joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4594b0
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f2d18
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x674ff8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 4], 0
push dword [ebp + 0xc]
push 1
push str.CPlayerManager::SetPlayerDisplayIcon
push str.__s__:_count__d___iconpath__s_
call fcn.0040f620
push eax
call fcn.0043a270
add esp, 0x10
mov ecx, ebx
call fcn.00452370
mov edi, eax
test edi, edi
jne 0x45952d
push str.CPlayerManager::SetPlayerDisplayIcon
push str.__s__:_not_find_player
call fcn.0040f620
push eax
call fcn.0043a270
add esp, 0xc
xor bl, bl
jmp 0x4595af
cmp dword [edi + 0x1c], 0
je 0x45958b
mov esi, dword [ebp + 0xc]
call fcn.00488823
push 0
push esi
mov eax, dword [eax + 8]
push eax
call dword [sym.imp.SHELL32.dll_ExtractIconW]
mov esi, eax
mov eax, dword [edi + 8]
test eax, eax
je 0x4595a2
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 0x14], 0
push 0x44fdb0
mov dword [ebp - 0x14], 0
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x4595a2
test esi, esi
je 0x4595a2
push esi
push 0
push 0x80
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [ebp + 0xc]
lea ecx, [edi + 0x34]
push eax
call fcn.00404270
mov ecx, ebx
call fcn.00455280
test al, al
jne 0x4595a6
xor bl, bl
jmp 0x4595af
mov ecx, ebx
call fcn.00453d90
mov bl, al
mov dword [ebp - 4], 0xffffffff
or ecx, 0xffffffff
mov edx, dword [ebp + 0xc]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x4595d1
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c2ae8
mov esp, ebp
pop ebp
ret 8
Function at 0x4610a0
Capabilities:
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f3768
mov eax, dword fs:[0]
push eax
sub esp, 0x210
mov eax, dword [0x674ff8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [ebp + 8]
mov dword [ebp - 4], 2
lea ecx, [esi + 0xe0]
push eax
call fcn.00404270
lea eax, [ebp + 0xc]
lea ecx, [esi + 0xe4]
push eax
call fcn.00404270
mov ecx, dword [esi + 0xe8]
test ecx, ecx
je 0x461122
cmp dword [ecx - 4], 0
lea eax, [ecx - 4]
je 0x46110f
mov eax, dword [ecx]
push 3
call dword [eax]
jmp 0x461118
push eax
call fcn.0047d17e
add esp, 4
mov dword [esi + 0xe8], 0
push dword [ebp + 0x10]
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntryW]
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.005c7190
add esp, 0xc
lea eax, [ebp - 0x218]
push 0
push 0
push 0x104
push eax
push dword [ebp + 0x10]
push 0
call dword [sym.imp.urlmon.dll_URLDownloadToCacheFileW]
push ecx
mov ecx, esp
test eax, eax
jne 0x461176
lea eax, [ebp - 0x218]
push eax
call fcn.00404b00
call fcn.0045ff20
jmp 0x46118a
push 0x63c638
call fcn.00404b00
mov ecx, 0xb5
call fcn.00401c80
mov edi, eax
mov dword [esi + 0xe8], eax
add esp, 4
test edi, edi
je 0x4611f9
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x21c], 0
push eax
push dword [edi + 4]
call dword [sym.imp.gdiplus.dll_GdipGetImageWidth]
test eax, eax
je 0x4611ba
mov dword [edi + 8], eax
mov eax, dword [ebp - 0x21c]
mov edi, dword [esi + 0xe8]
mov dword [esi + 0xec], eax
lea eax, [ebp - 0x21c]
push eax
mov dword [ebp - 0x21c], 0
push dword [edi + 4]
call dword [sym.imp.gdiplus.dll_GdipGetImageHeight]
test eax, eax
je 0x4611ed
mov dword [edi + 8], eax
mov eax, dword [ebp - 0x21c]
mov dword [esi + 0xf0], eax
mov byte [ebp - 4], 1
or esi, 0xffffffff
mov edx, dword [ebp + 8]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x46121a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
mov eax, esi
mov edx, dword [ebp + 0xc]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x461238
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp + 0x10]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x461257
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c2ae8
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4786f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
call fcn.00476db0
push dword [esi + 0x44]
mov dword [esi + 0x34], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
call fcn.0047d17e
mov ebx, dword [ebp + 8]
push 0
push 0
push ebx
mov dword [esi + 0x44], 0
call fcn.005d44c1
push ebx
call fcn.005d4523
add esp, 0x14
cmp eax, 0xffffffff
jne 0x478768
push ebx
call fcn.005d4650
add esp, 4
test eax, eax
je 0x478768
mov dword [esi + 0x34], 5
mov eax, 5
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
pop esi
pop ebx
pop ebp
ret 4
push edi
push 2
push 0
push ebx
call fcn.005d44c1
push ebx
call fcn.005d4bd2
push 0
push 0
push ebx
mov edi, eax
call fcn.005d44c1
add esp, 0x1c
cmp edi, 0xffffffff
je 0x4787ca
cmp edi, 0xffffffff
jae 0x4787ca
test edi, edi
jne 0x4787ad
mov dword [esi + 0x3c], edi
lea eax, [edi + 0xf]
mov dword [esi + 0x40], edi
pop edi
mov dword [esi + 0x34], 0xf
pop esi
pop ebx
pop ebp
ret 4
lea eax, [edi + 1]
push eax
call fcn.0047d175
push ebx
push edi
push 1
push eax
mov dword [esi + 0x44], eax
call fcn.005d4da9
add esp, 0x14
cmp eax, edi
je 0x4787eb
pop edi
mov dword [esi + 0x34], 5
mov eax, 5
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
pop esi
pop ebx
pop ebp
ret 4
mov eax, dword [esi + 0x44]
mov ecx, esi
mov byte [edi + eax], 0
call fcn.00478810
mov eax, dword [esi + 0x34]
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x4795e0
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f44d8
mov eax, dword fs:[0]
push eax
sub esp, 0x3c0
mov eax, dword [0x674ff8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
push 0x3bc
lea eax, [ebp - 0x3cc]
mov dword [ebp - 4], 0
push 0
push eax
call fcn.005c7190
push dword [ebp + 0xc]
lea eax, [ebp - 0x3b4]
mov dword [ebp - 0x3cc], 0x3bc
push eax
mov dword [ebp - 0x3c8], esi
mov dword [ebp - 0x3c0], 7
mov dword [ebp - 0x3bc], 0x465
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
mov dword [ebp - 0x3c4], 0
call fcn.00488823
push 0x80
mov eax, dword [eax + 0xc]
push eax
call dword [sym.imp.USER32.dll_LoadIconW]
mov dword [ebp - 0x3b8], eax
lea eax, [ebp - 0x3cc]
push eax
push 0
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
neg eax
mov dword [ebp - 4], 0xffffffff
sbb esi, esi
mov eax, dword [ebp + 0xc]
neg esi
add eax, 0xfffffff0
or ecx, 0xffffffff
lock xadd dword [eax + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x4796bb
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c2ae8
mov esp, ebp
pop ebp
ret 8
Function at 0x4796e0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f4500
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x674ff8]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x24], edx
mov ebx, ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 4], 0
push ebx
mov dword [ebp - 0x18], 0
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov edi, eax
test edi, edi
je 0x479774
push edi
call fcn.0047d175
add esp, 4
mov esi, eax
push edi
push 0
push esi
call fcn.005c7190
add esp, 0xc
push esi
push edi
push dword [ebp - 0x18]
push ebx
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
jne 0x479792
push esi
call fcn.0047d17e
add esp, 4
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.005c2ae8
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x20], 0
push eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x1c], 0
push eax
push 0x63d128
push esi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
push esi
test eax, eax
je 0x47976c
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x24]
movzx eax, word [ecx + 0xa]
mov word [edx], ax
movzx eax, word [ecx + 8]
mov edx, dword [ebp - 0x28]
mov word [edx], ax
movzx eax, word [ecx + 0xe]
mov edx, dword [ebp - 0x2c]
mov word [edx], ax
movzx eax, word [ecx + 0xc]
mov ecx, dword [ebp - 0x30]
mov word [ecx], ax
call fcn.0047d17e
add esp, 4
mov al, 1
jmp 0x479776
Function at 0x47ac60
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f4867
mov eax, dword fs:[0]
push eax
sub esp, 0x224
mov eax, dword [0x674ff8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ecx + 0x14]
lea ebx, [ecx + 0x14]
mov edi, dword [ebp + 8]
mov ecx, 0x63ca44
mov dword [ebp - 0x230], 0
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x47acce
test dx, dx
je 0x47acca
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x47acce
add eax, 4
add ecx, 4
test dx, dx
jne 0x47aca8
xor eax, eax
jmp 0x47acd3
sbb eax, eax
or eax, 1
test eax, eax
setne al
test al, al
je 0x47ace5
lea ecx, [esi - 0x10]
push ecx
jmp 0x47ae60
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.005c7190
add esp, 0xc
lea eax, [ebp - 0x218]
push 0
push 0x1c
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x47ad17
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
mov ecx, ebx
call fcn.004049c0
push 0x63d128
lea eax, [ebp - 0x22c]
push ebx
push eax
call fcn.0040a7c0
push str.Kakao
push eax
lea eax, [ebp - 0x228]
mov dword [ebp - 4], 0
push eax
call fcn.0040a7c0
push 0x63d128
push eax
lea eax, [ebp - 0x224]
mov byte [ebp - 4], 1
push eax
call fcn.0040a7c0
push 0x63d060
push eax
lea eax, [ebp - 0x220]
mov byte [ebp - 4], 2
push eax
call fcn.0040a7c0
push 0x63d128
push eax
lea eax, [ebp - 0x21c]
mov byte [ebp - 4], 3
push eax
call fcn.0040a7c0
add esp, 0x3c
push eax
mov ecx, ebx
mov byte [ebp - 4], 4
call fcn.00404270
mov byte [ebp - 4], 3
or esi, 0xffffffff
mov edx, dword [ebp - 0x21c]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x47add5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 2
mov eax, esi
mov edx, dword [ebp - 0x220]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x47adf6
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 1
mov eax, esi
mov edx, dword [ebp - 0x224]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x47ae17
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
mov eax, esi
mov edx, dword [ebp - 0x228]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x47ae38
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x22c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x47ae5a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebx]
sub eax, 0x10
push eax
call fcn.00404bc0
add esp, 4
add eax, 0x10
mov dword [edi], eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c2ae8
mov esp, ebp
pop ebp
ret 4
Function at 0x47b130
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f4931
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
mov eax, dword [0x674ff8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ecx + 0x1c]
lea ebx, [ecx + 0x1c]
mov edi, dword [ebp + 8]
mov ecx, 0x63ca44
mov dword [ebp - 0x228], 0
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x47b19e
test dx, dx
je 0x47b19a
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x47b19e
add eax, 4
add ecx, 4
test dx, dx
jne 0x47b178
xor eax, eax
jmp 0x47b1a3
sbb eax, eax
or eax, 1
test eax, eax
setne al
test al, al
je 0x47b1b5
lea ecx, [esi - 0x10]
push ecx
jmp 0x47b2c2
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.005c7190
add esp, 0xc
lea eax, [ebp - 0x218]
push 0
push 0x27
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x47b1e7
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
mov ecx, ebx
call fcn.004049c0
push 0x63d128
lea eax, [ebp - 0x224]
push ebx
push eax
call fcn.0040a7c0
push str.Game_Icon
push eax
lea eax, [ebp - 0x220]
mov dword [ebp - 4], 0
push eax
call fcn.0040a7c0
push 0x63d128
push eax
lea eax, [ebp - 0x21c]
mov byte [ebp - 4], 1
push eax
call fcn.0040a7c0
add esp, 0x24
push eax
mov ecx, ebx
mov byte [ebp - 4], 2
call fcn.00404270
mov byte [ebp - 4], 1
or esi, 0xffffffff
mov edx, dword [ebp - 0x21c]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x47b279
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
mov eax, esi
mov edx, dword [ebp - 0x220]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x47b29a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x224]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x47b2bc
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebx]
sub eax, 0x10
push eax
call fcn.00404bc0
add esp, 4
add eax, 0x10
mov dword [edi], eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c2ae8
mov esp, ebp
pop ebp
ret 4
Function at 0x47b2f0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f4931
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
mov eax, dword [0x674ff8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ecx + 0x20]
lea ebx, [ecx + 0x20]
mov edi, dword [ebp + 8]
mov ecx, 0x63ca44
mov dword [ebp - 0x228], 0
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x47b35e
test dx, dx
je 0x47b35a
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x47b35e
add eax, 4
add ecx, 4
test dx, dx
jne 0x47b338
xor eax, eax
jmp 0x47b363
sbb eax, eax
or eax, 1
test eax, eax
setne al
test al, al
je 0x47b375
lea ecx, [esi - 0x10]
push ecx
jmp 0x47b482
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.005c7190
add esp, 0xc
lea eax, [ebp - 0x218]
push 0
push 0x23
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x47b3a7
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
mov ecx, ebx
call fcn.004049c0
push 0x63d128
lea eax, [ebp - 0x224]
push ebx
push eax
call fcn.0040a7c0
push 0x63d060
push eax
lea eax, [ebp - 0x220]
mov dword [ebp - 4], 0
push eax
call fcn.0040a7c0
push 0x63d128
push eax
lea eax, [ebp - 0x21c]
mov byte [ebp - 4], 1
push eax
call fcn.0040a7c0
add esp, 0x24
push eax
mov ecx, ebx
mov byte [ebp - 4], 2
call fcn.00404270
mov byte [ebp - 4], 1
or esi, 0xffffffff
mov edx, dword [ebp - 0x21c]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x47b439
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
mov eax, esi
mov edx, dword [ebp - 0x220]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x47b45a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x224]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x47b47c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebx]
sub eax, 0x10
push eax
call fcn.00404bc0
add esp, 4
add eax, 0x10
mov dword [edi], eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c2ae8
mov esp, ebp
pop ebp
ret 4
Function at 0x47b540
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x674ff8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ecx + 0x5c]
push esi
lea esi, [ecx + 0x5c]
mov dword [ebp - 0x214], 0
push edi
mov edi, dword [ebp + 8]
mov ecx, 0x63ca44
nop dword [eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x47b596
test dx, dx
je 0x47b592
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x47b596
add eax, 4
add ecx, 4
test dx, dx
jne 0x47b570
xor eax, eax
jmp 0x47b59b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x47b5fe
push 0x208
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.005c7190
add esp, 0xc
mov dword [ebp - 0x210], 0x208
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x47b5e0
sub ecx, edx
lea eax, [ebp - 0x20c]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.004049c0
mov ecx, dword [esi]
sub ecx, 0x10
push ecx
call fcn.00404bc0
mov ecx, dword [ebp - 4]
add esp, 4
add eax, 0x10
xor ecx, ebp
mov dword [edi], eax
mov eax, edi
pop edi
pop esi
call fcn.005c2ae8
mov esp, ebp
pop ebp
ret 4

Function at 0x47c340
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f4b08
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x674ff8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp byte [edi + 8], 0
mov ebx, dword [sym.imp.ole32.dll_CoUninitialize]
je 0x47c39c
mov ecx, dword [edi]
test ecx, ecx
je 0x47c386
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [edi], 0
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x47c39a
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [edi + 4], 0
call ebx
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
js 0x47c3c6
push 0
push 0
push 0
push 3
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
test eax, eax
jns 0x47c3da
call ebx
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea esi, [edi + 4]
push esi
push 0x632694
push 1
push 0
push 0x632764
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x47c3c4
push str.ROOTCIMV2
lea ecx, [ebp - 0x10]
call fcn.0047d090
mov dword [ebp - 4], 0
mov eax, dword [eax]
test eax, eax
je 0x47c414
mov edx, dword [eax]
jmp 0x47c416
xor edx, edx
mov eax, dword [esi]
push edi
push 0
push 0
mov ecx, dword [eax]
push 0
push 0
push 0
push 0
push edx
push eax
call dword [ecx + 0xc]
lea ecx, [ebp - 0x10]
mov esi, eax
call fcn.0047d030
test esi, esi
js 0x47c3c4
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push dword [edi]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
js 0x47c3c4
mov byte [edi + 8], 1
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x47e71f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor esi, esi
call fcn.00488823
push 5
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x47e756
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
mov ecx, dword [ebp - 4]
push ebx
push dword [ebp + 0xc]
push esi
call fcn.0047e777
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x48366c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 4], ecx
mov esi, edi
cmp dword [ebp + 8], esi
je 0x4836b1
call fcn.00488823
push 0xf0
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x4836b1
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x4836cd
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.0048ce23
mov ebx, eax
test edi, edi
je 0x4836cb
test esi, esi
je 0x4836cb
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4840bf
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
je 0x48417d
cmp dword [esi + 0x20], 0
je 0x48417d
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x48417d
cmp dword [ebp + 8], 0
je 0x48417d
xor eax, eax
mov ebx, eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], ebx
mov edi, eax
call fcn.00488823
push 0x605750
push dword [ebp + 8]
mov eax, dword [eax + 0xc]
push eax
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x48414e
mov edi, dword [ebp - 0xc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp - 0x10]
mov dword [ebp - 4], eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x48417d
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov dword [ebp - 8], eax
push dword [ebp - 4]
push ebx
push esi
call fcn.004beae6
add esp, 0xc
mov ebx, eax
cmp dword [ebp - 8], 0
je 0x48416e
test edi, edi
je 0x48416e
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
test ebx, ebx
je 0x484179
mov ecx, esi
call fcn.00483e62
mov eax, ebx
jmp 0x48417f
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4