joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4eae30
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x603808
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x6b000c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x18], ebx
xor edi, edi
call fcn.0040bf10
mov ecx, eax
test ecx, ecx
je 0x4eaf92
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 1
lea eax, [ebp - 0x14]
push dword [ebx + 4]
push str..PhysicalDrive_d
push eax
call fcn.0040d300
mov esi, dword [ebp - 0x14]
add esp, 0xc
push edi
push edi
push 3
push edi
push 3
push SysReAllocString
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x10], eax
cmp eax, 0xffffffff
je 0x4eaf5d
push dword [ebp + 0xc]
mov ebx, dword [ebx + 0x48]
push dword [ebp + 8]
push edi
push ebx
call fcn.005dd6d0
imul ebx, dword [ebp + 0x10]
mov ecx, edx
mov dword [ebp + 0xc], eax
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], ecx
mov eax, dword [eax + 0x64]
test eax, eax
je 0x4eaef8
mov ecx, dword [eax + 0x18]
mov eax, dword [eax + 0x1c]
sub ecx, edx
sbb eax, dword [ebp - 0x1c]
js 0x4eaf54
jg 0x4eaef8
cmp ecx, ebx
jb 0x4eaf54
push 0
lea eax, [ebp - 0x20]
push eax
push edx
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x4eaf54
push ebx
call fcn.00560596
mov edi, eax
add esp, 4
test edi, edi
je 0x4eaf54
push ebx
push 0
push edi
call fcn.00588800
add esp, 0xc
mov dword [ebp + 0x10], 0
lea eax, [ebp + 0x10]
push 0
push eax
push ebx
push edi
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4eaf49
cmp dword [ebp + 0x10], ebx
je 0x4eaf54
push edi
call fcn.00560591
add esp, 4
xor edi, edi
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4eaf7c
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 0x80004005
call fcn.0040b250
int3

Function at 0x4ec8a0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp dword [esi + 0x68], 0
je 0x4ec8fe
push 0
mov dword [esi + 0x74], 0
call fcn.005b9077
add esp, 4
mov dword [esi + 0xa0], eax
mov dword [esi + 0xa4], edx
mov dword [esi + 0x80], 0
push 0
push 1
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x70], eax
lea eax, [ebp - 4]
push eax
push 0
push esi
push 0x4ec910
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x6c], eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4f76c0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6050ea
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x6b000c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x14], edi
mov ecx, dword [ecx]
sub ecx, 0x10
call fcn.0040c950
add eax, 0x10
mov dword [edi], eax
mov dword [ebp - 4], 1
lea ebx, [edi + 4]
mov dword [ebp - 0x14], ebx
lea esi, [ebx + 4]
mov dword [ebp - 0x18], esi
call fcn.0040bf10
mov ecx, eax
test ecx, ecx
je 0x4f77e5
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov byte [ebp - 4], 3
lea esi, [ebx + 0x10]
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov dword [ebp - 0x18], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0048c370
mov dword [esi], eax
mov byte [ebp - 4], 6
lea esi, [ebx + 0x24]
mov dword [ebp - 0x18], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0048baa0
mov dword [esi], eax
mov byte [ebp - 4], 9
mov dword [ebx + 0x2c], 0
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x34], 0
mov dword [ebx + 0x38], 0
mov byte [ebp - 4], 0xa
lea esi, [ebx + 0x3c]
mov dword [ebp - 0x18], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0048bfe0
mov dword [esi], eax
mov byte [ebp - 4], 0xd
mov ecx, ebx
mov eax, dword [ebp + 8]
add eax, 4
push eax
call fcn.004f4390
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.0040b250
int3
Function at 0x501eb0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x607021
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x6b000c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], 0
cmp dword [ebx + 0x12ac], 1
jne 0x501f41
mov eax, dword [ebx + 0x920]
test eax, eax
je 0x501f58
add eax, 0x1c
lea ecx, [ebp - 0x14]
push eax
call fcn.0040c2f0
mov dword [ebp - 4], 0
mov ecx, ebx
mov eax, dword [ebx + 0x920]
push dword [eax + 0x18]
push dword [eax + 0x14]
push dword [ebp - 0x14]
call fcn.004ffae0
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
mov edx, dword [ebp - 0x14]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x501f58
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x501f58
mov eax, dword [ebx + 0x12a0]
test eax, eax
je 0x501f58
push dword [eax + 0x14]
push dword [eax + 0x10]
push dword [eax]
call fcn.004ffae0
mov esi, dword [sym.imp.ycomuiu.dll_public:_class_DuiLib::CControlUI____thiscall_DuiLib::CPaintManagerUI::FindControl_wchar_t_const__const]
lea ecx, [ebx + 0x34]
push str.initGif
call esi
push str.viewGif
lea ecx, [ebx + 0x34]
mov dword [ebx + 0x9c0], eax
call esi
push 0x650a3c
mov edx, str.PreviewHint
mov dword [ebx + 0x9c4], eax
lea ecx, [ebp - 0x18]
call fcn.004db870
mov dword [ebp - 4], 3
lea ecx, [ebp - 0x14]
mov edx, dword [0x6b9640]
push str.cd.dat
call fcn.0048e450
add esp, 8
mov dword [ebp - 0x10], 1
push dword [eax]
push 1
push str.PreviewBrokenHint
push str.Other
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, 1
mov edi, eax
mov dword [ebp - 0x10], ecx
and ecx, 0xfffffffe
mov dword [ebp - 0x10], ecx
mov byte [ebp - 4], 2
or esi, 0xffffffff
mov edx, dword [ebp - 0x14]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x501ff9
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test edi, edi
jne 0x502013
mov eax, dword [ebp - 0x18]
cmp dword [eax - 0xc], edi
je 0x502013
push eax
push str.BrokenHint
mov ecx, ebx
call dword [sym.imp.ycomuiu.dll_public:_int___thiscall_DuiLib::WindowImplBase::SetDlgItemTextW_wchar_t_const___wchar_t_const__]
mov ecx, dword [ebx + 0x9c0]
push 0
mov eax, dword [ecx]
call dword [eax + pe_nt_image_headers32]
push 0
push 0
push 0x41e
mov ecx, ebx
call dword [sym.imp.ycomuiu.dll_public:_long_int___thiscall_DuiLib::CWindowWnd::PostMessageW_unsigned_int__unsigned_int__long_int_]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x18]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x502053
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x503780
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, ecx
push esi
push edi
mov eax, dword [ebx]
call dword [eax + 0x24]
mov ecx, eax
call dword [sym.imp.ycomuiu.dll_public:_class_DuiLib::CDPI____thiscall_DuiLib::CPaintManagerUI::GetDPIObj_void_]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x5037b4
cmp dword [0x6b8f7c], 0
je 0x5037b4
lea ecx, [ebp + 0x10]
push ecx
mov ecx, eax
call dword [sym.imp.ycomuiu.dll_public:_void___thiscall_DuiLib::CDPI::ScaleBack_struct_tagRECT__]
mov eax, dword [ebx + 0x710]
mov ecx, dword [eax + 0x904]
call fcn.004feb10
mov esi, eax
mov dword [ebp - 0x10], esi
test esi, esi
je 0x5038ef
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push dword [esi + 4]
call dword [sym.imp.gdiplus.dll_GdipGetImageWidth]
test eax, eax
je 0x5037ed
mov dword [esi + 8], eax
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push dword [esi + 4]
call dword [sym.imp.gdiplus.dll_GdipGetImageHeight]
test eax, eax
je 0x503808
mov dword [esi + 8], eax
mov ecx, dword [ebp - 8]
test ecx, ecx
jle 0x5038ef
mov edx, dword [ebp - 4]
test edx, edx
jle 0x5038ef
mov eax, dword [ebp + 0x18]
sub eax, dword [ebp + 0x10]
cmp edx, eax
jg 0x50386f
mov edi, dword [ebp + 0x1c]
sub edi, dword [ebp + 0x14]
cmp ecx, edi
jg 0x50386f
mov ecx, dword [ebp - 0xc]
test ecx, ecx
je 0x503859
cmp dword [0x6b8f7c], 0
je 0x503859
mov esi, dword [sym.imp.ycomuiu.dll_public:_int___thiscall_DuiLib::CDPI::Scale_int_]
push eax
call esi
mov ecx, dword [ebp - 0xc]
push edi
mov dword [ebp - 4], eax
call esi
mov edi, eax
mov eax, dword [ebp - 4]
push ecx
mov ecx, dword [ebx + 0x710]
push edi
push eax
add ecx, 0x950
call fcn.004fe6c0
jmp 0x50389c
mov edi, dword [ebx + 0x710]
mov ecx, edi
mov esi, dword [sym.imp.ycomuiu.dll_public:_void___thiscall_DuiLib::WindowImplBase::ShowWindow_wchar_t_const___bool_]
push 1
push str.picSize
call esi
push 1
push str.btnBestFit
mov ecx, edi
call esi
push 1
push str.btnActualSize
mov ecx, edi
call esi
mov ecx, dword [ebx + 0x710]
push 0
push 0
push 0x431
call dword [sym.imp.ycomuiu.dll_public:_struct_HWND______thiscall_DuiLib::CWindowWnd::operator_struct_HWND____void_const]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebx + 0x710]
push 5
push dword [ecx + 0x950]
call dword [sym.imp.USER32.dll_ShowWindow]
push ecx
mov ecx, dword [ebx + 0x710]
push dword [ebp - 0x10]
add ecx, 0x94c
call fcn.00535d90
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x5047b0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6074c0
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x6b000c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [0x6b9760]
mov edi, dword [sym.imp.ycomuiu.dll_public:_void___thiscall_DuiLib::WindowImplBase::SetControlBkImage_wchar_t_const___wchar_t_const__]
cmp dword [eax - 0xc], 0
je 0x5047f1
push eax
push str.DlgFrame
call edi
mov eax, dword [0x6b9764]
test eax, eax
je 0x504808
push eax
push str.DlgFrameBottom
mov ecx, esi
call dword [sym.imp.ycomuiu.dll_public:_void___thiscall_DuiLib::WindowImplBase::SetControlBKColor_wchar_t_const___unsigned_long_int_]
mov eax, dword [esi + 0x910]
test eax, eax
je 0x50481e
cmp eax, 1
je 0x50481e
push 0x65c21c
jmp 0x504823
push 0x65c254
push str.logo_pay
mov ecx, esi
call edi
push str.tabQRCode
lea ecx, [esi + 0x34]
call dword [sym.imp.ycomuiu.dll_public:_class_DuiLib::CControlUI____thiscall_DuiLib::CPaintManagerUI::FindControl_wchar_t_const__const]
mov edi, dword [sym.imp.ycomuiu.dll_public:_bool___thiscall_DuiLib::CTabLayoutUI::SelectItem_int_]
test eax, eax
je 0x50484a
push 0
mov ecx, eax
call edi
cmp dword [esi + 0x90c], 0
je 0x50485c
mov ecx, esi
call fcn.00505300
jmp 0x5048c0
mov eax, dword [esi + 0x900]
test eax, eax
je 0x504889
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x5048e9
push dword [esi + 0x900]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x900], 0
mov eax, dword [sym.imp.ycomuiu.dll_public:_class_DuiLib::CControlUI____thiscall_DuiLib::CPaintManagerUI::FindControl_wchar_t_const__const]
lea ecx, [esi + 0x34]
push str.tabQRCode
call eax
test eax, eax
je 0x5048a2
push 0
mov ecx, eax
call edi
lea eax, [ebp - 0x10]
push eax
push 0
push esi
push 0x504b00
push 0
push 0
call fcn.005b6ff3
add esp, 0x18
mov dword [esi + 0x900], eax
push 0
push 0x6ddd00
push 0xe2
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetTimer]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [sym.imp.ycomuiu.dll_public:_class_DuiLib::CControlUI____thiscall_DuiLib::CPaintManagerUI::FindControl_wchar_t_const__const]
lea ecx, [esi + 0x34]
push str.tabQRCode
call eax
test eax, eax
je 0x504902
push 2
mov ecx, eax
call edi
push 0x650a3c
mov edx, 0x65c1f0
lea ecx, [ebp - 0x10]
call fcn.004db870
add esp, 4
mov dword [ebp - 4], 0
mov ecx, esi
push dword [eax]
push str.QRTitle
call dword [sym.imp.ycomuiu.dll_public:_int___thiscall_DuiLib::WindowImplBase::SetDlgItemTextW_wchar_t_const___wchar_t_const__]
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
mov edx, dword [ebp - 0x10]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x5048c0
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x5048c0
Function at 0x507e10
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x607e80
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x6b000c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ecx, dword [edi + 0x910]
test ecx, ecx
js 0x507f6b
cmp ecx, dword [edi + 0x928]
jge 0x507f6b
mov eax, dword [edi + 0x924]
cmp dword [eax + ecx*4], 0
je 0x507e75
mov ecx, edi
call fcn.00508080
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0x944]
test eax, eax
je 0x507ea2
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x507eed
push dword [edi + 0x944]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 0x944], 0
mov esi, dword [sym.imp.ycomuiu.dll_public:_void___thiscall_DuiLib::WindowImplBase::ShowWindow_wchar_t_const___bool_]
mov ecx, edi
push 0
push str.QRFailed
call esi
push 0
push str.QRImage
mov ecx, edi
call esi
lea eax, [ebp - 0x10]
push eax
push 0
push edi
push 0x506f00
push 0
push 0
call fcn.005b6ff3
add esp, 0x18
mov dword [edi + 0x944], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.ycomuiu.dll_public:_void___thiscall_DuiLib::WindowImplBase::ShowWindow_wchar_t_const___bool_]
mov ecx, edi
push 1
push str.QRFailed
call esi
push 1
push str.btnRefreshQR
mov ecx, edi
call esi
push 0x650a3c
mov edx, 0x65c1f0
lea ecx, [ebp - 0x10]
call fcn.004db870
add esp, 4
mov dword [ebp - 4], 0
mov ecx, edi
push dword [eax]
push str.QRTitle
call dword [sym.imp.ycomuiu.dll_public:_int___thiscall_DuiLib::WindowImplBase::SetDlgItemTextW_wchar_t_const___wchar_t_const__]
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
mov edx, dword [ebp - 0x10]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x507e64
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 1
push 0xc000008c
call fcn.0040b220
int3
Function at 0x5086a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60802d
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x6b000c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.CQRPayNewDlg.4.0
mov dword [esi + 0x10], vtable.CQRPayNewDlg.0
mov dword [esi + 0x24], vtable.CQRPayNewDlg.1.0
mov dword [esi + 0x28], vtable.CQRPayNewDlg.5.0
mov dword [esi + 0x2c], vtable.CQRPayNewDlg.2.0
mov dword [esi + 0x30], vtable.CQRPayNewDlg.3.0
mov dword [ebp - 4], 1
lea eax, [esi + 0x908]
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 1
or edi, 0xffffffff
mov edx, dword [eax]
mov eax, edi
sub edx, 0x10
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x508725
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
lea eax, [esi + 0x904]
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 0
mov edx, dword [eax]
sub edx, 0x10
lock xadd dword [edx + 0xc], edi
dec edi
test edi, edi
jg 0x50874d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov dword [esi], vtable.MyBaseWindow.5.0
mov dword [esi + 0x10], vtable.MyBaseWindow.2.0
mov dword [esi + 0x24], vtable.MyBaseWindow.1.0
mov dword [esi + 0x28], vtable.MyBaseWindow.4.0
mov dword [esi + 0x2c], vtable.MyBaseWindow.0
mov dword [esi + 0x30], vtable.MyBaseWindow.3.0
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call dword [sym.imp.ycomuiu.dll_public_virtual:_void___thiscall_DuiLib::WindowImplBase::destructor_void_]
test byte [ebp + 8], 1
je 0x5087a0
push 0x914
push esi
call fcn.005603ff
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x50ab30
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
test ebx, ebx
je 0x50abdf
push esi
mov esi, dword [ebp + 0x10]
test esi, esi
jne 0x50ab6b
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
je 0x50abd7
test esi, esi
je 0x50abd7
push edi
push esi
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x50abce
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x50abc7
push 0
lea ecx, [ebp + 8]
push ecx
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
test esi, esi
je 0x50abce
push dword [ebp + 0xc]
push 1
push edi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
js 0x50abce
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret 0xc
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 0xc
pop esi
xor eax, eax
pop ebx
pop ebp
ret 0xc
xor eax, eax
pop ebx
pop ebp
ret 0xc
Function at 0x50bef0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push dword [edi + 0x10]
call fcn.00560596
mov esi, eax
add esp, 4
test esi, esi
je 0x50bf72
push dword [ebp + 0x10]
mov ebx, dword [edi + 0x10]
push dword [ebp + 0xc]
push 0
push ebx
call fcn.005dd6d0
add eax, dword [edi + 0x18]
lea ecx, [ebp + 0x10]
push 0
adc edx, dword [edi + 0x1c]
push ecx
push eax
push dword [edi + 0x20]
mov dword [ebp + 0xc], eax
mov dword [ebp + 0x10], edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
test eax, eax
je 0x50bf65
push 0
lea eax, [ebp + 8]
push eax
push ebx
push esi
push dword [edi + 0x20]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x50bf65
mov eax, dword [ebp + 8]
cmp eax, dword [edi + 0x10]
jne 0x50bf65
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 0xc
push 1
push esi
call fcn.005603ff
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 0xc
Function at 0x511790
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x609056
mov eax, dword fs:[0]
push eax
sub esp, 0x42c
mov eax, dword [0x6b000c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x430], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], 0
mov dword [ebp - 0x418], 0
mov byte [ebp - 4], 1
push 0x60
push 0
push edi
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
call ebx
mov esi, eax
mov dword [ebp - 0x424], esi
test esi, esi
jne 0x51183c
push 2
push eax
push edi
call ebx
mov esi, eax
mov dword [ebp - 0x424], eax
test esi, esi
jne 0x51183c
call fcn.005104b0
mov edi, eax
jmp 0x511971
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x51185f
call fcn.005104b0
jmp 0x511964
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [ebp - 0x420], ebx
test ebx, ebx
jne 0x51187d
call fcn.005104b0
jmp 0x511964
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov dword [ebp - 0x41c], edi
lea eax, [edi + 1]
cmp eax, edi
jae 0x51189e
mov edi, 0x8007000e
jmp 0x511966
mov byte [ebp - 4], 2
mov ecx, 2
mul ecx
mov dword [ebp - 0x438], eax
mov dword [ebp - 0x434], edx
test edx, edx
ja 0x5119b5
jb 0x5118c8
cmp eax, 0xffffffff
ja 0x5119b5
cmp eax, 0x400
jbe 0x5118e4
push eax
lea ecx, [ebp - 0x418]
call fcn.00517450
mov dword [ebp - 4], 1
jmp 0x511918
lea eax, [ebp - 0x414]
mov dword [ebp - 0x418], eax
mov dword [ebp - 4], 1
jmp 0x511918
mov eax, dword [ebp - 0x418]
test eax, eax
jne 0x511929
mov edi, 0x8007000e
jmp 0x511966
push edi
push eax
push edi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
jne 0x511944
call fcn.005104b0
jmp 0x511964
xor edx, edx
mov eax, dword [ebp - 0x418]
mov word [eax + ecx*2], dx
push dword [ebp + 0x14]
push dword [ebp - 0x418]
lea ecx, [ebp - 0x42c]
call fcn.00512ad0
mov edi, eax
test esi, esi
je 0x511971
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov byte [ebp - 4], 0
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x51198e
lea ecx, [ebp - 0x418]
call fcn.005172a0
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0055f9be
mov esp, ebp
pop ebp
ret 0x10
push 0x80070216
call fcn.0040b250
int3
Function at 0x5166c0
Capabilities:
Check if file exists
Create thread
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x609d58
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x6b000c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x6b8f78], 0
jne 0x5166fa
xor al, al
jmp 0x516874
lea eax, [ebp - 0x50]
mov dword [ebp - 0x48], 0
push eax
lea eax, [ebp - 0x48]
mov dword [ebp - 0x4c], 0
push eax
push 0
push str.UpDumpDay
push 0x650fc8
push SysReAllocString
mov dword [ebp - 0x50], 4
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
call fcn.0040bf10
mov ecx, eax
test ecx, ecx
je 0x51688f
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x44], eax
mov dword [ebp - 4], 1
lea eax, [ebp - 0x44]
push str.Error.tmp
push 0x6b88a0
push str._s__s
push eax
call fcn.0040d300
mov esi, dword [ebp - 0x44]
add esp, 0x10
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x516851
lea eax, [ebp - 0x40]
push eax
push esi
call fcn.005bdba8
mov eax, dword [ebp - 0x20]
add esp, 8
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x48], eax
je 0x516851
push 4
lea eax, [ebp - 0x4c]
push eax
push 4
push str.UpDumpDay
push 0x650fc8
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x516851
cmp eax, 0x200000
jg 0x516851
mov eax, dword [0x6b1b4c]
test eax, eax
je 0x5167fa
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x516851
push dword [0x6b1b4c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x6b1b4c], 0
test esi, esi
jne 0x516802
xor ecx, ecx
jmp 0x516816
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x516807
sub ecx, edx
sar ecx, 1
push ecx
push esi
mov ecx, 0x6b1aa4
call fcn.0040c9d0
lea eax, [ebp - 0x54]
mov dword [0x6b1ab4], 7
push eax
push 0
push 0x6b1a88
push 0x46c280
push 0
push 0
call fcn.005b6ff3
add esp, 0x18
mov dword [0x6b1b4c], eax
mov bl, 1
jmp 0x516853
xor bl, bl
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x516872
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0055f9be
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.0040b250
int3