joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402260
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
movzx eax, word [ebp + 8]
mov dword [ebp + 8], eax
pop ebp
jmp fcn.0040ea91

Function at 0x4027e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov eax, edi
shr eax, 4
inc eax
push 6
movzx eax, ax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp + 0xc], eax
test eax, eax
jne 0x402809
pop edi
pop ebx
pop ebp
ret
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x40281f
xor esi, esi
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x402816
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [esi + eax]
and edi, 0xf
jbe 0x402852
nop
cmp esi, ecx
jae 0x402816
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edi, 1
jne 0x402840
cmp esi, ecx
jae 0x402816
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x402a90
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
mov edi, dword [ebp + 0xc]
mov eax, edi
shr eax, 4
inc eax
push 6
movzx eax, ax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp + 0xc], eax
test eax, eax
je 0x402b6d
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x402b6d
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x402b6d
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [esi + eax]
and edi, 0xf
jbe 0x402b03
cmp esi, ecx
jae 0x402b6d
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edi, 1
jne 0x402af1
cmp esi, ecx
jae 0x402b6d
movzx eax, word [esi]
test ax, ax
je 0x402b6d
mov edx, dword [ebx]
mov edi, eax
mov dword [ebp + 8], eax
mov ecx, 1
mov eax, dword [edx - 8]
sub ecx, dword [edx - 4]
sub eax, edi
or ecx, eax
jge 0x402b36
push edi
mov ecx, ebx
call fcn.00402930
mov edx, dword [ebx]
movzx eax, word [esi]
jmp 0x402b39
mov eax, dword [ebp + 8]
movzx ecx, ax
lea eax, [esi + 2]
push ecx
push eax
push edi
push edx
call fcn.00558f29
push eax
call fcn.004029d0
mov ecx, dword [ebx]
add esp, 0x14
cmp edi, dword [ecx - 8]
jg 0x402b76
mov dword [ecx - 0xc], edi
xor edx, edx
mov ecx, dword [ebx]
lea eax, [edx + 1]
mov word [ecx + edi*2], dx
pop edi
pop esi
pop ebx
pop ebp
ret 8
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 8
push 0x80070057
call fcn.00402d40
int3
Function at 0x402b90
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov edi, dword [ebp + 8]
push edi
mov dword [ebp - 4], ecx
call fcn.0040b1e3
mov ebx, eax
test ebx, ebx
jne 0x402bb0
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, edi
shr eax, 4
push esi
inc eax
push 6
movzx eax, ax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp + 8], eax
test eax, eax
je 0x402c83
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x402c83
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x402c83
push dword [ebp + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [esi + eax]
and edi, 0xf
jbe 0x402c14
cmp esi, ecx
jae 0x402c83
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edi, 1
jne 0x402c02
cmp esi, ecx
jae 0x402c83
movzx eax, word [esi]
test ax, ax
je 0x402c83
mov ebx, dword [ebp - 4]
mov edi, eax
mov dword [ebp + 8], eax
mov ecx, 1
mov edx, dword [ebx]
mov eax, dword [edx - 8]
sub ecx, dword [edx - 4]
sub eax, edi
or ecx, eax
jge 0x402c4a
push edi
mov ecx, ebx
call fcn.00402930
mov edx, dword [ebx]
movzx eax, word [esi]
jmp 0x402c4d
mov eax, dword [ebp + 8]
movzx ecx, ax
lea eax, [esi + 2]
push ecx
push eax
push edi
push edx
call fcn.00558f29
push eax
call fcn.004029d0
mov eax, dword [ebx]
add esp, 0x14
cmp edi, dword [eax - 8]
jg 0x402c8e
mov dword [eax - 0xc], edi
xor ecx, ecx
mov eax, dword [ebx]
pop esi
mov word [eax + edi*2], cx
lea eax, [ecx + 1]
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop esi
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.00402d40
int3

Function at 0x40ab1a
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
push edi
cmp dword [ecx + 0x58], esi
je 0x40ab6d
push esi
push dword [ebp + 8]
call fcn.0040ad03
mov edi, eax
test edi, edi
je 0x40ab68
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp + 0xc]
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x40ab68
mov eax, dword [ebp - 8]
jmp 0x40ab7f
mov eax, dword [ebp + 0x10]
jmp 0x40ab7f
push dword [ecx + 0x6c]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
pop edi
pop esi
leave
ret 0xc
Function at 0x40c1ac
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor esi, esi
mov eax, ecx
push edi
mov edi, esi
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], esi
je 0x40c1f6
call fcn.004242fd
push 0xf0
push dword [ebp + 0xc]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x40c1f3
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x40c246
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
mov eax, dword [ebp - 4]
xor ebx, ebx
inc ebx
test esi, esi
je 0x40c223
mov ecx, dword [eax]
push dword [ebp + 0x10]
push esi
mov esi, dword [ecx + 0x20]
mov ecx, esi
push dword [ebp + 8]
call dword [0x580a18]
mov ecx, dword [ebp - 4]
call esi
mov ebx, eax
test edi, edi
je 0x40c223
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp + 8]
mov edi, dword [eax + 0x70]
test edi, edi
je 0x40c244
mov eax, dword [edi]
push dword [ebp + 0x10]
mov esi, dword [eax + 0xa0]
mov ecx, esi
call dword [0x580a18]
mov ecx, edi
call esi
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x40dc7a
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x571c82
call fcn.005540f6
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x74], ebx
jne 0x40dca0
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x40dd00
call fcn.0040a721
push eax
lea ecx, [ebp - 0x10]
call fcn.00402cc0
mov edi, dword [edi + 0x74]
lea ecx, [ebp - 0x10]
push ecx
mov dword [ebp - 4], ebx
mov eax, dword [edi]
mov esi, dword [eax + 0x8c]
mov ecx, esi
call dword [0x580a18]
mov ecx, edi
call esi
mov esi, dword [ebp + 8]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push esi
call fcn.0055addb
push eax
call fcn.004029d0
add esp, 0x14
test esi, esi
je 0x40dcf3
push esi
call fcn.00558fd9
pop ecx
mov ebx, eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00402e00
mov eax, ebx
call fcn.005540bf
ret 8

Function at 0x40eaf6
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor esi, esi
call fcn.004242fd
push 5
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x40eb2d
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
mov ecx, dword [ebp - 4]
push ebx
push dword [ebp + 0xc]
push esi
call fcn.0040eb4c
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8
Function at 0x4146ec
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 4], ecx
mov esi, edi
cmp dword [ebp + 8], esi
je 0x414731
call fcn.004242fd
push 0xf0
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x414731
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x41474d
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.0043b5f3
mov ebx, eax
test edi, edi
je 0x41474b
test esi, esi
je 0x41474b
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x4154f2
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
je 0x4155b0
cmp dword [esi + 0x20], 0
je 0x4155b0
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4155b0
cmp dword [ebp + 8], 0
je 0x4155b0
xor eax, eax
mov ebx, eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], ebx
mov edi, eax
call fcn.004242fd
push 0x5831c0
push dword [ebp + 8]
mov eax, dword [eax + 0xc]
push eax
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x415581
mov edi, dword [ebp - 0xc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp - 0x10]
mov dword [ebp - 4], eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x4155b0
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov dword [ebp - 8], eax
push dword [ebp - 4]
push ebx
push esi
call fcn.00453a90
add esp, 0xc
mov ebx, eax
cmp dword [ebp - 8], 0
je 0x4155a1
test edi, edi
je 0x4155a1
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
test ebx, ebx
je 0x4155ac
mov ecx, esi
call fcn.00415294
mov eax, ebx
jmp 0x4155b2
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x419dd6
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
call fcn.0055b48e
pop ecx
test eax, eax
jne 0x419e18
push dword [ebp - 4]
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0x583378
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.0040b142
add esp, 0x18
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x419dde
leave
ret
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
leave
ret
Function at 0x42544b
Capabilities:
Query or enumerate registry value

Disassembly:
push 8
mov eax, 0x571cf8
call fcn.005540f6
push dword [ebp + 0xc]
lea ecx, [ebp - 0x10]
call fcn.00406070
and dword [ebp - 4], 0
mov esi, dword [ebp + 8]
cmp esi, 0x80000000
jne 0x4254a9
call fcn.0042434b
cmp eax, 1
jne 0x4254a9
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push str.SoftwareClasses_
push eax
call fcn.0040ce64
add esp, 0xc
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.00406260
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.00402e00
inc esi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp - 0x10]
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
mov ecx, dword [ebp - 0x10]
mov esi, eax
add ecx, 0xfffffff0
call fcn.00402e00
mov eax, esi
call fcn.005540bf
ret 0x10

Function at 0x4254d0
Capabilities:
Set registry value

Disassembly:
push 8
mov eax, 0x571cf8
call fcn.005540f6
push dword [ebp + 0xc]
lea ecx, [ebp - 0x10]
call fcn.00406070
and dword [ebp - 4], 0
mov esi, dword [ebp + 8]
cmp esi, 0x80000000
jne 0x42552e
call fcn.0042434b
cmp eax, 1
jne 0x42552e
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push str.SoftwareClasses_
push eax
call fcn.0040ce64
add esp, 0xc
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.00406260
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.00402e00
inc esi
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp - 0x10]
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueW]
mov ecx, dword [ebp - 0x10]
mov esi, eax
add ecx, 0xfffffff0
call fcn.00402e00
mov eax, esi
call fcn.005540bf
ret 0x14

Function at 0x4388d4
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp dword [esi], ebx
je 0x43891b
push 0x582760
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x43892a
push str.MoveFileTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x43892a
push dword [esi]
mov ecx, edi
push 2
push ebx
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [0x580a18]
call edi
jmp 0x43892c
cmp dword [esi + 4], ebx
je 0x43892a
pop edi
pop esi
pop ebx
pop ebp
jmp dword [sym.imp.KERNEL32.dll_MoveFileW]
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x4554ef
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
mov dword [ebp - 4], ebx
test byte [esi + 4], 1
mov edi, dword [esi + 0xc]
jne 0x455545
push 5
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x45551e
call fcn.0040ffb0
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x455533
call fcn.0040ffb0
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x455545
call fcn.0040ffb0
call fcn.004242fd
cmp dword [eax + 0x3c], 0
je 0x45555a
push edi
mov ecx, ebx
call fcn.00454c1f
mov edi, eax
push dword [ebp + 0xc]
push edi
call fcn.0045572c
mov ebx, eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x88]
test ecx, ecx
je 0x455583
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 4]
and dword [eax + 0x88], 0
test ebx, ebx
je 0x45558f
mov edi, ebx
mov dword [eax + 0x88], ebx
or dword [esi + 4], 1
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x45bb58
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
mov ecx, dword [edi + 4]
call fcn.0040d85b
push 0xfffffffffffffff0
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
push dword [ebp + 0xc]
mov esi, eax
mov ecx, edi
and esi, 3
call fcn.0045bd71
cmp esi, 3
je 0x45bb96
mov dword [edi + 0xc], 1
cmp dword [edi], 0
je 0x45bbdf
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov esi, dword [ebp + 0x10]
test eax, eax
jle 0x45bbb9
lea ecx, [eax + 1]
push ecx
push eax
mov ecx, esi
call fcn.0040b255
jmp 0x45bbca
push 0xff
mov ecx, esi
call fcn.00402990
push 0x100
push eax
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0xffffffffffffffff
mov ecx, esi
call fcn.0040ae46
jmp 0x45bc03
mov esi, dword [ebp + 0x10]
push dword [esi]
push 0xffffffffffffffff
push 0x14d
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
jne 0x45bc03
push dword [esi]
push dword [ebp - 4]
call fcn.00428173
pop edi
pop esi
leave
ret 0xc

Function at 0x45bcc8
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
push edi
push dword [ebp + 0xc]
call fcn.0045bd71
cmp dword [esi], 0
mov edi, eax
mov dword [esi + 0xc], 1
je 0x45bd10
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.0040b255
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.0040ae46
jmp 0x45bd1b
mov eax, dword [ebp + 0x10]
push dword [eax]
push edi
call fcn.00428173
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x493055
Capabilities:
Get file system object information

Disassembly:
push 0x4cc
mov eax, 0x57866f
call fcn.0055412a
mov ebx, ecx
mov eax, dword [ebx + 0x14]
sub eax, 0x10
push eax
call fcn.00406330
pop ecx
lea esi, [eax + 0x10]
mov dword [ebp - 0x4d0], esi
and dword [ebp - 4], 0
lea ecx, [ebp - 0x4d0]
push 0
push 0x581a74
call fcn.00408d2c
cmp eax, 0xffffffff
jne 0x49312f
push 0
push 0x592fd0
lea ecx, [ebp - 0x4d0]
call fcn.00408d2c
cmp eax, 0xffffffff
jne 0x49312f
push 0
push 0x58167c
lea ecx, [ebp - 0x4d0]
call fcn.00408d2c
cmp eax, 0xffffffff
jne 0x49312f
mov eax, dword [ebx + 0x14]
sub eax, 0x10
push eax
call fcn.00406330
mov edi, eax
pop ecx
mov dword [ebp - 0x4d4], edi
lea ecx, [edi + 0x10]
mov dword [ebp - 0x4d8], ecx
xor edx, edx
mov byte [ebp - 4], 1
push edx
lea eax, [ebp - 0x218]
push eax
push 0x104
push edx
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_SearchPathW]
test eax, eax
jne 0x4930fe
mov eax, dword [ebx]
mov edi, dword [eax + 0x14]
mov ecx, edi
call dword [0x580a18]
mov ecx, ebx
call edi
mov ecx, dword [ebp - 0x4d4]
mov edi, eax
call fcn.00402e00
jmp 0x493168
lea eax, [ebp - 0x218]
push eax
call fcn.00558fd9
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x4d0]
call fcn.00406180
mov ecx, edi
mov byte [ebp - 4], 0
call fcn.00402e00
mov esi, dword [ebp - 0x4d0]
push 0x105
push 0x2b4
lea eax, [ebp - 0x4cc]
push eax
push 0
push esi
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x493155
mov edi, dword [ebp - 0x4cc]
jmp 0x493168
mov eax, dword [ebx]
mov edi, dword [eax + 0x14]
mov ecx, edi
call dword [0x580a18]
mov ecx, ebx
call edi
mov edi, eax
lea ecx, [esi - 0x10]
call fcn.00402e00
mov eax, edi
call fcn.005540d4
ret

Function at 0x497ae5
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
push edi
test esi, esi
jne 0x497aff
call fcn.004242fd
mov esi, dword [eax + 0xc]
push 0x5934ac
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x497b55
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x497b55
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
test eax, eax
jne 0x497b34
xor esi, esi
jmp 0x497b4a
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 8]
push eax
push dword [ebp - 4]
call fcn.00497b5e
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
jmp 0x497b57
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x4e9b7a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.004e9751
push eax
push esi
push dword [ebp + 8]
call fcn.004e9706
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.004e9741
cmpsd dword [esi], dword es:[edi]
cmp al, 0xb4
mov al, 0x88
popfd
jl 0x4e9bc6
invalid
invalid

Function at 0x4e9faa
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, 0x56fffffc
mov byte [ebp - 0x347], 0x56
mov byte [ebp - 0x346], 0x6d
mov byte [ebp - 0x345], 0x40
mov byte [ebp - 0x344], 0x44
mov byte [ebp - 0x343], 0x55
mov byte [ebp - 0x342], 0x25
lea eax, [ebp - 0x354]
push eax
call fcn.004e9751
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.004e9706
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
mov byte [ebp - 0x3af], 0x27
mov byte [ebp - 0x3ae], 0x66
lea eax, [ebp - 0x3c4]
push eax
call fcn.004e9751
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.004e9706
add esp, 0xc
mov dword [ebp - 0x538], eax
and byte [ebp - 0x3ec], 0
and byte [ebp - 0x3eb], 0
mov byte [ebp - 0x3ea], 0x11
and byte [ebp - 0x3e9], 0
mov byte [ebp - 0x3e8], 0xa9
mov byte [ebp - 0x3e7], 0x8b
mov byte [ebp - 0x3e6], 0x9a
mov byte [ebp - 0x3e5], 0xa3
mov byte [ebp - 0x3e4], 0x81
mov byte [ebp - 0x3e3], 0x8a
mov byte [ebp - 0x3e2], 0x9b
mov byte [ebp - 0x3e1], 0x82
mov byte [ebp - 0x3e0], 0x8b
mov byte [ebp - 0x3df], 0xa6
mov byte [ebp - 0x3de], 0x8f
mov byte [ebp - 0x3dd], 0x80
mov byte [ebp - 0x3dc], 0x8a
mov byte [ebp - 0x3db], 0x82
mov byte [ebp - 0x3da], 0x8b
mov byte [ebp - 0x3d9], 0xaf
mov byte [ebp - 0x3d8], 0xee
lea eax, [ebp - 0x3ec]
push eax
call fcn.004e9751
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.004e9706
add esp, 0xc
mov dword [ebp - 0x340], eax
call fcn.004e9741
int3
Function at 0x4ea5fb
Capabilities:
Contain obfuscated stackstrings

Disassembly:
xchg ecx, eax
cmp al, 0x24
or byte [eax - 0x22f5b], al
inc dword [eax]
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x22f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x12c], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x12b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x654], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x653]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.004e971f
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
invalid
invalid
sahf