joyce8/EMBER2024-capa huggingface dataset:
Function at 0x429f40
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c8
mov eax, dword [0x4f0464]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x4bc]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
push 0x3e8
push 0
push eax
mov dword [ebp - 0x4c4], esi
mov dword [ebp - 0x4c0], ebx
call fcn.0048c160
push 0xc8
lea eax, [ebp - 0xd4]
push 0
push eax
call fcn.0048c160
add esp, 0x18
test esi, esi
je 0x42a040
test ebx, ebx
je 0x42a040
lea eax, [ebp - 0x4bc]
push eax
push 0x3e8
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x42a040
mov ax, word [ebp - 0x4bc]
xor esi, esi
test ax, ax
je 0x42a040
xor ecx, ecx
movzx edx, ax
mov ax, word [ebp + ecx - 0x4ba]
mov word [ebp - 0xa], ax
xor eax, eax
mov word [ebp - 8], ax
lea eax, [ebp - 0xd4]
push 0x64
push eax
lea eax, [ebp - 0xc]
mov word [ebp - 0xc], dx
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x42a02b
lea eax, [ebp - 0xd4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
mov dword [ebp - 0x4c8], eax
lea eax, [ebp - 0xd4]
push eax
push dword [ebp - 0x4c4]
call fcn.004993fc
add esp, 0xc
test eax, eax
je 0x42a053
add esi, 4
lea ecx, [esi + esi]
movzx eax, word [ebp + ecx - 0x4bc]
mov edx, eax
test ax, ax
jne 0x429fd1
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004670b3
mov esp, ebp
pop ebp
ret
test edi, edi
je 0x42a0a9
cmp edi, 0x7fffffff
ja 0x42a0a0
mov ecx, ebx
mov esi, SysReAllocString
lea ebx, [ebp - 0xc]
sub esi, edi
mov edx, edi
sub ebx, ecx
nop
lea eax, [esi + edx]
test eax, eax
je 0x42a08b
movzx eax, word [ebx + ecx]
test ax, ax
je 0x42a08b
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x42a070
mov ebx, dword [ebp - 0x4c0]
lea eax, [ecx - 2]
test edx, edx
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
jmp 0x42a0a9
test edi, edi
je 0x42a0a9
xor eax, eax
mov word [ebx], ax
xor ecx, ecx
test edi, edi
je 0x42a0b7
cmp edi, 0x7fffffff
jbe 0x42a0bc
mov ecx, 0x80070057
test ecx, ecx
js 0x42a0ee
mov esi, edi
mov eax, ebx
test edi, edi
je 0x42a0d6
cmp word [eax], 0
je 0x42a0d6
add eax, 2
sub esi, 1
jne 0x42a0c8
xor eax, eax
mov ecx, 0x80070057
test esi, esi
cmovne ecx, eax
mov eax, edi
sub eax, esi
neg esi
sbb esi, esi
and esi, eax
jmp 0x42a0f0
xor esi, esi
test ecx, ecx
js 0x42a146
mov edx, edi
lea ecx, [ebx + esi*2]
sub edx, esi
je 0x42a139
mov eax, edx
sub eax, edi
mov edi, dword [ebp - 0x4c4]
add eax, 0x7ffffffe
add esi, eax
mov eax, dword [ebp - 0x4c8]
add eax, eax
sub eax, ecx
add edi, eax
nop word [eax + eax]
test esi, esi
je 0x42a139
movzx eax, word [edi + ecx]
test ax, ax
je 0x42a139
mov word [ecx], ax
dec esi
add ecx, 2
sub edx, 1
jne 0x42a120
test edx, edx
lea eax, [ecx - 2]
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004670b3
mov esp, ebp
pop ebp
ret
Function at 0x42a740
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x4f0464]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0x228
lea eax, [ebp - 0x22c]
push 0
push eax
call fcn.0048c160
add esp, 0xc
mov dword [ebp - 0x230], 0x22c
xor ebx, ebx
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
lea eax, [ebp - 0x230]
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x42a7b8
push edi
mov edi, dword [ebp + 8]
cmp dword [ebp - 0x228], edi
je 0x42a7b1
lea eax, [ebp - 0x230]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x42a796
jmp 0x42a7b7
mov ebx, dword [ebp - 0x218]
pop edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop esi
xor ecx, ebp
pop ebx
call fcn.004670b3
mov esp, ebp
pop ebp
ret

Function at 0x42a7e0
Capabilities:
Get process image filename

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1008
call fcn.00467560
mov eax, dword [0x4f0464]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1008], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
test eax, eax
je 0x42a950
mov edi, dword [ebp + 0x10]
cmp edi, 0x64
jb 0x42a950
push ebx
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
jne 0x42a845
push ebx
push eax
push 0x1010
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x42a950
push 0x800
lea eax, [ebp - 0x804]
push 0
push eax
call fcn.0048c160
add esp, 0xc
lea eax, [ebp - 0x804]
xor ebx, ebx
push 0x400
push eax
push ebx
push esi
call sub.KERNEL32.dll_K32GetModuleFileNameExW
test eax, eax
je 0x42a908
push 0x800
lea eax, [ebp - 0x1004]
push ebx
push eax
call fcn.0048c160
lea eax, [ebp - 0x804]
push 0x7e
push eax
call fcn.0048c2ba
add esp, 0x14
test eax, eax
je 0x42a8c5
push 0x400
lea eax, [ebp - 0x1004]
push eax
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
dec eax
cmp eax, 0x3fe
ja 0x42a8c5
lea ecx, [ebx + 1]
jmp 0x42a8c7
xor ecx, ecx
test ecx, ecx
lea edx, [ebp - 0x1004]
push edi
lea eax, [ebp - 0x804]
cmovne eax, edx
push eax
push edi
push dword [ebp - 0x1008]
call fcn.004993f1
add esp, 0x10
mov ebx, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004670b3
mov esp, ebp
pop ebp
ret
push 0x400
lea eax, [ebp - 0x804]
push eax
push esi
call sub.KERNEL32.dll_K32GetProcessImageFileNameW
test eax, eax
je 0x42a936
push edi
push dword [ebp - 0x1008]
lea eax, [ebp - 0x804]
push eax
call fcn.00429f40
add esp, 0xc
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004670b3
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004670b3
mov esp, ebp
pop ebp
ret
Function at 0x42a970
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b89a3
mov eax, dword fs:[0]
push eax
sub esp, 0xe8
mov eax, dword [0x4f0464]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x54], 0
lea edx, [ebp - 0x5c]
mov dword [ebp - 4], 0
push edx
push eax
push ecx
call fcn.0042b620
add esp, 0xc
test al, al
jne 0x42a9ee
mov ecx, dword [ebp - 0x5c]
test ecx, ecx
je 0x42a9e6
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or eax, 0xffffffff
jmp 0x42ab63
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x42a9f8
mov eax, dword [esi]
mov edi, dword [ebp - 0x5c]
lea ecx, [ebp - 0x44]
push ecx
lea ecx, [ebp - 0x50]
mov dword [ebp - 0x44], 4
push ecx
lea ecx, [ebp - 0x48]
push ecx
push 0
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
mov dword [ebp - 0x44], ebx
test ebx, ebx
jne 0x42aa32
cmp dword [ebp - 0x48], 4
je 0x42ab53
mov dword [ebp - 0x44], 0xd
call fcn.00445180
mov ecx, eax
push 1
mov edx, dword [eax]
mov eax, dword [edx + 8]
call eax
movzx eax, al
sub eax, 1
jne 0x42ab3f
push 0x69
push str.d:jenkins.jenkinsworkspacelib_commonwin11_update_assistantwin11_update_assistant_srcutilsutils.cc
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], al
call fcn.00411d10
push 3
push 0x4c1b84
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
call fcn.00411d10
mov byte [ebp - 4], 2
call fcn.00445180
mov dword [ebp - 0x48], eax
lea ecx, [ebp - 0xf4]
push 0xf3
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.004092d0
mov ebx, eax
push str._error__get_dword_value_failed__root:
push ebx
mov byte [ebp - 4], 3
call fcn.0040a600
add esp, 8
mov ecx, ebx
push dword [ebp - 0x4c]
call fcn.004296e0
push str.__path:
push ebx
call fcn.0040a600
push str.__key:
push ebx
call fcn.0040a600
add esp, 0x10
cmp dword [esi + 0x14], 8
jb 0x42aaf2
mov esi, dword [esi]
test esi, esi
mov eax, 0x4c19e4
cmovne eax, esi
push eax
push ebx
call fcn.00407110
push str.__err:
push ebx
call fcn.0040a600
add esp, 0x10
mov ecx, ebx
push dword [ebp - 0x44]
call fcn.00418320
mov ecx, dword [ebp - 0x48]
push ebx
mov eax, dword [ecx]
call dword [eax + 0x1c]
lea ecx, [ebp - 0xf4]
call fcn.0040a7e0
lea ecx, [ebp - 0x28]
call fcn.00409da0
lea ecx, [ebp - 0x40]
call fcn.00409da0
test edi, edi
je 0x42a9e6
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or eax, 0xffffffff
jmp 0x42ab63
mov esi, dword [ebp - 0x50]
test edi, edi
je 0x42ab61
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004670b3
mov esp, ebp
pop ebp
ret
Function at 0x4300f0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b9e02
mov eax, dword fs:[0]
push eax
sub esp, 0x228
mov eax, dword [0x4f0464]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x234], 0
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
push 0
push eax
call fcn.0048c160
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor eax, eax
mov dword [ebp - 0x220], 0
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x21c], 7
mov word [ebp - 0x230], ax
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x430180
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x230]
call fcn.00411e00
cmp dword [ebp - 0x220], 0
mov dword [ebp - 0x234], 1
je 0x4301c7
push 0xd
push str._schtasks.exe
lea ecx, [ebp - 0x230]
call fcn.0042c2a0
cmp dword [esi + 0x14], 8
jb 0x4301cf
mov esi, dword [esi]
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
push 0
cmovae eax, dword [ebp - 0x230]
push 0x1388
push 1
push 0
push 0
push esi
push eax
call fcn.00458a50
mov edx, dword [ebp - 0x21c]
add esp, 0x1c
cmp edx, 8
jb 0x430236
mov ecx, dword [ebp - 0x230]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x43022c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x430250
push edx
push ecx
call fcn.00466e06
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004670b3
mov esp, ebp
pop ebp
ret
call fcn.0048f279
int3
Function at 0x431c40
Capabilities:
Parse credit card information

Disassembly:
push esi
mov esi, ecx
xor cl, cl
mov eax, dword [esi + 0x4c]
cmp eax, 0xffffffff
je 0x431e55
push ebx
push edi
cmp eax, 0x7c
je 0x431e53
cmp eax, 0x29
jne 0x431c81
cmp dword [esi + 0x10], 0
jne 0x431e53
cmp eax, eax
jne 0x431c81
test dword [esi + 0x50], 0x10000000
je 0x431e62
jmp 0x431e0c
cmp eax, 0x2e
jne 0x431cdb
push 5
lea ecx, [esi + 0x24]
call fcn.004345b0
mov eax, dword [esi]
mov edx, dword [esi + 8]
cmp eax, edx
je 0x431ccf
cmp byte [eax], 0x5c
jne 0x431ccc
lea ecx, [eax + 1]
cmp ecx, edx
je 0x431ccc
mov edx, dword [esi + 0x50]
test dl, 8
jne 0x431cb9
mov bl, byte [ecx]
cmp bl, 0x28
je 0x431cca
cmp bl, 0x29
je 0x431cca
test dl, 0x10
jne 0x431ccc
mov dl, byte [ecx]
cmp dl, 0x7b
je 0x431cca
cmp dl, 0x7d
jne 0x431ccc
mov eax, ecx
inc eax
mov dword [esi], eax
mov ecx, esi
call fcn.00434850
jmp 0x431e3e
cmp eax, 0x5c
jne 0x431d37
mov ecx, esi
call fcn.00434620
test byte [esi + 0x50], 0x80
je 0x431d2b
mov al, byte [esi + 0x48]
cmp al, 0x62
jne 0x431d0a
push 4
lea ecx, [esi + 0x24]
call fcn.004345b0
mov ecx, esi
call fcn.00434620
jmp 0x431e45
cmp al, 0x42
jne 0x431d2b
push 4
lea ecx, [esi + 0x24]
call fcn.004345b0
mov eax, dword [esi + 0x28]
mov ecx, esi
xor dword [eax + 8], 1
call fcn.00434620
jmp 0x431e45
mov ecx, esi
call fcn.00431e80
jmp 0x431e3e
cmp eax, 0x5b
jne 0x431d98
mov ecx, esi
call fcn.00434620
lea ecx, [esi + 0x24]
call fcn.00431240
mov eax, dword [esi + 0x4c]
cmp eax, 0x5e
jne 0x431d64
mov eax, dword [esi + 0x28]
mov ecx, esi
xor dword [eax + 8], 1
call fcn.00434620
mov eax, dword [esi + 0x4c]
test dword [esi + 0x50], 0x20000000
je 0x431d82
cmp eax, 0x5d
jne 0x431d82
push eax
lea ecx, [esi + 0x24]
call fcn.004311d0
mov ecx, esi
call fcn.00434620
mov ecx, esi
call fcn.00432880
cmp dword [esi + 0x4c], 0x5d
jne 0x431e6b
jmp 0x431e37
cmp eax, 0x28
jne 0x431dc8
mov ecx, esi
call fcn.00434620
mov ecx, esi
call fcn.00434a50
cmp dword [esi + 0x4c], 0x29
mov bl, al
jne 0x431e62
mov ecx, esi
call fcn.00434620
test bl, bl
je 0x431e45
jmp 0x431e3e
cmp eax, 0x5e
jne 0x431de0
push 2
lea ecx, [esi + 0x24]
call fcn.004345b0
mov ecx, esi
call fcn.00434620
jmp 0x431e45
cmp eax, 0x24
jne 0x431df8
push 3
lea ecx, [esi + 0x24]
call fcn.004345b0
mov ecx, esi
call fcn.00434620
jmp 0x431e45
cmp eax, 0x2a
je 0x431e59
cmp eax, 0x2b
je 0x431e59
cmp eax, 0x3f
je 0x431e59
cmp eax, 0x7b
je 0x431e59
cmp eax, 0x7d
jne 0x431e1c
test dword [esi + 0x50], 0x10000000
je 0x431e74
jmp 0x431e2a
cmp eax, 0x5d
jne 0x431e2a
test dword [esi + 0x50], 0x10000000
je 0x431e6b
movzx eax, byte [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.004310c0
mov ecx, esi
call fcn.00434620
mov ecx, esi
call fcn.00434680
mov eax, dword [esi + 0x4c]
mov cl, 1
cmp eax, 0xffffffff
jne 0x431c53
pop edi
pop ebx
mov al, cl
pop esi
ret
push 0xa
mov ecx, esi
call fcn.00433f10
push 5
mov ecx, esi
call fcn.00433f10
push 4
mov ecx, esi
call fcn.00433f10
push 6
mov ecx, esi
call fcn.00433f10
int3
Function at 0x434cf0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
je 0x434d21
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x434d10
pop edi
mov eax, edx
pop esi
pop ebp
ret 8
Function at 0x437920
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4010
call fcn.00467560
mov eax, dword [0x4f0464]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x4004]
push edi
mov edi, dword [ebp + 0xc]
push 0x4000
push 0
push eax
call fcn.0048c160
add esp, 0xc
mov dword [ebp - 0x4008], 0
test esi, esi
je 0x437a16
test edi, edi
je 0x437a16
lea eax, [ebp - 0x4008]
push eax
push esi
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
je 0x437a16
cmp eax, 0x3fff
ja 0x437a16
lea ecx, [ebp - 0x4004]
push ecx
push eax
push 0
push esi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x437a16
lea eax, [ebp - 0x4010]
push eax
lea eax, [ebp - 0x400c]
push eax
push 0x4c2704
lea eax, [ebp - 0x4004]
push eax
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x437a16
mov esi, dword [ebp + 0x10]
lea eax, [esi + esi]
push eax
push 0
push edi
call fcn.0048c160
mov ecx, dword [ebp - 0x400c]
movzx eax, word [ecx + 0xc]
push eax
movzx eax, word [ecx + 0xe]
push eax
movzx eax, word [ecx + 8]
push eax
movzx eax, word [ecx + 0xa]
push eax
push str._d._d._d._d
lea eax, [esi - 1]
push eax
push edi
call fcn.0043a190
add esp, 0x28
mov eax, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004670b3
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.004670b3
mov esp, ebp
pop ebp
ret
Function at 0x438a60
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ba646
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x4f0464]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x430], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], 0
mov dword [ebp - 0x418], 0
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push 0x60
push 0
push esi
mov byte [ebp - 4], 1
call ebx
mov edi, eax
mov dword [ebp - 0x424], edi
test edi, edi
jne 0x438b0c
push 2
push eax
push esi
call ebx
mov edi, eax
mov dword [ebp - 0x424], eax
test edi, edi
jne 0x438b0c
call fcn.004360c0
mov esi, eax
jmp 0x438bfc
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x438b2f
call fcn.004360c0
jmp 0x438bef
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [ebp - 0x420], ebx
test ebx, ebx
jne 0x438b4d
call fcn.004360c0
jmp 0x438bef
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov dword [ebp - 0x41c], esi
lea eax, [esi + 1]
cmp eax, esi
jae 0x438b6e
mov esi, 0x8007000e
jmp 0x438bf1
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.00435f90
jmp 0x438b98
cmp dword [ebp - 0x418], 0
mov dword [ebp - 4], 1
jne 0x438baf
mov esi, 0x8007000e
jmp 0x438bf1
push esi
push dword [ebp - 0x418]
push esi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
jne 0x438bcf
call fcn.004360c0
jmp 0x438bef
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x42c]
push dword [ebp - 0x418]
call fcn.004388c0
mov esi, eax
test edi, edi
je 0x438bfc
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x438c20
lea ecx, [ebp - 0x418]
call fcn.00437910
nop word [eax + eax]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004670b3
mov esp, ebp
pop ebp
ret 0x10
Function at 0x43ab50
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x43abc1
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x43abc1
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x43abc1
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x43abc1
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
push 0x40
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x43abbb
push esi
push ebx
push edi
call fcn.0048b660
add esp, 0xc
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x43abbb
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4443c0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bad9a
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4f0464]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.LogUtils::LogAppender.0
lea edi, [esi + 0x14]
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov byte [esi + 0xc], 1
mov dword [esi + 0x10], 0
call fcn.0040f380
mov ecx, eax
test ecx, ecx
je 0x444584
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov dword [ebp - 4], 0
lea ebx, [esi + 0x18]
call fcn.0040f380
mov ecx, eax
test ecx, ecx
je 0x44458e
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebx], eax
mov byte [ebp - 4], 1
call fcn.0040f380
mov ecx, eax
test ecx, ecx
je 0x444598
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], 0xffffffff
lea eax, [esi + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov byte [ebp - 4], 5
mov dword [esi + 0x10], eax
test edx, edx
jne 0x4444a2
xor ecx, ecx
jmp 0x4444c0
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp + 0x10], eax
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4444b0
sub ecx, dword [ebp + 0x10]
sar ecx, 1
push ecx
push edx
mov ecx, edi
call fcn.0040fcd0
push edi
mov ecx, ebx
call fcn.0041e860
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x4444dc
xor ecx, ecx
jmp 0x4444f4
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp + 0x10], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4444e4
sub ecx, dword [ebp + 0x10]
sar ecx, 1
push ecx
push edx
lea ecx, [esi + 0x1c]
call fcn.0040fcd0
push ebx
lea eax, [ebp + 0x10]
mov ecx, esi
push eax
call fcn.00444f00
push eax
mov ecx, ebx
mov byte [ebp - 4], 6
call fcn.0041e860
mov edx, dword [ebp + 0x10]
or eax, 0xffffffff
mov byte [ebp - 4], 5
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x444535
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebx]
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi + 4], eax
test eax, eax
je 0x44456e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x44456e
cmp dword [esi + 0x10], 0
je 0x444565
push dword [edi]
call fcn.0049a8e2
add esp, 4
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 0x80004005
call fcn.0040b080
push 0x80004005
call fcn.0040b080
push 0x80004005
call fcn.0040b080
int3