joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44da9c
Capabilities:
Get geographical location

Disassembly:
push ebx
add esp, 0xfffffef8
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
push 0x1001
push 0x800
call fcn.00409714
test eax, eax
jle 0x44dad4
mov eax, ebx
mov edx, esp
mov ecx, 0x105
push 0
call fcn.00405be0
jmp 0x44dadb
mov eax, ebx
call fcn.004058a8
add esp, 0x108
pop ebx
ret

Function at 0x44dde4
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff98
push ebx
xor edx, edx
mov dword [ebp - 0x64], edx
mov dword [ebp - 0x68], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x44dede
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x44deec
push 0x44df18
call fcn.0040973c
push eax
call fcn.0040976c
test eax, eax
je 0x44de2b
mov dword [ebp - 0x60], 0x40
lea edx, [ebp - 0x60]
push edx
call eax
jmp 0x44de51
mov dword [ebp - 0x20], 0x20
lea eax, [ebp - 0x20]
push eax
call fcn.004098b8
mov eax, dword [ebp - 0x14]
xor edx, edx
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], edx
mov eax, dword [ebp - 0x18]
xor edx, edx
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], edx
push 0
push 0x100000
mov eax, dword [ebp - 0x50]
mov edx, dword [ebp - 0x4c]
add eax, 0x80000
adc edx, 0
call fcn.00407860
push edx
push eax
lea ecx, [ebp - 0x64]
mov dl, 0x30
mov eax, 1
call fcn.0040d9e0
push dword [ebp - 0x64]
push 0x44df40
push 0
push 0x100000
mov eax, dword [ebp - 0x58]
mov edx, dword [ebp - 0x54]
add eax, 0x80000
adc edx, 0
call fcn.00407860
push edx
push eax
lea ecx, [ebp - 0x68]
mov dl, 0x30
mov eax, 1
call fcn.0040d9e0
push dword [ebp - 0x68]
push 0x44df50
mov eax, ebx
mov edx, 4
call fcn.00405db8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44dee5
lea eax, [ebp - 0x68]
mov edx, 2
call fcn.004058cc
ret
Function at 0x44e268
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov ebx, ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x44e3b5
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
lea eax, [ebp - 4]
call fcn.004058a8
xor eax, eax
push ebp
push 0x44e390
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
lea eax, [ebp - 4]
mov ecx, ebx
mov edx, esi
call fcn.004059e0
push 0
mov edx, edi
lea eax, [ebp - 8]
mov ecx, ebx
call fcn.004059e0
lea eax, [ebp - 4]
xor edx, edx
call fcn.00405ab8
call fcn.00405c3c
cmp ebx, eax
jne 0x44e386
lea eax, [ebp - 8]
xor edx, edx
call fcn.00405ab8
call fcn.00405c3c
cmp ebx, eax
jne 0x44e386
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00405f4c
je 0x44e386
lea eax, [ebp - 0x10]
push eax
push 0x40
push ebx
push esi
call fcn.00409a78
test eax, eax
je 0x44e386
mov edx, esi
mov eax, edi
mov ecx, ebx
call fcn.004032cc
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x10]
push eax
push ebx
push esi
call fcn.00409a78
mov eax, dword [0x58ccf4]
call fcn.00407d08
mov ebx, eax
lea eax, [ebx + 1]
push eax
mov eax, 0x58ccf4
mov ecx, 1
mov edx, dword [0x44e244]
call fcn.00407ed0
add esp, 4
lea edi, [ebx + ebx*2]
mov eax, dword [0x58ccf4]
mov dword [eax + edi*4], esi
mov eax, dword [0x58ccf4]
lea eax, [eax + edi*4 + 4]
mov edx, dword [ebp - 4]
call fcn.004058fc
mov eax, dword [0x58ccf4]
lea eax, [eax + edi*4 + 8]
mov edx, dword [ebp - 8]
call fcn.004058fc
mov byte [ebp - 9], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x44e39a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44e3bc
lea eax, [ebp - 8]
mov edx, 2
call fcn.004058cc
ret
Function at 0x44e3c8
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x44e4bf
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x58ccf4]
call fcn.00407d10
test eax, eax
jl 0x44e4a9
inc eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], 0
mov eax, dword [ebp - 8]
lea eax, [eax + eax*2]
mov edx, dword [0x58ccf4]
lea ebx, [edx + eax*4]
xor eax, eax
push ebp
push 0x44e493
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebx + 8]
call fcn.00405c3c
mov ecx, eax
mov edx, dword [ebx]
lea eax, [ebp - 4]
call fcn.004059e0
mov eax, dword [ebp - 4]
mov edx, dword [ebx + 8]
call fcn.00405f4c
jne 0x44e489
lea eax, [ebp - 0xc]
push eax
push 0x40
mov eax, dword [ebx + 4]
call fcn.00405c3c
push eax
mov eax, dword [ebx]
push eax
call fcn.00409a78
test eax, eax
je 0x44e489
mov eax, dword [ebx + 4]
call fcn.00405c3c
mov ecx, eax
mov edx, dword [ebx]
mov eax, dword [ebx + 4]
call fcn.004032cc
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebx + 4]
call fcn.00405c3c
push eax
mov eax, dword [ebx]
push eax
call fcn.00409a78
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x44e49d
inc dword [ebp - 8]
dec dword [ebp - 0x10]
jne 0x44e401
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44e4c6
lea eax, [ebp - 4]
call fcn.004058a8
ret
Function at 0x44e7dc
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x44e914
push dword fs:[eax]
mov dword fs:[eax], esp
cmp bl, 0x5c
je 0x44e8f9
mov eax, dword [ebp + 8]
cmp dword [eax - 8], 0
je 0x44e854
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x2c]
mov edx, ebx
mov ecx, 0
call fcn.00405b4c
lea eax, [ebp - 0x2c]
mov edx, 0x44e930
call fcn.00405c70
mov eax, dword [ebp - 0x2c]
call fcn.00405f64
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
call eax
jmp 0x44e8b5
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x30]
mov edx, ebx
mov ecx, 0
call fcn.00405b4c
lea eax, [ebp - 0x30]
mov edx, 0x44e930
call fcn.00405c70
mov eax, dword [ebp - 0x30]
call fcn.00405f64
push eax
call fcn.004096b4
test eax, eax
je 0x44e8b5
mov eax, dword [ebp - 0x24]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0x20]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0x1c]
xor edx, edx
call fcn.00407818
call fcn.00407818
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
push 0x44e940
lea eax, [ebp - 0x38]
mov edx, ebx
mov ecx, 0
call fcn.00405b4c
mov eax, dword [ebp - 0x38]
lea edx, [ebp - 0x34]
call fcn.0040c044
push dword [ebp - 0x34]
push 0x44e950
push dword [ebp - 4]
push dword [ebp - 8]
lea eax, [ebp - 0x3c]
call fcn.0040e2b0
push dword [ebp - 0x3c]
mov eax, esi
mov edx, 4
call fcn.00405db8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44e91b
lea eax, [ebp - 0x3c]
mov edx, 5
call fcn.004058cc
ret
Function at 0x4513b0
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor ebx, ebx
call fcn.0040969c
cmp esi, eax
je 0x4513da
push edi
call fcn.00409a38
mov esi, eax
cmp esi, 0xffffffff
je 0x4513da
push edi
call fcn.004099c8
test esi, esi
setg bl
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x45521c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00405f54
mov eax, dword [ebp - 8]
call fcn.00405f54
xor eax, eax
push ebp
push 0x455345
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [edi], 0
jne 0x455318
mov eax, dword [ebp - 4]
call fcn.00405f64
push eax
call fcn.00409744
xor ecx, ecx
mov edx, dword [ebp - 8]
call fcn.00417574
mov dword [edi], eax
test esi, esi
je 0x45528c
cmp word [esi], 0x25ff
jne 0x45528c
mov eax, esi
add eax, 2
mov eax, dword [eax]
mov ebx, dword [eax]
jmp 0x45528e
xor ebx, ebx
push 0
call fcn.0040973c
cmp eax, dword [0x58bb20]
je 0x4552a6
cmp byte [0x5804a8], 0
je 0x4552bd
lea eax, [ebp - 0x14]
call fcn.00430ddc
mov eax, dword [ebp - 0x14]
mov edx, dword [edi]
mov ecx, dword [ebp + 8]
call fcn.004310ac
jmp 0x4552cc
mov edx, dword [edi]
mov ecx, dword [ebp + 8]
mov eax, dword [0x58bb20]
call fcn.00431014
test ebx, ebx
je 0x4552db
mov eax, esi
add eax, 2
mov eax, dword [eax]
cmp ebx, dword [eax]
je 0x4552df
xor eax, eax
jmp 0x4552e1
mov al, 1
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x45531c
add esi, 2
mov ebx, dword [esi]
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
push ebx
call fcn.00409a78
test eax, eax
je 0x45531c
mov eax, dword [ebp + 8]
mov dword [ebx], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x10]
push eax
push 4
push ebx
call fcn.00409a78
jmp 0x45531c
mov byte [ebp - 9], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45534c
lea eax, [ebp - 0x14]
mov edx, dword [0x430db0]
call fcn.00407ff0
lea eax, [ebp - 8]
mov edx, 2
call fcn.004058cc
ret

Function at 0x45535c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x455431
push dword fs:[eax]
mov dword fs:[eax], esp
test edi, edi
je 0x455415
test esi, esi
je 0x45539d
cmp word [esi], 0x25ff
jne 0x45539d
mov eax, esi
add eax, 2
mov eax, dword [eax]
mov ebx, dword [eax]
jmp 0x45539f
xor ebx, ebx
push 0
call fcn.0040973c
cmp eax, dword [0x58bb20]
je 0x4553b7
cmp byte [0x5804a8], 0
je 0x4553ce
lea eax, [ebp - 0xc]
call fcn.00430ddc
mov eax, dword [ebp - 0xc]
mov ecx, edi
mov edx, dword [ebp - 4]
call fcn.004310ac
jmp 0x4553dd
mov ecx, edi
mov edx, dword [ebp - 4]
mov eax, dword [0x58bb20]
call fcn.00431014
test ebx, ebx
je 0x455415
mov eax, esi
add eax, 2
mov eax, dword [eax]
cmp ebx, dword [eax]
jne 0x455415
add esi, 2
mov ebx, dword [esi]
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push ebx
call fcn.00409a78
test eax, eax
je 0x455415
mov dword [ebx], edi
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 8]
push eax
push 4
push ebx
call fcn.00409a78
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x455438
lea eax, [ebp - 0xc]
mov edx, dword [0x430db0]
call fcn.00407ff0
ret
Function at 0x455bf8
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push ebx
push esi
push edi
mov dword [ebp - 0x44], ecx
mov edi, edx
mov ebx, eax
lea eax, [ebp - 0x40]
mov edx, dword [0x418c0c]
call fcn.00407100
xor eax, eax
push ebp
push 0x455cb8
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x45], 0
lea edx, [ebp - 0x40]
mov eax, ebx
call fcn.0041df14
cmp byte [ebp - 0x40], 0
je 0x455c9c
mov eax, dword [ebp - 0x20]
call fcn.00407d10
test eax, eax
jl 0x455c9c
inc eax
xor esi, esi
mov edx, esi
add edx, edx
add edx, edx
add edx, edx
sub edx, esi
mov ecx, dword [ebp - 0x20]
lea ebx, [ecx + edx*4]
cmp byte [ebx + 0x10], 0
je 0x455c98
cmp edi, dword [ebx + 0xc]
jne 0x455c98
lea eax, [ebp - 0x4c]
push eax
push 0x40
push 4
mov eax, dword [ebx + 0x14]
push eax
call fcn.00409a78
test eax, eax
je 0x455c9c
mov edx, dword [ebp - 0x44]
sub edx, dword [ebx + 8]
mov eax, dword [ebx + 0x14]
mov dword [eax], edx
lea edx, [ebp - 0x4c]
push edx
mov edx, dword [ebp - 0x4c]
push edx
push 4
push eax
call fcn.00409a78
mov byte [ebp - 0x45], 1
jmp 0x455c9c
inc esi
dec eax
jne 0x455c47
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x455cbf
lea eax, [ebp - 0x40]
mov edx, dword [0x418c0c]
call fcn.004071d8
ret

Function at 0x456450
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405f54
lea eax, [ebp - 0xc]
mov edx, dword [0x456330]
call fcn.00407100
xor eax, eax
push ebp
push 0x456502
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x456510
call fcn.00409f80
mov ebx, eax
test ebx, ebx
je 0x4564d6
lea eax, [ebp - 0x10]
push eax
push 0
push ebx
call fcn.0040a148
mov cl, 0x30
mov edx, 1
call fcn.0040da34
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
mov edx, 0x456534
call fcn.00405cec
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00405958
lea eax, [ebp - 0xc]
push eax
push 0x45635c
call fcn.00409f70
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x456509
lea eax, [ebp - 0x10]
call fcn.004058a8
lea eax, [ebp - 0xc]
mov edx, dword [0x456330]
call fcn.004071d8
lea eax, [ebp - 4]
call fcn.004058a8
ret
Function at 0x456570
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x45663e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
call fcn.0040968c
mov cl, 0x30
mov edx, 1
call fcn.0040da34
mov ecx, dword [ebp - 8]
lea eax, [ebp - 4]
mov edx, 0x456658
call fcn.00405cec
mov eax, dword [ebp - 4]
call fcn.00405f64
push eax
push 0
push 4
call fcn.00409970
mov ebx, eax
test ebx, ebx
je 0x456623
push 0
push 0
push 0
push 4
push ebx
call fcn.00409948
mov esi, eax
test esi, esi
je 0x45661d
mov eax, dword [esi + 4]
push eax
call fcn.00409474
mov eax, dword [esi]
push eax
push 0
push 0x100000
call fcn.00409978
mov edi, eax
test edi, edi
je 0x456605
push 0xffffffffffffffff
push edi
call fcn.00409a98
push edi
call fcn.00409474
mov edx, 0x5804dc
lea eax, [esi + 8]
mov ecx, 0x50
call fcn.004032cc
push esi
call fcn.00409a60
push ebx
call fcn.00409474
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x456645
lea eax, [ebp - 8]
mov edx, 2
call fcn.004058cc
ret
Function at 0x456748
Capabilities:
Get file size
Read file via mapping
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffedc
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x124], edx
mov dword [ebp - 0x120], edx
mov dword [ebp - 4], edx
xor edx, edx
push ebp
push 0x4568fa
push dword fs:[edx]
mov dword fs:[edx], esp
xor ebx, ebx
push 0x104
lea edx, [ebp - 0x119]
push edx
push eax
call fcn.0040972c
push 0
push 0
push 3
push 0
push 3
push 0x80000000
lea eax, [ebp - 0x119]
push eax
call fcn.004094b4
mov esi, eax
cmp esi, 0xffffffff
je 0x456859
push 0
push 0
push 0
push 2
push 0
push esi
call fcn.004094c4
mov edi, eax
test edi, edi
je 0x456853
push 0
push 0
push 0
push 4
push edi
call fcn.00409948
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x45684d
mov eax, dword [ebp - 8]
call fcn.004172ac
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x456844
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0x58], 0
je 0x456844
mov eax, dword [ebp - 0xc]
add eax, 0x58
mov dword [ebp - 0x10], eax
push 0
push esi
call fcn.004096e4
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x10]
sub edx, dword [ebp - 8]
xor ecx, ecx
mov eax, dword [ebp - 8]
call fcn.004566ec
mov ecx, eax
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 8]
mov edx, dword [ebp - 0x14]
sub edx, eax
sub edx, 4
mov eax, dword [ebp - 0x10]
add eax, 4
call fcn.004566ec
add eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0xc]
cmp eax, dword [edx + 0x58]
je 0x456844
mov bl, 1
mov eax, dword [ebp - 8]
push eax
call fcn.00409a60
push edi
call fcn.00409474
push esi
call fcn.00409474
test bl, bl
je 0x4568ce
push 0x10
push 0
lea edx, [ebp - 0x120]
mov eax, dword [0x580be0]
mov ecx, dword [eax]
call dword [ecx + 0x248]
mov eax, dword [ebp - 0x120]
call fcn.00405f64
push eax
push 0
call fcn.0040a230
push 0
call fcn.0040973c
cmp eax, dword [0x58bb20]
je 0x4568c7
mov eax, 0x580be0
call fcn.004087cc
lea eax, [ebp - 0x124]
mov edx, dword [ebp - 4]
call fcn.00406964
mov ecx, dword [ebp - 0x124]
mov dl, 1
mov eax, dword [0x40b800]
call fcn.0040b878
call fcn.004050b0
jmp 0x4568ce
push 0
call fcn.0040958c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x456901
lea eax, [ebp - 0x124]
call fcn.00406738
lea eax, [ebp - 0x120]
call fcn.004058a8
lea eax, [ebp - 4]
call fcn.004058a8
ret
Function at 0x456a84
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor edx, edx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x456b91
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
mov ecx, 0x456ba0
mov edx, 0x456bac
mov eax, esi
call fcn.00417918
lea eax, [ebp - 4]
xor edx, edx
call fcn.00405ab8
call fcn.00405c3c
cmp eax, 0x14
jne 0x456b7b
cmp esi, dword [0x58bb20]
sete al
mov edx, dword [ebp - 4]
test byte [edx + 3], 0x80
sete dl
cmp al, dl
jne 0x456b7b
mov eax, esi
call fcn.004172ac
mov ebx, eax
lea eax, [ebp - 8]
push eax
push 0x40
push 0xe0
lea eax, [ebx + 0x18]
push eax
call fcn.00409a78
cmp esi, dword [0x58bb20]
jne 0x456b2f
mov eax, 0x42fd3c
mov edx, dword [ebp - 4]
sub eax, dword [edx]
sub eax, esi
mov dword [ebx + 0x2c], eax
mov eax, 0x580440
mov edx, dword [ebp - 4]
sub eax, dword [edx + 4]
sub eax, esi
mov dword [ebx + 0x30], eax
jmp 0x456b4a
mov eax, dword [ebp - 4]
mov eax, dword [eax]
and eax, 0x7fffffff
mov dword [ebx + 0x2c], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
and eax, 0x7fffffff
mov dword [ebx + 0x30], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov dword [ebx + 0x1c], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov dword [ebx + 0x20], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
mov dword [ebx + 0x24], eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 8]
push eax
push 0xe0
lea eax, [ebx + 0x18]
push eax
call fcn.00409a78
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x456b98
lea eax, [ebp - 4]
call fcn.004058a8
ret
Function at 0x459828
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde0
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x21c], eax
mov dword [ebp - 0x220], eax
mov dword [ebp - 4], eax
lea ebx, [ebp - 8]
xor eax, eax
push ebp
push 0x459aa5
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x580d48], 0
jne 0x459879
push 0x459ab4
push 0x459ae8
call fcn.0040973c
push eax
call fcn.0040976c
mov dword [0x580d48], eax
cmp dword [0x580d4c], 0
jne 0x45989c
push 0x459afc
push 0x459b28
call fcn.00409910
push eax
call fcn.0040976c
mov dword [0x580d4c], eax
cmp dword [0x580d50], 0
jne 0x4598bf
push 0x459b3c
push 0x459b5c
call fcn.0040973c
push eax
call fcn.0040976c
mov dword [0x580d50], eax
xor eax, eax
mov dword [ebx], eax
push ebx
push 0
push 0
push 5
call dword [0x580d48]
xor esi, esi
cmp dword [ebx], 0
jne 0x459911
mov dword [ebx], 0x10000
mov eax, dword [ebx]
add eax, eax
mov dword [ebx], eax
push esi
call fcn.00409930
mov eax, dword [ebx]
push eax
push 0x40
call fcn.00409928
mov esi, eax
push 0
mov eax, dword [ebx]
push eax
push esi
push 5
call dword [0x580d48]
test eax, eax
je 0x459931
cmp dword [ebx], 0x400000
jne 0x4598dd
jmp 0x459931
mov eax, dword [ebx]
add eax, eax
mov dword [ebx], eax
mov eax, dword [ebx]
push eax
push 0x40
call fcn.00409928
mov esi, eax
push 0
mov eax, dword [ebx]
push eax
push esi
push 5
call dword [0x580d48]
test eax, eax
jne 0x459a79
mov ebx, esi
cmp dword [ebx + 0x3c], 0
je 0x459a57
lea eax, [ebp - 4]
mov edx, dword [ebx + 0x3c]
call fcn.004068f4
cmp dword [0x580d4c], 0
je 0x459a42
mov eax, dword [ebx + 0x44]
push eax
push 0
push 0x410
call fcn.00409978
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x459a42
push 0x104
lea eax, [ebp - 0x216]
push eax
push 0
mov eax, dword [ebp - 0xc]
push eax
call dword [0x580d4c]
test eax, eax
jbe 0x459a39
lea eax, [ebp - 4]
lea edx, [ebp - 0x216]
mov ecx, 0x105
call fcn.00406948
mov edx, dword [ebp - 4]
mov eax, 0x459b80
call fcn.0040d080
test al, al
je 0x459a16
push 0x104
lea eax, [ebp - 0x216]
push eax
call fcn.004097e8
lea eax, [ebp - 0x21c]
push eax
mov ecx, 0x7fffffff
mov edx, 0x15
mov eax, dword [ebp - 4]
call fcn.00406d9c
mov eax, dword [ebp - 0x21c]
push eax
lea eax, [ebp - 0x220]
lea edx, [ebp - 0x216]
mov ecx, 0x105
call fcn.00406948
mov edx, dword [ebp - 0x220]
lea eax, [ebp - 4]
pop ecx
call fcn.00406b1c
jmp 0x459a39
mov edx, dword [ebp - 4]
mov eax, 0x459bb8
call fcn.0040cdec
test al, al
je 0x459a39
lea eax, [ebp - 4]
mov ecx, 4
mov edx, 1
call fcn.00406e6c
mov eax, dword [ebp - 0xc]
push eax
call fcn.00409474
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebx + 0x50]
mov edx, dword [ebx + 0x44]
mov eax, dword [ebp - 4]
call fcn.0045947c
pop ecx
jmp 0x459a6c
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebx + 0x50]
mov edx, dword [ebx + 0x44]
mov eax, 0x459bd0
call fcn.0045947c
pop ecx
mov edi, dword [ebx]
test edi, edi
je 0x459a79
add ebx, edi
jmp 0x45993b
push esi
call fcn.00409930
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x459aac
lea eax, [ebp - 0x220]
mov edx, 2
call fcn.00406740
lea eax, [ebp - 4]
call fcn.00406738
ret
Function at 0x45abc8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
mov esi, 0x58cd0c
push 0xa
push 0x45ac5c
mov eax, dword [0x58bb20]
push eax
call fcn.004095e4
mov ebx, eax
test ebx, ebx
jne 0x45abec
call fcn.00465ef8
push ebx
mov eax, dword [0x58bb20]
push eax
call fcn.00409920
mov ebx, eax
test ebx, ebx
jne 0x45ac03
call fcn.00465ef8
push ebx
call fcn.00409940
mov dword [esi], eax
cmp dword [esi], 0
jne 0x45ac15
call fcn.00465ef8
mov eax, dword [esi]
mov edx, dword [esi]
mov ecx, edx
add ecx, dword [eax]
mov dword [0x58cd10], ecx
mov ecx, edx
add ecx, dword [eax + 4]
mov dword [0x58cd14], ecx
mov ecx, edx
add ecx, dword [eax + 8]
mov dword [0x58cd18], ecx
mov ecx, edx
add ecx, dword [eax + 0xc]
mov dword [0x58cd1c], ecx
mov ecx, edx
add ecx, dword [eax + 0x10]
mov dword [0x58cd20], ecx
add edx, dword [eax + 0x14]
mov dword [0x58cd24], edx
pop esi
pop ebx
ret

Function at 0x45c6c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x45c769
test eax, edx
je 0x45c76c
push 0
push 0
cmp word [eax - 0xa], 2
je 0x45c6e9
push edx
mov edx, eax
mov eax, esp
call fcn.00406964
pop edx
mov eax, dword [esp]
cmp word [edx - 0xa], 2
je 0x45c6ff
push eax
lea eax, [esp + 8]
call fcn.00406964
pop eax
mov edx, dword [esp + 4]
movzx ecx, word [edx]
cmp cx, word [eax]
je 0x45c70e
movzx eax, word [eax]
sub eax, ecx
jmp 0x45c735
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
shl ecx, 1
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x45c74f
add ecx, 4
js 0x45c726
pop eax
pop ebx
mov ecx, esp
mov edx, dword [ecx]
or edx, dword [ecx + 4]
je 0x45c74c
push eax
mov eax, ecx
mov edx, 2
call fcn.004058cc
pop eax
pop edx
pop edx
ret
bsf ebx, ebx
shr ebx, 4
add ebx, ebx
add ecx, ebx
jns 0x45c733
movzx eax, word [ecx + eax]
movzx edx, word [ecx + edx]
sub eax, edx
pop ebx
pop ebx
jmp 0x45c735
xor eax, eax
ret
test eax, eax
je 0x45c77c
test edx, edx
jne 0x45c6d0
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x45d964
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
mov esi, eax
mov eax, esi
call fcn.004067d4
push eax
call fcn.004096cc
cmp eax, 0xffffffff
je 0x45d982
test al, 0x10
sete al
pop esi
pop ebx
ret
call fcn.004096fc
mov ebx, eax
cmp ebx, 2
je 0x45d9a3
cmp ebx, 3
je 0x45d9a3
cmp ebx, 0x7b
je 0x45d9a3
mov eax, esi
call fcn.0045d924
test al, al
jne 0x45d9a7
xor eax, eax
jmp 0x45d9a9
mov al, 1
pop esi
pop ebx
ret

Function at 0x45d9ac
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.004067d4
push eax
call fcn.004096cc
cmp eax, 0xffffffff
je 0x45d9c5
test al, 0x10
jne 0x45d9c9
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret