joyce8/EMBER2024-capa huggingface dataset:
Function at 0x466a5f
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d054d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x15c
push ebx
push esi
push edi
push 1
push 0x104
mov eax, dword [ebp + 8]
push eax
call fcn.00430896
test eax, eax
jne 0x466aa8
push 0x216
push str.filecore.cpp
call fcn.004adb90
test eax, eax
je 0x466aa8
int3
xor ecx, ecx
test ecx, ecx
jne 0x466a80
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ebp + 8]
push eax
push 0x104
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
test eax, eax
jne 0x466afe
mov edx, dword [ebp + 0xc]
movsx eax, byte [edx]
test eax, eax
je 0x466ae4
mov ecx, dword [ebp + 0xc]
push ecx
push str.Warning:_could_not_parse_the_path__s._n
call fcn.00430765
add esp, 8
push 0x104
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
xor eax, eax
jmp 0x466bf1
lea ecx, [ebp - 0x1c]
call fcn.004aa097
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00466c04
push 0
push 0
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x10]
push ecx
push 0
push 0
push 0
lea ecx, [ebp - 0x1c]
call fcn.004aa13a
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
jne 0x466b76
lea ecx, [ebp - 0x1c]
call fcn.004aa13a
push eax
push str.Warning:_could_not_get_volume_information__s._n
call fcn.00430765
add esp, 8
mov dword [ebp - 0x164], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.0045490c
mov eax, dword [ebp - 0x164]
jmp 0x466bf1
mov edx, dword [ebp - 0x18]
and edx, 2
test edx, edx
jne 0x466b8a
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_CharUpperA]
mov ecx, dword [ebp - 0x18]
and ecx, 4
test ecx, ecx
jne 0x466bd2
lea edx, [ebp - 0x15c]
push edx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 0xffffffff
je 0x466bd2
mov ecx, dword [ebp - 0x160]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
lea edx, [ebp - 0x130]
push edx
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp - 0x168], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.0045490c
mov eax, dword [ebp - 0x168]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x467529
Capabilities:
Check if file exists
Get file attributes
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 0x2c], ecx
push 0x5e
push str.filest.cpp
mov eax, dword [ebp - 0x2c]
push eax
call fcn.00462220
push 0x118
push 0
mov ecx, dword [ebp + 8]
push ecx
call fcn.004070d0
add esp, 0xc
push 0x104
mov ecx, dword [ebp - 0x2c]
add ecx, 0xc
call fcn.004aa13a
push eax
mov edx, dword [ebp + 8]
add edx, 0x12
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 4], 0xffffffff
je 0x4676b1
lea ecx, [ebp - 0x18]
push ecx
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
jne 0x4675a4
xor eax, eax
jmp 0x4676b6
push 0
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, dword [ebp + 8]
mov dword [edx + 0xc], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 0xc], 0xffffffff
jne 0x4675c9
xor eax, eax
jmp 0x4676b6
mov ecx, dword [ebp - 0x2c]
add ecx, 0xc
call fcn.004aa11c
test eax, eax
je 0x4675e1
mov ecx, dword [ebp + 8]
mov byte [ecx + 0x10], 0
jmp 0x46762a
mov ecx, dword [ebp - 0x2c]
add ecx, 0xc
call fcn.004aa13a
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xffffffff
jne 0x467605
mov edx, dword [ebp + 8]
mov byte [edx + 0x10], 0
jmp 0x46762a
mov eax, dword [ebp + 8]
mov cl, byte [ebp - 0x1c]
mov byte [eax + 0x10], cl
mov edx, dword [ebp - 0x1c]
and dl, 0
test edx, edx
je 0x46762a
push str.Warning:_CFile::GetStatus___returns_m_attribute_without_high_order_flags._n
push 0x53b6b4
call fcn.00430765
add esp, 8
push 0xffffffffffffffff
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x20]
call fcn.00430b1f
push eax
mov ecx, dword [ebp + 8]
call fcn.004aa83e
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x24]
call fcn.00430b1f
push eax
mov ecx, dword [ebp + 8]
add ecx, 8
call fcn.004aa83e
push 0xffffffffffffffff
lea edx, [ebp - 0x18]
push edx
lea ecx, [ebp - 0x28]
call fcn.00430b1f
push eax
mov ecx, dword [ebp + 8]
add ecx, 4
call fcn.004aa83e
mov ecx, dword [ebp + 8]
call fcn.004aa870
test eax, eax
jne 0x467690
mov eax, dword [ebp + 8]
add eax, 4
push eax
mov ecx, dword [ebp + 8]
call fcn.004aa83e
mov ecx, dword [ebp + 8]
add ecx, 8
call fcn.004aa870
test eax, eax
jne 0x4676b1
mov ecx, dword [ebp + 8]
add ecx, 4
push ecx
mov ecx, dword [ebp + 8]
add ecx, 8
call fcn.004aa83e
mov eax, 1
mov esp, ebp
pop ebp
ret 4
Function at 0x475df0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x90
cmp dword [0x53eb60], 0
je 0x475e0c
mov eax, dword [0x540afc]
jmp 0x475f50
mov dword [0x53eb60], 1
xor eax, eax
mov ax, word [0x540af8]
test eax, eax
jne 0x475e4f
push str.MSH_SCROLL_LINES_MSG
call dword [sym.imp.USER32.dll_RegisterWindowMessageA]
mov dword [0x540af4], eax
cmp dword [0x540af4], 0
jne 0x475e46
mov word [0x540af8], 1
jmp 0x475e4f
mov word [0x540af8], 2
xor ecx, ecx
mov cx, word [0x540af8]
cmp ecx, 2
jne 0x475eaa
mov dword [ebp - 4], 0
push str.Magellan_MSWHEEL
push str.MouseZ
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x475eaa
cmp dword [0x540af4], 0
je 0x475eaa
push 0
push 0
mov edx, dword [0x540af4]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [0x540afc], eax
mov eax, dword [0x540afc]
jmp 0x475f50
mov dword [0x540afc], 3
cmp dword [0x540aac], 0
jne 0x475f31
lea ecx, [ebp - 8]
push ecx
push 1
push 0
push str.Control_PanelDesktop
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x475f2f
mov dword [ebp - 0x90], 0x80
lea edx, [ebp - 0x90]
push edx
lea eax, [ebp - 0x88]
push eax
lea ecx, [ebp - 0x8c]
push ecx
push 0
push str.WheelScrollLines
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x475f25
push 0xa
push 0
lea eax, [ebp - 0x88]
push eax
call fcn.0040eb80
add esp, 0xc
mov dword [0x540afc], eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x475f4b
cmp dword [0x540aa8], 0
jne 0x475f4b
push 0
push 0x540afc
push 0
push 0x68
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
mov eax, dword [0x540afc]
mov esp, ebp
pop ebp
ret

Function at 0x478930
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
add ecx, 0x20
call fcn.004aa13a
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
and eax, 1
test eax, eax
je 0x478986
push 1
push 0
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov ecx, dword [ebp - 8]
call dword [edx + 0xa0]
test eax, eax
jne 0x478984
push str.Warning:_File_save_with_new_name_failed._n
push 0x53b284
call fcn.00430765
add esp, 8
xor eax, eax
jmp 0x4789c1
jmp 0x4789bc
push 1
mov ecx, dword [ebp - 8]
add ecx, 0x20
call fcn.004aa13a
push eax
mov eax, dword [ebp - 8]
mov edx, dword [eax]
mov ecx, dword [ebp - 8]
call dword [edx + 0xa0]
test eax, eax
jne 0x4789bc
push str.Warning:_File_save_failed._n
push 0x53b2a4
call fcn.00430765
add esp, 8
xor eax, eax
jmp 0x4789c1
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x496a3e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
and ecx, 1
test ecx, ecx
je 0x496a62
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xc]
mov dword [ebp - 4], eax
jmp 0x496a9c
push 5
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x496ab6
push 0xc9
push str.dlgprop.cpp
call fcn.004adb90
test eax, eax
je 0x496ab6
int3
xor eax, eax
test eax, eax
jne 0x496a9c
mov ecx, dword [ebp - 4]
xor edx, edx
mov dx, word [ecx + 2]
cmp edx, 0xffff
jne 0x496b91
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
and eax, 0x80000000
test eax, eax
je 0x496b61
push 0x537f6c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x496b0e
push 0xe1
push str.dlgprop.cpp
call fcn.004adb90
test eax, eax
je 0x496b0e
int3
xor ecx, ecx
test ecx, ecx
jne 0x496af4
cmp dword [ebp - 0x18], 0
je 0x496b5f
push 0x537f7c
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x496b55
mov eax, 1
test eax, eax
je 0x496b4f
push 0xe6
push str.dlgprop.cpp
call fcn.004adb90
test eax, eax
je 0x496b4f
int3
xor ecx, ecx
test ecx, ecx
jne 0x496b32
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x496b91
mov eax, dword [ebp - 0x14]
and eax, 0xff
cmp eax, 3
jne 0x496b91
mov ecx, 1
test ecx, ecx
je 0x496b8b
push 0xed
push str.dlgprop.cpp
call fcn.004adb90
test eax, eax
je 0x496b8b
int3
xor edx, edx
test edx, edx
jne 0x496b6e
call fcn.004c5923
cmp dword [eax + 0x1038], 0
je 0x496bae
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0x20]
call fcn.004969f3
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.004968b5
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x20]
cmp dword [eax + 0x44], 0
je 0x496bde
mov ecx, dword [ebp - 0x20]
mov edx, dword [ecx + 0x44]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x44], 0
cmp dword [ebp - 8], 0
je 0x496bf3
mov ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 8]
mov dword [edx + 0x44], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 4]
mov dword [ecx + 0xc], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
or ecx, 1
mov edx, dword [ebp + 8]
mov dword [edx + 4], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x49f4a9
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
push 5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindow]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x49f598
mov eax, dword [ebp - 4]
push eax
call fcn.0045a7f4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x49f584
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x1c]
cmp edx, dword [ebp - 4]
je 0x49f584
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x1c]
push edx
call fcn.0049f0c1
test eax, eax
je 0x49f584
push 0xfffffffffffffff0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov dword [ebp - 0xc], eax
cmp dword [ebp + 8], 0
jne 0x49f54a
mov ecx, dword [ebp - 0xc]
and ecx, 0x18000000
cmp ecx, 0x10000000
jne 0x49f54a
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x24]
or ecx, 2
mov edx, dword [ebp - 8]
mov dword [edx + 0x24], ecx
jmp 0x49f584
cmp dword [ebp + 8], 0
je 0x49f584
mov eax, dword [ebp - 0xc]
and eax, 0x18000000
test eax, eax
jne 0x49f584
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x24]
and edx, 2
test edx, edx
je 0x49f584
push 4
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x24]
and edx, 0xfffffffd
mov eax, dword [ebp - 8]
mov dword [eax + 0x24], edx
push 2
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_GetWindow]
mov dword [ebp - 4], eax
jmp 0x49f4c4
mov esp, ebp
pop ebp
ret 4
Function at 0x4b69fb
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x28], 0
jne 0x4b6a22
push 0x3cc
push str.afxwin2.inl
call fcn.004adb90
test eax, eax
je 0x4b6a22
int3
xor ecx, ecx
test ecx, ecx
jne 0x4b6a05
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4c66fc
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
mov dword [ebp - 0x1c], ecx
cmp dword [ebp + 8], 0
jne 0x4c6722
push 0x146
push str.afxtls.cpp
call fcn.004adb90
test eax, eax
je 0x4c6722
int3
xor eax, eax
test eax, eax
jne 0x4c6708
mov dword [ebp - 4], 1
mov dword [ebp - 8], 1
jmp 0x4c6741
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 8]
cmp eax, dword [edx + 8]
jge 0x4c67c4
cmp dword [ebp + 0xc], 0
je 0x4c6764
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx + 0x10]
mov eax, dword [ebp - 8]
mov ecx, dword [edx + eax*8 + 4]
cmp ecx, dword [ebp + 0xc]
jne 0x4c67a9
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xc]
mov ecx, dword [ebp - 8]
mov edx, dword [eax + ecx*4]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4c6790
push 1
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xc]
call dword [edx]
mov dword [ebp - 0x20], eax
jmp 0x4c6797
mov dword [ebp - 0x20], 0
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 8]
mov dword [ecx + edx*4], 0
jmp 0x4c67bf
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 8]
cmp dword [ecx + edx*4], 0
je 0x4c67bf
mov dword [ebp - 4], 0
jmp 0x4c6738
cmp dword [ebp - 4], 0
je 0x4c6838
mov eax, dword [ebp - 0x1c]
add eax, 0x1c
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x1c]
add ecx, 0x14
call fcn.004c6dc0
mov edx, dword [ebp - 0x1c]
add edx, 0x1c
push edx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov edx, dword [ebp + 8]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4c6823
push 1
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x14]
call dword [edx]
mov dword [ebp - 0x24], eax
jmp 0x4c682a
mov dword [ebp - 0x24], 0
push 0
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4c6841
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
add eax, 0x1c
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [ebp + 0xc], 0
jne 0x4c6884
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4c6882
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov ecx, dword [ebp - 0x10]
call fcn.004c66fc
jmp 0x4c68b9
mov ecx, dword [ebp - 0x10]
add ecx, 0x14
call fcn.004c6de0
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4c68b9
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [ebp - 0x10]
call fcn.004c66fc
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
jmp 0x4c6892
mov ecx, dword [ebp - 0x10]
add ecx, 0x1c
push ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esp, ebp
pop ebp
ret 8

Function at 0x4c8315
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov ecx, 0x540af0
call fcn.004c8460
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
xor ecx, ecx
mov cx, word [eax + 8]
test ecx, ecx
jne 0x4c83fe
mov edx, dword [ebp - 4]
cmp dword [edx + 4], 0
je 0x4c8356
push 0x2f
push str.ccdata.cpp
call fcn.004adb90
test eax, eax
je 0x4c8356
int3
xor eax, eax
test eax, eax
jne 0x4c833c
push str.COMCTL32.DLL
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4c83c1
push 5
mov ecx, dword [ebp + 0x10]
neg ecx
sbb ecx, ecx
and ecx, 0xe
add ecx, 0x3ee
and ecx, 0xffff
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4c83c1
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.00465182
add esp, 0xc
mov ecx, dword [ebp + 8]
call fcn.004aa0f0
add eax, 1
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
mov ecx, dword [ebp + 8]
call fcn.004aa13a
push eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 0xc]
mov cx, word [eax]
mov word [edx + 8], cx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
push eax
mov ecx, dword [ebp + 8]
call fcn.00454bbd
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 4]
mov ax, word [edx + 8]
mov word [ecx], ax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dx, word [ecx]
xor eax, eax
cmp edx, 0xffff
setne al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4c8ded
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [ebp + 0x10], 0
jne 0x4c8e39
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 1
mov edx, dword [ebp + 8]
push edx
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegSetValueA]
test eax, eax
je 0x4c8e32
mov eax, dword [ebp + 8]
push eax
push 0x53aff4
call fcn.00430765
add esp, 8
xor eax, eax
jmp 0x4c8ea5
mov eax, 1
jmp 0x4c8ea5
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
push edx
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x4c8e92
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 1
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x4c8e92
cmp dword [ebp - 8], 0
jne 0x4c8e92
mov eax, 1
jmp 0x4c8ea5
mov edx, dword [ebp + 8]
push edx
push str.Warning:_registration_database_update_failed_for_key__s._n
call fcn.00430765
add esp, 8
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc
Function at 0x2e01a35d
Capabilities:
Hide graphical window

Disassembly:
push 0
push dword [ecx]
call dword [sym.imp.USER32.dll_ShowWindow]
ret
Function at 0x2e01d65b
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
and dword [ebp - 4], 0
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x2e01d669
sub eax, ecx
push 0
sar eax, 1
lea ecx, [ebp - 4]
push ecx
add eax, eax
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x2e01d6b2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp + 8]
call fcn.2e00e813
mov eax, dword [eax]
mov dword [ebp + 0xc], eax
push 0x2e041f6c
lea eax, [ebp + 0xc]
push eax
call fcn.2e02ee42
leave
ret 8

Function at 0x2e023c96
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push ebx
push 3
push ebx
push ebx
push SysReAllocString
push dword [ebp + 8]
mov edi, ecx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp + 8], eax
cmp eax, 0xffffffff
jne 0x2e023ce3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 8]
call fcn.2e00e813
mov eax, dword [eax]
mov dword [ebp + 8], eax
push 0x2e041f6c
lea eax, [ebp + 8]
push eax
call fcn.2e02ee42
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
je 0x2e023cc1
lea eax, [esi + 1]
push eax
call fcn.2e02ff86
pop ecx
mov dword [edi], eax
cmp eax, ebx
jne 0x2e023d12
mov al, byte [ebp + 0xb]
mov byte [ebp + 0xb], al
push 0x2e044a48
lea eax, [ebp + 0xb]
jmp 0x2e023cdd
push ebx
lea ecx, [ebp - 4]
push ecx
push esi
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x2e023cc1
mov eax, dword [edi]
push dword [ebp + 8]
mov byte [esi + eax], bl
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 4

Function at 0x2e025f39
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x2e049994]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x108]
push eax
mov esi, 0x103
xor ebx, ebx
push esi
mov edi, ecx
mov dword [ebp - 0x10c], ebx
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x2e025f9b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x110]
call fcn.2e00e813
mov eax, dword [eax]
mov dword [ebp - 0x10c], eax
push 0x2e041f6c
lea eax, [ebp - 0x10c]
push eax
call fcn.2e02ee42
inc dword [ebp - 0x10c]
push dword [ebp - 0x10c]
lea eax, [ebp - 0x108]
push eax
push 0x2e008d38
push esi
push edi
call fcn.2e025e73
add esp, 0x14
test eax, eax
jl 0x2e025fe5
push ebx
push ebx
push 1
push ebx
push ebx
push SysReAllocString
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
jne 0x2e025ff6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x50
je 0x2e025f9b
jmp 0x2e026004
push 0x2e008cf8
mov ecx, 0x2e0494f0
call fcn.2e025e3a
jmp 0x2e026004
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, edi
call fcn.2e025e92
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.2e02f7a3
leave
ret