [ebp - 0x10]
add edi, ebx
mov ecx, dword [ebp + 0x28]
mov edx, dword [ebp + 0x18]
cmp edi, dword [ebp - 8]
jl 0x42c083
mov ebx, dword [ebp + 8]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 0xc]
add ebx, eax
mov dword [ebp + 8], ebx
cmp ebx, edi
jl 0x42c064
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push edi
call dword [sym.imp.GDI32.dll_GetStretchBltMode]
push 1
push dword [ebp + 0x18]
mov dword [ebp - 0x18], eax
call dword [sym.imp.GDI32.dll_SetStretchBltMode]
sub ebx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
cmp ebx, eax
jge 0x42c14f
mov edi, dword [ebp + 0xc]
sub edi, dword [ebp - 4]
mov edx, dword [ebp + 0x24]
mov dword [ebp + 0xc], edi
lea ebx, [ebx]
mov ecx, eax
sub ecx, ebx
cmp edx, ecx
cmovl ecx, edx
mov dword [ebp - 0x10], ecx
cmp edi, esi
jge 0x42c146
push 0xcc0020
push dword [ebp + 0x20]
sub esi, edi
push dword [ebp + 0x1c]
cmp dword [ebp + 0x28], esi
push dword [ebp + 0x18]
cmovl esi, dword [ebp + 0x28]
push esi
push ecx
push edi
push ebx
push dword [ebp - 0x14]
call dword [sym.imp.GDI32.dll_BitBlt]
mov ecx, dword [ebp - 0x10]
add edi, esi
mov esi, dword [ebp - 8]
cmp edi, esi
jl 0x42c110
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp + 0x24]
mov edi, dword [ebp + 0xc]
add ebx, ecx
cmp ebx, eax
jl 0x42c100
push dword [ebp - 0x18]
push dword [ebp + 0x18]
call dword [sym.imp.GDI32.dll_SetStretchBltMode]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42eb50
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x7e6410]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x3c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esi + 0x28], 0
jne 0x42ec49
mov eax, dword [esi + 0x2c]
xorps xmm0, xmm0
movdqu xmmword [ebp - 0x2c], xmm0
push edi
mov dword [ebp - 0x2c], eax
mov eax, dword [esi + 0x30]
push 0x10
movdqu xmmword [ebp - 0x1c], xmm0
mov dword [ebp - 0x30], 0x28
movq qword [ebp - 0xc], xmm0
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], 0x200001
mov dword [ebp - 0x20], 0
call dword [sym.imp.gdiplus.dll_GdipAlloc]
mov edi, eax
test edi, edi
je 0x42ebe3
mov ecx, dword [esi]
lea eax, [ebp - 0x34]
push eax
push ecx
lea eax, [ebp - 0x30]
mov dword [edi], vtable.Gdiplus::Bitmap.0
push eax
mov dword [ebp - 0x34], 0
call dword [sym.imp.gdiplus.dll_GdipCreateBitmapFromGdiDib]
mov dword [edi + 8], eax
mov eax, dword [ebp - 0x34]
mov dword [edi + 4], eax
jmp 0x42ebe5
xor edi, edi
mov ecx, dword [esi + 4]
mov dword [esi + 4], edi
test ecx, ecx
je 0x42ebf5
mov eax, dword [ecx]
push 1
call dword [eax]
mov ebx, dword [esi + 4]
test ebx, ebx
je 0x42ec34
push 8
call dword [sym.imp.gdiplus.dll_GdipAlloc]
mov edi, eax
test edi, edi
je 0x42ec2d
xor eax, eax
mov dword [ebp - 0x34], eax
test ebx, ebx
je 0x42ec26
lea eax, [ebp - 0x34]
push eax
push dword [ebx + 4]
call dword [sym.imp.gdiplus.dll_GdipGetImageGraphicsContext]
mov dword [edi + 4], eax
mov eax, dword [ebp - 0x34]
mov dword [edi], eax
mov dword [esi + 0x28], edi
jmp 0x42ec3f
xor edi, edi
mov dword [esi + 0x28], edi
jmp 0x42ec3f
push str.cccccccccccccccccccccccccc8888888888888888888_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [esi + 0x28], 0
lea ebx, [esi + 0x3c]
pop edi
je 0x42ec4c
inc dword [esi + 0x38]
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [esi + 0x28]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.006b3266
mov esp, ebp
pop ebp
ret
Function at 0x42f1c0
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6f6ec8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x7e6410]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [ebp - 0x28]
call fcn.00430140
push 3
push 0x783aec
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
push dword [ebp - 0x18]
push 0
call fcn.00427df0
test eax, eax
jne 0x42f21e
mov esi, dword [esi*4 + 0x783ca8]
jmp 0x42f3c2
push 3
push 0x783af4
push dword [ebp - 0x18]
lea ecx, [ebp - 0x28]
push 0
call fcn.00427df0
test eax, eax
jne 0x42f242
mov esi, dword [esi*4 + 0x783c48]
jmp 0x42f3c2
push 3
push 0x783afc
push dword [ebp - 0x18]
lea ecx, [ebp - 0x28]
push 0
call fcn.00427df0
test eax, eax
jne 0x42f266
mov esi, dword [esi*4 + 0x783c08]
jmp 0x42f3c2
push 0x783b04
lea ecx, [ebp - 0x28]
call fcn.00427da0
test eax, eax
jne 0x42f283
mov esi, dword [esi*4 + 0x783be8]
jmp 0x42f3c2
push 0x783b0c
lea ecx, [ebp - 0x28]
call fcn.00427da0
test eax, eax
jne 0x42f2a0
mov esi, dword [esi*4 + 0x783cf8]
jmp 0x42f3c2
push 0x783b14
lea ecx, [ebp - 0x28]
call fcn.00427da0
test eax, eax
je 0x42f3bb
push 0x783b1c
lea ecx, [ebp - 0x28]
call fcn.00427da0
test eax, eax
jne 0x42f2d2
mov esi, dword [esi*4 + 0x783c88]
jmp 0x42f3c2
push 0x783b24
lea ecx, [ebp - 0x28]
call fcn.00427da0
test eax, eax
jne 0x42f2ef
mov esi, dword [esi*4 + 0x783c68]
jmp 0x42f3c2
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx eax, ax
cmp eax, 0x1c0a
jg 0x42f3ef
je 0x42f3bb
cmp eax, 0x80a
jg 0x42f377
je 0x42f3bb
cmp eax, 0x412
jg 0x42f353
je 0x42f212
cmp eax, 0x40a
jg 0x42f33f
je 0x42f3bb
cmp eax, 4
je 0x42f397
cmp eax, 0x404
jmp 0x42f492
cmp eax, 0x411
jne 0x42f498
mov esi, dword [esi*4 + 0x783c48]
jmp 0x42f3c2
sub eax, 0x419
je 0x42f25a
sub eax, 5
je 0x42f2c6
sub eax, 0x3e6
je 0x42f397
mov esi, dword [esi*4 + 0x783c68]
jmp 0x42f3c2
cmp eax, 0x100a
jg 0x42f3a0
je 0x42f3bb
sub eax, 0xc04
je 0x42f397
sub eax, 6
je 0x42f3bb
sub eax, 0x3fa
jne 0x42f498
mov esi, dword [esi*4 + 0x783be8]
jmp 0x42f3c2
sub eax, 0x1404
je 0x42f294
sub eax, 6
je 0x42f3bb
sub eax, 0x400
jne 0x42f498
mov esi, dword [esi*4 + 0x783c28]
cmp dword [ebp - 0x14], 8
jb 0x42f3d3
push dword [ebp - 0x28]
call fcn.006b31f8
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.006b3266
mov esp, ebp
pop ebp
ret
cmp eax, 0x3c0a
jg 0x42f43d
je 0x42f3bb
cmp eax, 0x2c0a
jg 0x42f41f
je 0x42f3bb
cmp eax, 0x200a
je 0x42f3bb
cmp eax, 0x240a
je 0x42f3bb
cmp eax, 0x280a
je 0x42f3bb
mov esi, dword [esi*4 + 0x783c68]
jmp 0x42f3c2
cmp eax, 0x300a
je 0x42f3bb
cmp eax, 0x340a
je 0x42f3bb
cmp eax, 0x380a
je 0x42f3bb
mov esi, dword [esi*4 + 0x783c68]
jmp 0x42f3c2
cmp eax, 0x4c0a
jg 0x42f477
je 0x42f3bb
cmp eax, 0x400a
je 0x42f3bb
cmp eax, 0x440a
je 0x42f3bb
cmp eax, 0x480a
je 0x42f3bb
mov esi, dword [esi*4 + 0x783c68]
jmp 0x42f3c2
cmp eax, 0x500a
je 0x42f3bb
cmp eax, 0x540a
je 0x42f3bb
cmp eax, 0x7c04
je 0x42f294
mov esi, dword [esi*4 + 0x783c68]
jmp 0x42f3c2
Function at 0x42f600
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push edi
push 0x44
call fcn.006b6815
mov esi, eax
add esp, 4
test esi, esi
je 0x42f6f8
xor eax, eax
mov dword [esi + 0x18], 7
lea ecx, [esi + 4]
mov dword [ecx + 0x10], 0
lea edi, [esi + 0x1c]
mov word [ecx], ax
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], 7
mov word [edi], ax
mov eax, dword [ebp + 8]
mov dword [esi + 0x34], eax
mov eax, dword [ebp + 0xc]
cmp ecx, eax
je 0x42f659
push 0xffffffffffffffff
push 0
push eax
call fcn.00424900
mov eax, dword [ebp + 0x10]
cmp edi, eax
je 0x42f66c
push 0xffffffffffffffff
push 0
push eax
mov ecx, edi
call fcn.00424900
push 0x108
call fcn.006b6815
add esp, 4
test eax, eax
je 0x42f70a
mov ecx, eax
call fcn.0042fe40
mov dword [esi], eax
mov eax, dword [ebp + 0x14]
push esi
mov dword [esi + 0x3c], eax
mov eax, dword [ebp + 0x18]
push 0
push 0x42fc50
mov byte [esi + 0x38], 0
mov dword [esi + 0x40], eax
call fcn.006b9d07
mov eax, dword [esi]
add esp, 0xc
cmp dword [eax + 4], 0
jne 0x42f6ee
mov edi, dword [sym.imp.USER32.dll_PeekMessageW]
push ebx
mov ebx, dword [sym.imp.USER32.dll_TranslateMessage]
nop
push 1
push 0xff
push 0
push 0
lea eax, [ebp - 0x20]
push eax
call edi
test eax, eax
je 0x42f6e5
lea eax, [ebp - 0x20]
push eax
call ebx
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
mov eax, dword [esi]
cmp dword [eax + 4], 0
je 0x42f6c0
pop ebx
mov eax, dword [esi]
pop edi
pop esi
mov eax, dword [eax]
mov esp, ebp
pop ebp
ret
push 0x7da8d8
lea eax, [ebp - 1]
mov byte [ebp - 1], 0
push eax
call fcn.006b4394
push 0x7da8d8
lea eax, [ebp - 1]
mov byte [ebp - 1], 0
push eax
call fcn.006b4394
int3
Function at 0x432cd0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov edi, eax
test edi, edi
jne 0x432cee
pop edi
mov esp, ebp
pop ebp
ret
push esi
push 0x790eb0
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp + 0x10]
push 0x790eb0
push eax
call fcn.00428920
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov dword [ebp - 8], eax
xor ecx, ecx
inc eax
mov edx, 2
mov dword [ebp - 0xc], eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.006b6815
mov esi, eax
add esp, 4
test esi, esi
je 0x432d7b
mov eax, dword [ebp - 8]
lea eax, [eax*2 + 2]
push eax
push 0
push esi
call fcn.006b47d0
add esp, 0xc
push dword [ebp - 0xc]
push esi
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp + 0x10]
push esi
push eax
call fcn.00428920
push esi
call fcn.006b31f8
add esp, 4
mov eax, 1
pop esi
pop edi
mov esp, ebp
pop ebp
ret
push 0x7da8d8
lea eax, [ebp - 1]
mov byte [ebp - 1], 0
push eax
call fcn.006b4394
int3
Function at 0x4350a0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x7e6410]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x804f44], 0
je 0x4350d5
xor eax, eax
cmp dword [0x804f3c], eax
setne al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006b3266
mov esp, ebp
pop ebp
ret
push esi
push edi
push 0x90
lea eax, [ebp - 0x94]
push 0
push eax
call fcn.006b47d0
add esp, 0xc
mov dword [ebp - 0x98], 0x94
lea eax, [ebp - 0x98]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
xor eax, eax
cmp dword [ebp - 0x88], 2
push 0x783ee0
sete al
mov dword [0x804f4c], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
test esi, esi
je 0x4351be
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x783ef0
push esi
call edi
mov dword [0x804f30], eax
test eax, eax
je 0x4351be
push 0x783f04
push esi
call edi
mov dword [0x804f50], eax
test eax, eax
je 0x4351be
push 0x783f18
push esi
call edi
mov dword [0x804f48], eax
test eax, eax
je 0x4351be
push 0x783f28
push esi
call edi
mov dword [0x804f34], eax
test eax, eax
je 0x4351be
push str.EnumDisplayMonitors
push esi
call edi
mov dword [0x804f40], eax
test eax, eax
je 0x4351be
push str.EnumDisplayDevicesW
push esi
call edi
mov dword [0x804f38], eax
test eax, eax
je 0x4351be
cmp dword [0x804f4c], 0
je 0x4351a6
push 0x783f64
jmp 0x4351ab
push str.GetMonitorInfoA
push esi
call edi
mov dword [0x804f3c], eax
test eax, eax
je 0x4351be
mov eax, 1
jmp 0x435206
mov dword [0x804f30], 0
xor eax, eax
mov dword [0x804f50], 0
mov dword [0x804f48], 0
mov dword [0x804f34], 0
mov dword [0x804f3c], 0
mov dword [0x804f40], 0
mov dword [0x804f38], 0
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov dword [0x804f44], 1
pop esi
call fcn.006b3266
mov esp, ebp
pop ebp
ret

Function at 0x437680
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov eax, ecx
push edi
mov dword [ebp - 4], eax
call fcn.00437a50
push 0
push 0x8000000
push 3
push 0
push 3
push SysReAllocStringLen
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4376f5
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
lea ecx, [ebx + 2]
push ecx
call fcn.006b6815
mov edi, eax
add esp, 4
test edi, edi
je 0x4376ee
push 0
lea eax, [ebp - 8]
push eax
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x437700
push edi
call fcn.006b31f8
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
push 1
push ebx
push edi
call fcn.004377c0
push edi
mov esi, eax
call fcn.006b31f8
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4392b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6f769c
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x7e6410]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [0x7e7970]
mov dword [esi + 4], eax
lea ecx, [esi + 8]
mov dword [ebp - 4], 0
mov dword [ecx], 0
mov dword [ecx + 4], 0x11
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xa
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0xa
mov eax, dword [0x7e7970]
mov dword [esi + 0x38], eax
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 3
mov dword [esi], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
test eax, eax
jle 0x43936b
push ecx
push eax
call fcn.00440d20
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x440a90
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x70
mov eax, dword [0x7e6410]
xor eax, esp
mov dword [esp + 0x6c], eax
mov edx, dword [ebp + 8]
mov eax, edx
push esi
mov esi, dword [ebp + 0xc]
push edi
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x440ab1
sub eax, edi
mov dword [esp + 0x1c], 0
push eax
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c], 0
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
call fcn.004401c0
lea edx, [esp + 0xc]
lea ecx, [esp + 0x68]
call fcn.00440290
movzx eax, byte [esp + 0x77]
push eax
movzx eax, byte [esp + 0x7a]
push eax
movzx eax, byte [esp + 0x7d]
push eax
movzx eax, byte [esp + 0x80]
push eax
movzx eax, byte [esp + 0x83]
push eax
movzx eax, byte [esp + 0x86]
push eax
movzx eax, byte [esp + 0x89]
push eax
movzx eax, byte [esp + 0x8c]
push eax
movzx eax, byte [esp + 0x8f]
push eax
movzx eax, byte [esp + 0x92]
push eax
movzx eax, byte [esp + 0x95]
push eax
movzx eax, byte [esp + 0x98]
push eax
movzx eax, byte [esp + 0x9b]
push eax
movzx eax, byte [esp + 0x9e]
push eax
movzx eax, byte [esp + 0xa1]
push eax
movzx eax, byte [esp + 0xa4]
push eax
push str._02x_02x_02x_02x_02x_02x_02x_02x_02x_02x_02x_02x_02x_02x_02x_02x
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
mov ecx, dword [esp + 0xc0]
add esp, 0x4c
pop edi
pop esi
xor ecx, esp
call fcn.006b3266
mov esp, ebp
pop ebp
ret

Function at 0x440bb0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x70
mov eax, dword [0x7e6410]
xor eax, esp
mov dword [esp + 0x6c], eax
mov edx, dword [ebp + 8]
mov eax, edx
push esi
mov esi, dword [ebp + 0xc]
push edi
lea edi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x440bd1
sub eax, edi
mov dword [esp + 0x1c], 0
sar eax, 1
lea ecx, [esp + 8]
add eax, eax
mov dword [esp + 0x18], 0
push eax
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
call fcn.004401c0
lea edx, [esp + 0xc]
lea ecx, [esp + 0x68]
call fcn.00440290
movzx eax, byte [esp + 0x77]
push eax
movzx eax, byte [esp + 0x7a]
push eax
movzx eax, byte [esp + 0x7d]
push eax
movzx eax, byte [esp + 0x80]
push eax
movzx eax, byte [esp + 0x83]
push eax
movzx eax, byte [esp + 0x86]
push eax
movzx eax, byte [esp + 0x89]
push eax
movzx eax, byte [esp + 0x8c]
push eax
movzx eax, byte [esp + 0x8f]
push eax
movzx eax, byte [esp + 0x92]
push eax
movzx eax, byte [esp + 0x95]
push eax
movzx eax, byte [esp + 0x98]
push eax
movzx eax, byte [esp + 0x9b]
push eax
movzx eax, byte [esp + 0x9e]
push eax
movzx eax, byte [esp + 0xa1]
push eax
movzx eax, byte [esp + 0xa4]
push eax
push str._02x_02x_02x_02x_02x_02x_02x_02x_02x_02x_02x_02x_02x_02x_02x_02x
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
mov ecx, dword [esp + 0xc0]
add esp, 0x4c
pop edi
pop esi
xor ecx, esp
call fcn.006b3266
mov esp, ebp
pop ebp
ret
Function at 0x4537b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6f9303
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x7e6410]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [ebp + 8]
mov dword [ebp - 4], 0
push eax
lea ecx, [esi + 0x464]
call fcn.004289a0
mov edi, dword [esi + 0x37c]
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x46c], eax
test edi, edi
je 0x453814
mov edi, dword [edi]
mov ecx, dword [edi]
test ecx, ecx
je 0x45380d
mov eax, dword [ecx]
call dword [eax + 0xc]
mov dword [edi + 4], 0
lea edi, [esi + 0x380]
mov ecx, edi
call fcn.00428750
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4538c9
test al, 0x10
jne 0x4538c9
cmp dword [esi + 0x37c], 0
jne 0x45387b
push 4
call fcn.006b6815
add esp, 4
test eax, eax
jne 0x453863
mov byte [ebp + 0xf], al
lea eax, [ebp + 0xf]
push 0x7da8d8
push eax
call fcn.006b4394
mov dword [ebp + 0xc], eax
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.004745b0
mov byte [ebp - 4], 0
mov dword [esi + 0x37c], eax
mov eax, dword [esi + 0x37c]
push 0
push dword [esi + 0x464]
mov ecx, dword [eax]
call fcn.00474320
test eax, eax
jne 0x4538bd
mov eax, dword [esi + 0x37c]
test eax, eax
je 0x4538b2
mov esi, dword [eax]
mov ecx, dword [esi]
test ecx, ecx
je 0x4538ab
mov eax, dword [ecx]
call dword [eax + 0xc]
mov dword [esi + 4], 0
mov ecx, edi
call fcn.00428750
xor esi, esi
jmp 0x4538d8
mov dword [esi + 0x470], 1
jmp 0x4538d3
mov dword [esi + 0x470], 0
mov esi, 1
mov eax, dword [ebp + 8]
lea ecx, [eax - 0xc]
cmp ecx, 0x7e8698
je 0x453903
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x453903
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff4
push ecx
call fcn.006b31f8
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8