joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4161f0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x749920
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x8606e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [ebp - 0x30], vtable.CMitFile.0
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], cx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 4], ecx
cmp dword [eax + 0x14], 8
jb 0x416249
mov eax, dword [eax]
sub esp, 8
lea ecx, [ebp - 0x30]
push eax
call fcn.00413f60
mov eax, dword [ebp - 0x2c]
test eax, eax
jne 0x41626a
xor esi, esi
mov dword [ebp - 0x30], vtable.CMitFile.0
jmp 0x41633b
mov esi, dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
lea ecx, [ebp - 0x5c]
push ecx
xorps xmm0, xmm0
push eax
movlpd qword [ebp - 0x5c], xmm0
call esi
mov eax, dword [ebp - 0x5c]
inc eax
push eax
call fcn.004cd475
add esp, 4
mov dword [ebp - 0x54], 0
mov edi, eax
xorps xmm0, xmm0
lea eax, [ebp - 0x50]
movlpd qword [ebp - 0x50], xmm0
push eax
push dword [ebp - 0x2c]
call esi
push 0
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x50]
push edi
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
lea eax, [ebp - 0x50]
xorps xmm0, xmm0
push eax
push dword [ebp - 0x2c]
movlpd qword [ebp - 0x50], xmm0
call esi
mov eax, dword [ebp - 0x50]
lea ecx, [ebp - 0x48]
mov edx, edi
mov byte [eax + edi], 0
call fcn.004172d0
push edi
mov byte [ebp - 4], 1
call fcn.004cd271
add esp, 4
lea eax, [ebp - 0x48]
mov ecx, ebx
push eax
call fcn.00416090
mov eax, dword [ebp - 0x34]
mov esi, 1
cmp eax, 0x10
jb 0x41630d
inc eax
lea ecx, [ebp - 0x48]
push eax
push dword [ebp - 0x48]
call fcn.004094e0
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], 0xf
mov dword [ebp - 0x38], 0
mov byte [ebp - 0x48], 0
mov dword [ebp - 0x30], vtable.CMitFile.0
test eax, eax
je 0x41633b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x2c], 0
mov ecx, dword [ebp - 0x14]
cmp ecx, 8
jb 0x416350
inc ecx
push ecx
push dword [ebp - 0x28]
lea ecx, [ebp - 0x28]
call fcn.00409480
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ccd8f
mov esp, ebp
pop ebp
ret 4
Function at 0x416c60
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
cmp dword [0x8903bc], 0
je 0x416c6f
mov eax, 1
ret
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
push 8
push 1
push str.Microsoft_Base_Cryptographic_Provider_v1.0
push str.MyContainer
push 0x8903bc
call edi
mov esi, eax
test esi, esi
jne 0x416d0c
push eax
push 1
push str.Microsoft_Base_Cryptographic_Provider_v1.0
push eax
push 0x8903bc
call edi
mov esi, eax
test esi, esi
jne 0x416d0c
push 0x20
push 1
push str.Microsoft_Base_Cryptographic_Provider_v1.0
push eax
push 0x8903bc
call edi
mov esi, eax
test esi, esi
jne 0x416d0c
push 0x28
push 1
push str.Microsoft_Base_Cryptographic_Provider_v1.0
push eax
push 0x8903bc
call edi
mov esi, eax
test esi, esi
jne 0x416d0c
push eax
push 1
push str.Microsoft_Base_Cryptographic_Provider_v1.0
push str.MyContainer
push 0x8903bc
call edi
mov esi, eax
test esi, esi
jne 0x416d0c
mov eax, dword [0x8903bc]
test eax, eax
je 0x416d17
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
pop edi
mov dword [0x8903bc], esi
mov eax, esi
pop esi
ret
push 0x8903c0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
pop edi
mov eax, esi
pop esi
ret
Function at 0x41b470
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x8606e0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
xor al, al
push edi
mov edi, edx
mov ecx, dword [esi + 0x10]
cmp ecx, 2
jb 0x41b528
cmp ecx, 1
jbe 0x41b538
cmp dword [esi + 0x14], 8
jb 0x41b4aa
mov ecx, dword [esi]
jmp 0x41b4ac
mov ecx, esi
cmp word [ecx + 2], 0x3a
jne 0x41b528
push 0x20a
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.0062ff20
add esp, 0xc
lea eax, [ebp - 0x218]
mov ecx, esi
push 0x104
push eax
call fcn.00406ca0
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumePathNameW]
test eax, eax
setne al
test al, al
je 0x41b528
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
setne al
test al, al
je 0x41b528
mov ecx, dword [ebp - 0x220]
mov dword [edi], ecx
mov ecx, dword [ebp - 0x21c]
mov dword [edi + 4], ecx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004ccd8f
mov esp, ebp
pop ebp
ret
push str.invalid_string_position
call fcn.004b2788
int3

Function at 0x41c440
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 4]
push edi
push eax
push dword [ebp + 8]
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov edi, eax
test edi, edi
jne 0x41c45f
pop edi
mov esp, ebp
pop ebp
ret
push esi
push edi
call fcn.006415c1
mov esi, eax
add esp, 4
test esi, esi
jne 0x41c475
pop esi
pop edi
mov esp, ebp
pop ebp
ret
push esi
push edi
push dword [ebp - 4]
push dword [ebp + 8]
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x81fcb8
push esi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x41c4cc
cmp dword [ebp - 8], 0x34
jb 0x41c4cc
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp + 0x18]
movzx ecx, word [edx + 0xc]
mov word [eax], cx
mov eax, dword [ebp + 0x14]
movzx ecx, word [edx + 0xe]
mov word [eax], cx
mov eax, dword [ebp + 0x10]
movzx ecx, word [edx + 8]
mov word [eax], cx
mov eax, dword [ebp + 0xc]
movzx ecx, word [edx + 0xa]
mov word [eax], cx
push esi
call fcn.0063302c
add esp, 4
mov eax, 1
pop esi
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x41e3c0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add dword [ebp + 8], 8
pop ebp
jmp fcn.0043e01e
Function at 0x42e8b0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
push 0
mov dword [esp + 0x18], edi
call fcn.00638e18
add esp, 4
mov dword [edi + 0x58], eax
mov edx, 1
lea esi, [edi + 0x5c]
mov ecx, eax
lea esi, [esi + 4]
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
inc edx
mov dword [esi - 4], eax
cmp edx, 0x270
jl 0x42e8d7
lea eax, [edi + 0x3c]
mov dword [edi + 0x54], 0x270
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0
push 0x81fd64
lea ecx, [edi + 0x10]
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
call fcn.00408810
lea eax, [edi + 0x30]
mov edi, eax
nop
mov esi, dword [edi]
mov eax, esi
mov ecx, dword [edi + 4]
mov edx, ecx
mov dword [esp + 0x10], ecx
xor ebx, ebx
xor ecx, ecx
lock cmpxchg8b qword [edi]
cmp esi, eax
jne 0x42e930
cmp dword [esp + 0x10], edx
jne 0x42e930
mov eax, dword [esp + 0x14]
xor cl, cl
add eax, 0x38
xchg byte [eax], cl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x42ed60
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
lea eax, [ecx + 8]
mov esi, 0x270
nop dword [eax]
mov edx, dword [eax - 4]
lea eax, [eax + 4]
xor edx, dword [eax - 4]
and edx, 0x7fffffff
xor edx, dword [eax - 8]
mov ecx, edx
and cl, 1
movzx ecx, cl
neg ecx
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [eax + 0x62c]
xor ecx, edx
mov dword [eax + 0x9b8], ecx
sub esi, 1
jne 0x42ed70
pop esi
ret

Function at 0x42edb0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
mov ebx, ecx
mov ecx, 0xe3
push esi
push edi
lea edi, [ebx + 0x9c4]
mov edx, dword [edi + 4]
lea edi, [edi + 4]
xor edx, dword [edi - 4]
and edx, 0x7fffffff
xor edx, dword [edi - 4]
mov eax, edx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr edx, 1
and eax, 0x9908b0df
xor eax, dword [edi + 0x630]
xor eax, edx
mov dword [edi - 0x9c4], eax
sub ecx, 1
jne 0x42edc0
lea esi, [ebx + 0xd50]
mov edi, 0x18c
mov ecx, dword [esi + 4]
lea esi, [esi + 4]
xor ecx, dword [esi - 4]
and ecx, 0x7fffffff
xor ecx, dword [esi - 4]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi - 0xd50]
xor eax, ecx
mov dword [esi - 0x9c4], eax
sub edi, 1
jne 0x42ee02
mov ecx, dword [ebx + 0x1380]
xor ecx, dword [ebx + 4]
and ecx, 0x7fffffff
xor ecx, dword [ebx + 0x1380]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx + 0x634]
xor eax, ecx
mov dword [ebx + 0x9c0], eax
mov dword [ebx], edi
pop edi
pop esi
pop ebx
ret
Function at 0x42ee80
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
push edi
mov edi, ecx
mov edx, 0x1571
mov eax, 1
mov dword [edi + 0x1384], 0xffffffff
lea esi, [edi + 8]
mov dword [edi + 4], 0x1571
mov ecx, edx
lea esi, [esi + 4]
shr ecx, 0x1e
xor ecx, edx
imul edx, ecx, 0x6c078965
add edx, eax
inc eax
mov dword [esi - 4], edx
cmp eax, 0x270
jl 0x42eea2
mov dword [edi], 0x270
mov eax, edi
pop edi
pop esi
ret 0xc

Function at 0x430710
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x74b94e
mov eax, dword fs:[0]
push eax
sub esp, 0x1ac
mov eax, dword [0x8606e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x1a4], edi
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1b8], edi
mov dword [edi + 4], eax
mov dword [ebp - 4], 0
mov dword [edi], vtable.DefaultSender.0
mov byte [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov byte [ebp - 4], 1
lea esi, [edi + 0x14]
push 0
mov dword [ebp - 0x1a4], esi
push 0
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00432420
mov dword [esi], eax
lea eax, [edi + 0x1c]
push 2
push eax
call fcn.004b2f85
lea eax, [edi + 0x4c]
push eax
call fcn.004b2027
add esp, 0xc
mov dword [edi + 0x88], 0xf
mov dword [edi + 0x84], 0
cmp dword [edi + 0x88], 0x10
jb 0x4307cf
mov eax, dword [edi + 0x74]
jmp 0x4307d2
lea eax, [edi + 0x74]
mov byte [eax], 0
lea eax, [edi + 0x8c]
mov dword [eax + 0x14], 0xf
mov dword [eax + 0x10], 0
cmp dword [eax + 0x14], 0x10
jb 0x4307f1
mov eax, dword [eax]
mov byte [eax], 0
mov byte [ebp - 4], 6
lea esi, [edi + 0xa4]
mov dword [ebp - 0x1a4], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00432340
mov dword [esi], eax
push 0x1f
push str.open_data_router_api.ggkuai.com
lea ecx, [edi + 0x74]
mov byte [ebp - 4], 7
call fcn.00408810
mov ecx, edi
call fcn.00431a10
push 0x190
lea eax, [ebp - 0x1a0]
push 0
push eax
call fcn.0062ff20
add esp, 0xc
lea eax, [ebp - 0x1a0]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
push 3
call fcn.004ce7a0
lea eax, [ebp - 0x1a8]
mov dword [ebp - 0x1a8], edi
push eax
lea edx, [ebp - 0x1ac]
mov dword [ebp - 0x1ac], 0x431ad0
lea ecx, [ebp - 0x1a4]
call fcn.00432580
add esp, 8
mov edx, eax
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x1b4]
call fcn.004325d0
mov eax, dword [ebp - 0x1a4]
test eax, eax
je 0x4308b2
push 8
push eax
call fcn.004cd240
add esp, 8
cmp dword [edi + 0x10], 0
je 0x4308bd
call fcn.00633607
mov ecx, dword [ebp - 0x1b4]
mov eax, edi
mov dword [edi + 0xc], ecx
mov ecx, dword [ebp - 0x1b0]
mov dword [edi + 0x10], ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ccd8f
mov esp, ebp
pop ebp
ret 4
Function at 0x438587
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x43859c
mov eax, dword [esi]
and eax, 0xf
jmp 0x43859e
xor eax, eax
cmp eax, 1
jb 0x4386af
cmp eax, 5
ja 0x4386af
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
cmp eax, 1
jbe 0x438665
push edi
lea ecx, [ebp + 0xc]
call fcn.00439bfb
push eax
push ebx
call fcn.00438756
add esp, 0xc
lea ecx, [ebp + 0xc]
push edi
call fcn.0043d478
push eax
push ebx
call fcn.00438756
add esp, 0xc
lea eax, [ebp - 0xc]
lea ecx, [ebp + 0xc]
push eax
call fcn.00438d35
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0xc]
and dword [ebp - 0x14], 0
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push eax
call fcn.00437d76
test al, al
je 0x438656
and dword [ebp - 0x14], 0
mov esi, dword [ebp - 0xc]
push edi
lea ecx, [ebp - 0xc]
call fcn.00439bfb
push eax
push ebx
call fcn.00438756
add esp, 0xc
lea ecx, [ebp - 0xc]
push edi
call fcn.0043d478
push eax
push ebx
call fcn.00438756
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0xc]
mov esi, dword [esi + 0x14]
add esp, 0xc
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0xc], esi
push eax
call fcn.00437d76
test al, al
jne 0x438614
push edi
push 0
push ebx
call fcn.00438756
mov esi, dword [ebp + 0xc]
add esp, 0xc
test esi, esi
je 0x438692
mov esi, dword [esi + 0x14]
jmp 0x438694
mov al, byte [esi]
and al, 0xf
mov byte [ebp - 1], al
lea eax, [ebp - 1]
push eax
call fcn.00633a0d
push edi
push esi
push ebx
call fcn.00438587
add esp, 0x1c
test esi, esi
je 0x438692
mov esi, dword [esi + 0x1c]
jmp 0x438694
xor esi, esi
push edi
push 1
push 1
test esi, esi
jne 0x43866e
lea eax, [ebp - 2]
mov byte [ebp - 2], 0
push eax
call fcn.00633a0d
add esp, 0x10
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4386b4
Capabilities:
Write file on windows

Disassembly:
push 0x44
mov eax, 0x74c0b6
call fcn.004cd880
mov esi, dword [ebp + 0xc]
lea ecx, [ebp - 0x50]
push 0xa
sub esp, 0xc
mov dword [esp + 8], 0x40100000
mov dword [esp + 4], 0x3e800000
mov dword [esp], 0x3f400000
push 0x11
call fcn.0045138f
and dword [ebp - 4], 0
lea eax, [ebp - 0x50]
push eax
push dword [ebp + 8]
call fcn.0043823d
lea eax, [ebp - 0x50]
push eax
call fcn.0043842f
mov ecx, dword [ebp - 0x4c]
push esi
push 0x10
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x20]
push 1
push eax
mov dword [ebp - 0x20], 0x6c6d7873
mov dword [ebp - 0x1c], 2
mov dword [ebp - 0x18], ecx
call fcn.00633a0d
lea eax, [ebp - 0x50]
push eax
push esi
call fcn.004387e7
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x50]
push eax
call fcn.00438587
add esp, 0x30
lea ecx, [ebp - 0x50]
mov dword [ebp - 4], 1
call fcn.00438155
call fcn.004cd82a
ret
Function at 0x438756
Capabilities:
Write file on windows

Disassembly:
push 0x18
mov eax, 0x74c08d
call fcn.004cd84c
mov esi, dword [ebp + 8]
push dword [esi + 4]
call fcn.004396c5
and dword [ebp + 8], 0
mov edi, eax
pop ecx
push dword [ebp + 0xc]
lea ecx, [ebp - 0x24]
call fcn.00434814
and dword [ebp - 4], 0
lea eax, [ebp - 0x24]
push 0xfde9
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.00435e17
add esp, 0xc
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 2
call fcn.00434a07
lea eax, [ebp - 0x18]
push eax
call fcn.00434232
test eax, eax
jne 0x4387c7
lea ecx, [ebp - 0x18]
call fcn.00622637
push eax
mov ecx, esi
call fcn.00437f87
mov eax, dword [eax + 0xc]
mov dword [ebp + 8], eax
push dword [ebp + 0x10]
lea eax, [ebp + 8]
push edi
push 1
push eax
call fcn.00633a0d
add esp, 0x10
lea ecx, [ebp - 0x18]
call fcn.00433b28
call fcn.004cd815
ret

Function at 0x4387e7
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
push edi
call fcn.0049fdd0
mov edi, eax
test edi, edi
je 0x438828
push esi
mov ecx, dword [ebp + 0xc]
mov esi, edi
push edi
call fcn.00441a3a
push dword [ebp + 8]
mov edi, eax
mov eax, dword [esi]
push esi
call dword [eax + 0xc]
inc eax
push eax
mov eax, dword [esi]
push 1
push esi
call dword [eax + 0x20]
push eax
call fcn.00633a0d
add esp, 0x10
test edi, edi
jne 0x4387fa
pop esi
pop edi
pop ebp
ret

Function at 0x439a92
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
xor esi, esi
cmp dword [ebp + 0x10], esi
jne 0x439ab2
mov eax, dword [ebp + 8]
mov dword [eax], 1
mov dword [eax + 8], esi
mov dword [eax + 4], esi
jmp 0x439b70
lea eax, [ebp - 4]
mov dword [ebp - 4], esi
push eax
push dword [ebp + 0x10]
call fcn.0043932e
pop ecx
pop ecx
mov ecx, eax
test ecx, ecx
je 0x439ad0
mov eax, dword [ebp + 8]
mov dword [eax], ecx
jmp 0x439aa7
push ebx
push edi
mov edi, dword [ebp - 4]
lea eax, [edi + 2]
push eax
call dword [0x8600c4]
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x439af1
mov eax, dword [ebp + 8]
mov dword [eax], 3
jmp 0x439b15
push dword [ebp + 0x10]
push edi
push 1
push ebx
call fcn.00644c3e
add esp, 0x10
cmp eax, edi
je 0x439b1d
push ebx
call dword [0x8600c8]
mov eax, dword [ebp + 8]
pop ecx
mov dword [eax], 2
mov dword [eax + 8], esi
mov dword [eax + 4], esi
jmp 0x439b6e
push edi
push ebx
push dword [ebp + 0x18]
call fcn.004392fd
mov edx, eax
add esp, 0xc
cmp edx, 2
je 0x439b3f
push 2
push edx
call fcn.00439c0e
pop ecx
pop ecx
test al, al
je 0x439b4d
shr edi, 1
xor ecx, ecx
lea eax, [edi + edi]
mov word [eax + ebx], cx
lea edi, [eax + 2]
push dword [ebp + 0x1c]
push 1
push 1
push edx
push dword [ebp + 0x14]
push edi
push ebx
push dword [ebp + 0xc]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004398e1
mov eax, dword [ebp + 8]
add esp, 0x28
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x43d8fe
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7485a0
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x8606e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi + 0x64]
cmp eax, dword [0x8600d0]
jl 0x43d99c
mov ecx, dword [0x8600d4]
test ecx, ecx
je 0x43d952
push dword [edi + 0x68]
push dword [edi + 0x70]
push dword [edi + 0x74]
push dword [edi + 0x6c]
push eax
lea eax, [edi + 0x78]
push eax
push edi
call ecx
add esp, 0x1c
jmp 0x43d99c
cmp byte [0x8600cc], 0
je 0x43d99c
push 0x465
call fcn.006415c1
push dword [edi + 0x74]
lea ecx, [edi + 0x78]
mov esi, eax
push dword [edi + 0x6c]
push dword [edi + 0x70]
push ecx
push edi
push str._s__s__s__s:_d_n
push 0xffffffffffffffff
push 0x464
push esi
call fcn.0043d7f1
add esp, 0x28
mov byte [eax + esi], 0
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push esi
call fcn.0063302c
pop ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4501fd
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x75f3ac
push dword [ebp + 8]
call fcn.006449d5
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x45025a
push ebx
push edi
push esi
call fcn.00645e0d
push eax
call fcn.00645f43
mov edi, eax
pop ecx
pop ecx
cmp edi, dword [ebp + 0x10]
jbe 0x450239
push 0x7a
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor ebx, ebx
jmp 0x45024f
push esi
push edi
push 1
push dword [ebp + 0xc]
call fcn.00644c3e
xor ebx, ebx
add esp, 0x10
cmp edi, eax
sete bl
push esi
call fcn.0063343e
pop ecx
pop edi
mov eax, ebx
pop ebx
pop esi
pop ebp
ret

Function at 0x4502b1
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push dword [ebp + 0x10]
mov esi, dword [ebp + 8]
mov ecx, esi
push dword [ebp + 0xc]
call fcn.00450dd6
mov ebx, eax
test ebx, ebx
je 0x450323
push edi
push ebx
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test edi, edi
je 0x450307
cmp dword [ebp + 0x18], edi
jae 0x4502ec
push 0x7a
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x450307
push ebx
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x450307
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
jne 0x45030b
xor eax, eax
jmp 0x450322
push edi
push eax
push dword [ebp + 0x14]
call fcn.0062f5d0
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
pop ebp
ret 0x14
Function at 0x450436
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0x140
mov eax, 0x74ce2c
call fcn.004cd880
mov edi, ecx
mov eax, dword [ebp + 0xc]
and dword [ebp - 0x128], 0
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
test eax, eax
jne 0x4504d5
push 0x81fcb8
lea eax, [edi + 8]
push eax
lea eax, [ebp - 0x140]
push eax
call fcn.0040af20
and dword [ebp - 4], 0
push ebx
push eax
lea eax, [ebp - 0x124]
push eax
call fcn.0040af20
lea ecx, [ebp - 0x140]
mov byte [ebp - 4], 2
call fcn.00434a07
lea ecx, [ebp - 0x124]
call fcn.00622637
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4504ac
test al, 0x20
jne 0x4504bc
push 0x822950
lea ecx, [ebp - 0x124]
call fcn.00434ac7
lea eax, [ebp - 0x124]
mov ecx, esi
push eax
call fcn.004347da
lea ecx, [ebp - 0x124]
jmp 0x450558
push ebx
push eax
lea ecx, [ebp - 0x118]
call fcn.0044fc79
lea eax, [ebp - 0x118]
push eax
lea ecx, [edi + 0x14]
call fcn.00450db6
mov ebx, eax
test ebx, ebx
jne 0x450505
push 0x822950
mov ecx, esi
call fcn.00434814
jmp 0x45055d
push 0x81fcb8
lea eax, [edi + 8]
push eax
lea eax, [ebp - 0x14c]
push eax
call fcn.0040af20
lea ecx, [ebx + 0x108]
mov dword [ebp - 4], 3
push ecx
push eax
lea eax, [ebp - 0x134]
push eax
call fcn.0044fe0f
lea ecx, [ebp - 0x14c]
mov byte [ebp - 4], 5
call fcn.00434a07
lea eax, [ebp - 0x134]
mov ecx, esi
push eax
call fcn.004347da
lea ecx, [ebp - 0x134]
call fcn.00434a07
mov eax, esi
call fcn.004cd82a
ret 0xc

Function at 0x45ecd8
Capabilities:
Create process on windows

Disassembly:
push 0x18
mov eax, 0x74de31
call fcn.004cd84c
mov edi, ecx
push dword [ebp + 0x10]
lea eax, [edi + 0x24c]
push dword [ebp + 0xc]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
jne 0x45ed08
mov eax, dword [edi]
push edi
call dword [eax + 0x114]
jmp 0x45ed7e
push dword [ebp + 0x10]
mov ecx, edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0044d4d4
lea esi, [edi + 0x25c]
push esi
lea ecx, [ebp - 0x18]
call fcn.004347da
mov eax, dword [esi]
xor ebx, ebx
push esi
mov dword [ebp - 4], ebx
call dword [eax + 0x10]
test eax, eax
je 0x45ed5d
mov eax, dword [edi]
lea ecx, [ebp - 0x24]
push ebx
push ecx
mov ecx, edi
call dword [eax + 0x228]
push eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call fcn.00434a60
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], bl
call fcn.00434a07
push 1
push ebx
push ebx
lea ecx, [ebp - 0x18]
call fcn.00622637
push eax
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x18]
call fcn.00434a07
call fcn.004cd815
ret 0xc