joyce8/EMBER2024-capa huggingface dataset:
Function at 0x529ef7
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
xor esi, esi
call dword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
cmp dword [0x63e024], eax
je 0x529f18
mov eax, 0x10dd
jmp 0x52a0e6
mov eax, dword [0x63def4]
test eax, eax
jne 0x52a0e6
mov ecx, dword [0x63c630]
test ecx, ecx
jne 0x529f46
push 6
pop eax
mov dword [0x63def4], eax
mov dword [0x63e18c], 0x63c630
jmp 0x52a0e6
push ebx
push edi
mov ebx, esi
mov edi, esi
call fcn.005297db
mov ecx, 0x4e5ec0
mov dword [ebp - 4], eax
call fcn.005297db
mov dword [ebp - 0x1c], eax
cmp eax, dword [ebp - 4]
jne 0x529f77
cmp dword [0x63e198], ebx
jne 0x52a0d8
jmp 0x52a0b9
push 0x18
call fcn.00413631
mov edi, eax
pop ecx
test edi, edi
jne 0x529f8d
push 8
pop esi
jmp 0x52a0b9
mov ecx, dword [ebp - 4]
call fcn.005298be
mov ebx, eax
test ebx, ebx
je 0x529f85
mov eax, dword [ebp - 4]
mov edx, esi
jmp 0x529fa5
mov eax, dword [ebp - 8]
lea ecx, [ebp - 0xc]
mov dword [ebp - 0x18], eax
push ecx
lea ecx, [edx + ebx]
mov dword [ebp - 0xc], esi
push esi
mov edx, eax
call fcn.0052bbcc
mov dword [ebp - 8], eax
cmp dword [ebp - 0xc], esi
jne 0x52a0ad
mov ecx, dword [ebp - 0x18]
mov edx, eax
sub edx, dword [ebp - 4]
mov dword [ebp - 0x10], edx
call fcn.00529821
test eax, eax
jne 0x529fdf
cmp edx, 5
jl 0x529fa2
cmp edx, 5
jl 0x52a0ad
cmp edx, 0x12
jbe 0x529ff1
push 6
jmp 0x529f87
mov eax, dword [ebp - 8]
lea edx, [ebx + 0x17]
mov dword [ebx + 0x18], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebx + 0x1c], eax
mov eax, dword [ebp - 0x10]
mov byte [edx], al
lea ecx, [eax + ebx]
lea eax, [ecx + 5]
mov byte [ecx], 0xe9
sub dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ecx + 1], eax
add ecx, 5
call fcn.005297b2
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], esi
push eax
push 0x40
push dword [ebp - 0x10]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
test eax, eax
jne 0x52a042
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov esi, eax
jmp 0x52a0b9
mov ecx, dword [ebp - 4]
call fcn.00529ac6
mov dword [ebp - 0x18], eax
test eax, eax
je 0x52a083
mov ecx, 0x6544
cmp word [eax + 0x1c], cx
je 0x52a083
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x1c], esi
push ecx
push 0x40
push 0x40
push eax
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
test eax, eax
je 0x52a038
mov eax, dword [ebp - 0x18]
mov dword [eax + 0x1c], 0x6f746544
mov dword [eax + 0x20], 0x21737275
mov eax, dword [ebp - 4]
mov dword [edi + 0xc], eax
mov dword [edi + 4], esi
mov dword [edi + 8], 0x63c630
mov dword [edi + 0x10], ebx
mov eax, dword [ebp - 0x14]
mov dword [edi + 0x14], eax
mov eax, dword [0x63e19c]
mov dword [edi], eax
xor eax, eax
mov dword [0x63e19c], edi
jmp 0x52a0e4
cmp dword [0x63e198], 0
push 9
pop esi
jne 0x52a0c3
mov dword [0x63def4], esi
test ebx, ebx
je 0x52a0ca
mov ecx, ebx
call fcn.00529aa5
test edi, edi
je 0x52a0d8
push 0x18
push edi
call fcn.0056d0c8
pop ecx
pop ecx
mov dword [0x63e18c], 0x63c630
mov eax, esi
pop edi
pop ebx
pop esi
leave
ret 0xc
Function at 0x52a0eb
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov dword [ebp - 8], edx
mov ebx, ecx
call dword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
cmp dword [0x63e024], eax
je 0x52a10e
mov eax, 0x10dd
jmp 0x52a1ee
mov eax, dword [0x63def4]
test eax, eax
jne 0x52a1ee
test ebx, ebx
jne 0x52a127
push 6
pop eax
jmp 0x52a1ee
cmp dword [ebx], 0
jne 0x52a13f
push 6
pop eax
mov dword [0x63def4], eax
mov dword [0x63e18c], ebx
jmp 0x52a1ee
push esi
push edi
push 0x18
call fcn.00413631
mov esi, eax
pop ecx
test esi, esi
jne 0x52a154
push 8
pop edi
jmp 0x52a1d0
mov ecx, dword [ebp - 8]
mov edi, dword [ebx]
call fcn.005297db
movzx ecx, byte [edi + 0x17]
mov edx, eax
mov eax, dword [edi + 0x18]
sub eax, ecx
mov dword [ebp - 8], eax
test ecx, ecx
je 0x52a1c4
cmp ecx, 0x17
ja 0x52a1c4
cmp dword [edi + 0x1c], edx
jne 0x52a1c4
and dword [ebp - 4], 0
lea edx, [ebp - 4]
push edx
push 0x40
push ecx
push eax
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
test eax, eax
jne 0x52a19a
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov edi, eax
jmp 0x52a1d0
mov eax, dword [ebp - 8]
mov dword [esi + 0xc], eax
mov dword [esi + 4], 1
mov dword [esi + 8], ebx
mov dword [esi + 0x10], edi
mov eax, dword [ebp - 4]
mov dword [esi + 0x14], eax
mov eax, dword [0x63e19c]
mov dword [esi], eax
xor eax, eax
mov dword [0x63e19c], esi
jmp 0x52a1ec
cmp dword [0x63e198], 0
push 9
pop edi
jne 0x52a1da
mov dword [0x63def4], edi
test esi, esi
je 0x52a1e4
push 0x18
push esi
call fcn.0056d0c8
pop ecx
pop ecx
mov dword [0x63e18c], ebx
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x52a226
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x634254]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
xor eax, eax
push 3
pop esi
inc eax
mov dword [ebp - 0x10c], 0x104
mov dword [ebp - 0x110], eax
mov ebx, ecx
lea eax, [ebp - 0x11c]
xor ecx, ecx
push eax
push 0x20019
push ecx
push str.SystemCurrentControlSetControlNetwork4D36E972_E325_11CE_BFC1_08002BE10318
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x11c], ecx
mov dword [ebp - 0x118], ecx
mov dword [ebp - 0x114], ecx
call edi
test eax, eax
jne 0x52a3d4
push ebx
push str._sConnection
lea eax, [ebp - 0x108]
push 0x103
push eax
call fcn.0052a843
add esp, 0x10
lea eax, [ebp - 0x118]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 0x11c]
call edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x52a3cc
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 4
pop eax
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x10c], eax
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x110]
push eax
push 0
push str.MediaSubType
push dword [ebp - 0x118]
call ebx
test eax, eax
jne 0x52a3c4
push 0x104
push eax
lea eax, [ebp - 0x108]
mov dword [ebp - 0x110], 1
push eax
mov dword [ebp - 0x10c], 0x103
call fcn.005713c0
add esp, 0xc
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x110]
push eax
push 0
push str.PnpInstanceID
push dword [ebp - 0x118]
call ebx
test eax, eax
jne 0x52a3c4
mov eax, dword [ebp - 0x114]
xor ebx, ebx
inc ebx
cmp eax, ebx
jne 0x52a3be
push esi
lea eax, [ebp - 0x108]
push 0x6154a8
push eax
call fcn.005a1bf0
add esp, 0xc
test eax, eax
jne 0x52a390
xor esi, esi
jmp 0x52a3c4
mov eax, dword [ebp - 0x114]
cmp eax, ebx
jne 0x52a3be
push esi
lea eax, [ebp - 0x108]
push 0x6154a8
push eax
call fcn.005a1bf0
add esp, 0xc
test eax, eax
je 0x52a3b8
push 2
pop esi
jmp 0x52a3c4
mov eax, dword [ebp - 0x114]
cmp eax, 2
cmove esi, ebx
push dword [ebp - 0x118]
call edi
push dword [ebp - 0x11c]
call edi
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0056d855
leave
ret
Function at 0x52a62c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2aa0
call fcn.0056d570
mov eax, dword [0x634254]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, 0x208
lea eax, [ebp - 0x20c]
push esi
xor ebx, ebx
mov edi, ecx
push ebx
push eax
call fcn.005713c0
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryW]
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x52a67b
sub ecx, edx
sar ecx, 1
test ecx, ecx
jle 0x52a6bc
push 0x5c
pop eax
cmp ax, word [ebp + ecx*2 - 0x20e]
je 0x52a6bc
mov word [ebp + ecx*2 - 0x20c], ax
lea ecx, [ecx*2 + 2]
cmp ecx, esi
jae 0x52a815
xor eax, eax
mov word [ebp + ecx - 0x20c], ax
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x52a6c5
sub ecx, edx
mov edx, 0x104
sar ecx, 1
mov eax, edx
sub eax, ecx
push eax
push str.iphlpapi.dll
push edx
lea eax, [ebp - 0x20c]
push eax
call fcn.005a81c5
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.DLL_LoadLibraryW]
mov dword [ebp - 0x2aa0], eax
test eax, eax
jne 0x52a711
xor al, al
jmp 0x52a806
push str.GetAdaptersInfo
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
test eax, eax
je 0x52a7dd
lea ecx, [ebp - 0x2a9c]
mov dword [ebp - 0x2a9c], 0x2880
push ecx
lea ecx, [ebp - 0x2a8c]
push ecx
call eax
test eax, eax
jne 0x52a7dd
push 3
lea esi, [ebp - 0x2a8c]
pop ebx
lea ecx, [esi + 8]
call fcn.0052a226
mov dword [ebp - 0x2a98], eax
mov ecx, edi
xor eax, eax
mov dword [ebp - 0x2a94], eax
mov word [ebp - 0x2a90], ax
lea eax, [ebp - 0x2a94]
push eax
call fcn.0052a1f1
test al, al
jne 0x52a794
cmp dword [esi + 0x1a0], 6
jne 0x52a7d1
mov ecx, dword [ebp - 0x2a98]
cmp ebx, ecx
jle 0x52a7d1
jmp 0x52a79a
mov ecx, dword [ebp - 0x2a98]
mov al, byte [esi + 0x194]
mov ebx, ecx
mov byte [edi], al
mov al, byte [esi + 0x195]
mov byte [edi + 1], al
mov al, byte [esi + 0x196]
mov byte [edi + 2], al
mov al, byte [esi + 0x197]
mov byte [edi + 3], al
mov al, byte [esi + 0x198]
mov byte [edi + 4], al
mov al, byte [esi + 0x199]
mov byte [edi + 5], al
mov esi, dword [esi]
test esi, esi
jne 0x52a750
xor ebx, ebx
push dword [ebp - 0x2aa0]
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
lea eax, [ebp - 0x2a94]
mov dword [ebp - 0x2a94], ebx
push eax
mov ecx, edi
mov word [ebp - 0x2a90], bx
call fcn.0052a1f1
xor al, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0056d855
leave
ret
call fcn.0056db47
int3
Function at 0x52b6d7
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
mov eax, dword [0x634254]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
call fcn.00465f8d
cmp eax, 5
jle 0x52b774
push 0x1d
pop ecx
mov esi, str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem_
lea edi, [ebp - 0x80]
rep movsd dword es:[edi], dword [esi]
push 4
pop eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x88], eax
lea eax, [ebp - 0x84]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x80]
movsw word es:[edi], word [esi]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x52b774
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0x8c]
push eax
push ebx
push str.EnableLUA
push dword [ebp - 0x84]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp - 0x90], 1
push dword [ebp - 0x84]
sete bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0056d855
leave
ret

Function at 0x52d154
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ecx]
lea edx, [ebp - 0x18]
push ebx
push edx
call dword [eax + 0x10]
cmp dword [ebp - 8], 0
je 0x52d184
cmp dword [ebp - 4], 8
lea eax, [ebp - 0x18]
cmovae eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x52d184
mov bl, 1
jmp 0x52d186
xor bl, bl
lea ecx, [ebp - 0x18]
call fcn.00403730
mov al, bl
pop ebx
leave
ret
Function at 0x52d198
Capabilities:
Check if file exists
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [ecx]
lea edx, [ebp - 0x38]
push ebx
push esi
push edi
push edx
call dword [eax + 0x10]
cmp dword [ebp - 0x28], 0
je 0x52d2ec
cmp dword [ebp - 0x24], 8
lea eax, [ebp - 0x38]
cmovae eax, dword [ebp - 0x38]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x52d2ec
cmp dword [ebp - 0x24], 8
lea eax, [ebp - 0x38]
cmovae eax, dword [ebp - 0x38]
xor ebx, ebx
push ebx
push ebx
push 3
push ebx
push ebx
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x52d208
mov edi, dword [ebp + 8]
mov ecx, edi
push 0x609b28
call fcn.0043e7a7
jmp 0x52d2d9
push ebx
push esi
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x52d22b
mov edi, dword [ebp + 8]
mov ecx, edi
push 0x609b28
call fcn.0043e7a7
jmp 0x52d2d5
push ebx
lea eax, [edi + 1]
mov dword [ebp - 0x20], ebx
push eax
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], 0xf
call fcn.0044202f
cmp dword [ebp - 0xc], 0x10
lea ecx, [ebp - 4]
push ebx
push ecx
lea eax, [ebp - 0x20]
mov dword [ebp - 4], ebx
cmovae eax, dword [ebp - 0x20]
push edi
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
je 0x52d282
cmp edi, dword [ebp - 4]
jne 0x52d282
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x20]
push eax
mov ecx, edi
mov dword [edi], ebx
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
call fcn.0043e71b
jmp 0x52d291
mov edi, dword [ebp + 8]
mov ecx, edi
push 0x609b28
call fcn.0043e7a7
mov eax, dword [ebp - 0xc]
cmp eax, 0x10
jb 0x52d2c8
mov ecx, dword [ebp - 0x20]
inc eax
mov dword [ebp - 8], ecx
mov dword [ebp + 8], eax
cmp eax, 0x1000
jb 0x52d2bf
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 8]
push eax
call fcn.0040379f
mov eax, dword [ebp + 8]
pop ecx
pop ecx
mov ecx, dword [ebp - 8]
push eax
push ecx
call fcn.0056d0c8
pop ecx
pop ecx
mov byte [ebp - 0x20], bl
mov dword [ebp - 0xc], 0xf
mov dword [ebp - 0x10], ebx
test esi, esi
je 0x52d2e0
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
lea ecx, [ebp - 0x38]
call fcn.00403730
mov eax, edi
jmp 0x52d304
mov ecx, dword [ebp + 8]
push 0x609b28
call fcn.0043e7a7
lea ecx, [ebp - 0x38]
call fcn.00403730
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x52d926
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x830
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, esi
push edi
cmp dword [esi + 0x14], 8
jb 0x52d93f
mov eax, dword [esi]
push 0x5dffa0
push eax
call dword [sym.imp.SHLWAPI.dll_PathMatchSpecW]
test eax, eax
je 0x52dabe
mov ebx, dword [ebp + 0x14]
xor edi, edi
cmp dword [ebx], edi
je 0x52dabe
push 0x800
lea eax, [ebp - 0x830]
push edi
push eax
call fcn.005713c0
add esp, 0xc
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x52d97f
mov eax, dword [esi]
push eax
push 0x400
lea eax, [ebp - 0x830]
push eax
push edi
push 0x60a030
push str.InternetShortcut
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringW]
cmp word [ebp - 0x830], di
je 0x52dabe
push 0x14
call fcn.00413631
pop ecx
test eax, eax
je 0x52d9bf
mov ecx, eax
call fcn.0043a335
mov edi, eax
lea eax, [ebp - 0x830]
push eax
lea ecx, [ebp - 0x18]
call fcn.00408981
push 0x60a200
lea ecx, [ebp - 0x30]
call fcn.00408981
lea eax, [ebp - 0x18]
push eax
call fcn.0043a6cb
pop ecx
push eax
lea eax, [ebp - 0x30]
mov ecx, edi
push eax
call fcn.0043ad50
lea ecx, [ebp - 0x30]
call fcn.00403730
lea ecx, [ebp - 0x18]
call fcn.00403730
push 0x5dfe04
lea ecx, [ebp - 0x18]
call fcn.00408981
sub esp, 0x18
xor eax, eax
mov ecx, esp
push esi
mov dword [ecx], eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], eax
call fcn.00407eca
lea eax, [ebp - 0x30]
push eax
call fcn.004d0b40
push eax
call fcn.0043a6cb
add esp, 0x20
mov ecx, edi
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.0043ad50
lea ecx, [ebp - 0x30]
call fcn.00403730
lea ecx, [ebp - 0x18]
call fcn.00403730
mov esi, dword [ebp + 0xc]
cmp dword [esi + 0x10], 0
je 0x52da82
push str.path
lea ecx, [ebp - 0x18]
call fcn.00408981
push esi
call fcn.0043a6cb
pop ecx
push eax
lea eax, [ebp - 0x18]
mov ecx, edi
push eax
call fcn.0043ad50
lea ecx, [ebp - 0x18]
call fcn.00403730
push 0x5dfe10
lea ecx, [ebp - 0x18]
call fcn.00408981
push dword [ebp + 0x10]
call fcn.0043a6cb
pop ecx
push eax
lea eax, [ebp - 0x18]
mov ecx, edi
push eax
call fcn.0043ad50
lea ecx, [ebp - 0x18]
call fcn.00403730
mov ecx, dword [ebx]
push edi
mov eax, dword [ecx + 0x10]
sub eax, dword [ecx + 0xc]
sar eax, 2
push eax
call fcn.0043b731
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x52e18d
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x268
push ebx
push edi
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x28], ebx
je 0x52e1b4
lea eax, [edi + 0x18]
push eax
mov ecx, dword [ebp + 8]
call fcn.00405d53
mov al, 1
jmp 0x52e29d
cmp dword [edi + 0x14], 8
mov eax, edi
jb 0x52e1be
mov eax, dword [edi]
push ebx
push ebx
push 3
push ebx
push ebx
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
cmp eax, 0xffffffff
je 0x52e1e3
test eax, eax
je 0x52e1e3
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push edi
jmp 0x52e1a5
push 0x250
lea eax, [ebp - 0x268]
push ebx
push eax
call fcn.005713c0
add esp, 0xc
mov eax, edi
cmp dword [edi + 0x14], 8
jb 0x52e202
mov eax, dword [edi]
push esi
lea ecx, [ebp - 0x268]
push ecx
push eax
call dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
cmp eax, 0xffffffff
mov esi, ebx
push eax
cmovne esi, dword [ebp - 0x248]
call dword [sym.imp.KERNEL32.DLL_FindClose]
cmp esi, 0x1400000
ja 0x52e28a
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x18]
push 0x5e0054
push esi
push eax
add edi, 0x18
call fcn.0044c79e
add esp, 0xc
mov ecx, edi
push eax
call fcn.004443e3
lea ecx, [ebp - 0x18]
call fcn.00403730
cmp dword [edi + 0x14], 8
mov ecx, edi
jb 0x52e25e
mov ecx, dword [edi]
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x52e268
mov eax, dword [esi]
push ebx
push ecx
push eax
call dword [sym.imp.KERNEL32.DLL_CopyFileW]
test eax, eax
jne 0x52e28e
mov esi, 0x605890
push esi
call fcn.0057bbea
pop ecx
push eax
push esi
mov ecx, edi
call fcn.00407684
xor al, al
jmp 0x52e29c
push edi
mov ecx, esi
call fcn.00405d53
cmp dword [esi + 0x10], ebx
setne al
pop esi
pop edi
pop ebx
leave
ret 4
Function at 0x52f8da
Capabilities:
Check if file exists
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp method.CBrowser360.virtual_12

Function at 0x531370
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, ecx
push dword [edi + 4]
mov dword [edi], vtable.CCfgMgr.0
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x531397
push dword [edi + 4]
call dword [sym.imp.USER32.dll_DestroyWindow]
and dword [edi + 4], 0
mov eax, dword [edi + 0x5a4]
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_TerminateThread]
test eax, eax
je 0x5313ae
push 0xffffffffffffffff
push eax
call esi
mov eax, dword [edi + 0x5ac]
test eax, eax
je 0x5313bd
push 0xffffffffffffffff
push eax
call esi
mov eax, dword [edi + 0x5b0]
test eax, eax
je 0x5313cc
push 0xffffffffffffffff
push eax
call esi
lea esi, [edi + 0x630]
lea ecx, [esi + 0x18]
call fcn.00403730
mov ecx, esi
call fcn.00403730
lea ecx, [edi + 0x624]
call fcn.00538138
lea ecx, [edi + 0x618]
call fcn.00538138
lea ecx, [edi + 0x60c]
call fcn.00538138
lea ecx, [edi + 0x600]
call fcn.00538138
lea ecx, [edi + 0x5f4]
call fcn.00538138
lea ecx, [edi + 0x5e8]
call fcn.00538138
lea ecx, [edi + 0x5e4]
call fcn.00531332
lea ecx, [edi + 0x5d8]
call fcn.00538090
lea ecx, [edi + 0x5cc]
call fcn.00538090
lea ecx, [edi + 0x5bc]
call fcn.005380e4
push 0x17
pop ebx
mov dword [ebp - 4], ebx
mov esi, ebx
lea ebx, [edi + 0x59c]
sub ebx, 0x18
mov ecx, ebx
call fcn.00403730
sub esi, 1
jne 0x53145d
mov ebx, dword [ebp - 4]
lea esi, [edi + 0x374]
sub esi, 0x18
mov ecx, esi
call fcn.00403730
sub ebx, 1
jne 0x531475
cmp dword [edi + 0x14], ebx
pop esi
pop ebx
je 0x531493
push dword [edi + 0x14]
call fcn.0055319c
pop edi
leave
ret

Function at 0x532f65
Capabilities:
Create thread

Disassembly:
push esi
push 1
push 0x10
mov esi, ecx
call fcn.00534fd4
test eax, eax
je 0x532f7d
mov ecx, esi
pop esi
jmp fcn.00534e71
pop esi
ret

Function at 0x533149
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
mov edx, dword [esi + 0x5e4]
test edx, edx
je 0x533182
mov eax, dword [edx + 4]
sub eax, dword [edx]
test eax, 0xfffffff8
je 0x533182
xor eax, eax
push eax
push eax
push edx
push 0x533184
push eax
push eax
mov dword [esi + 0x5e4], eax
call fcn.00592655
add esp, 0x18
mov dword [esi + 0x5ac], eax
pop esi
ret
Function at 0x534364
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push 0x3c
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x40], 0x40
push 0
push eax
call fcn.005713c0
add esp, 0xc
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.DLL_GlobalMemoryStatusEx]
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
shrd ecx, eax, 0x14
shr eax, 0x14
push eax
push ecx
push dword [ebp + 8]
call fcn.00530c4f
mov eax, dword [ebp + 8]
add esp, 0xc
leave
ret

Function at 0x535cb8
Capabilities:
Create thread
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
mov al, byte [ebp + 0xc]
sub esp, 0x1c
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov byte [esi + 0x5a1], al
mov eax, dword [ebp + 8]
cmp dword [eax + 0x10], ebx
jne 0x535d88
push str.FILE
push 0xc9
push ebx
call dword [sym.imp.KERNEL32.DLL_FindResourceW]
mov edi, eax
test edi, edi
je 0x535d81
push edi
push ebx
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
push edi
push 0
mov ebx, eax
call dword [sym.imp.KERNEL32.DLL_LoadResource]
mov edi, eax
test edi, edi
je 0x535d81
test ebx, ebx
je 0x535d81
push edi
call dword [sym.imp.KERNEL32.DLL_LockResource]
and dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x1c]
and dword [ebp - 0xc], 0
push ebx
push eax
mov dword [ebp - 8], 0xf
call fcn.0043cf29
push edi
call dword [sym.imp.KERNEL32.DLL_FreeResource]
lea eax, [ebp - 0x1c]
mov ecx, esi
push eax
call fcn.00537562
mov ecx, dword [ebp - 8]
mov byte [ebp + 0xf], al
cmp ecx, 0x10
jb 0x535d91
mov edx, dword [ebp - 0x1c]
inc ecx
mov dword [ebp + 8], ecx
mov dword [ebp - 4], edx
cmp ecx, 0x1000
jb 0x535d76
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 4]
push eax
call fcn.0040379f
mov edx, dword [ebp - 4]
pop ecx
pop ecx
mov ecx, dword [ebp + 8]
push ecx
push edx
call fcn.0056d0c8
pop ecx
pop ecx
jmp 0x535d91
xor al, al
jmp 0x535e27
push eax
call fcn.00537562
mov byte [ebp + 0xf], al
lea ebx, [esi + 0x648]
lea edi, [esi + 0x630]
push ebx
push edi
call fcn.00537ac7
xor eax, eax
pop ecx
pop ecx
cmp dword [esi + 0x1bc], eax
jne 0x535de4
cmp byte [esi + 0x5a1], al
jne 0x535dd8
cmp dword [esi + 0x640], eax
je 0x535dd8
push eax
push eax
push edi
push 0x5352e6
push eax
push eax
call fcn.00592655
add esp, 0x18
mov dword [esi + 0x5b0], eax
push ebx
lea ecx, [esi + 0x1ac]
call fcn.00405d53
push 6
lea eax, [ebp - 0x1c]
mov ecx, esi
push eax
call fcn.00535b5d
push eax
call fcn.00538737
mov ecx, eax
call fcn.00538be4
lea ecx, [ebp - 0x1c]
call fcn.00403730
cmp byte [esi + 0x5a1], 0
jne 0x535e1d
xor eax, eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov ecx, esi
call fcn.00536b85
mov al, byte [ebp + 0xf]
pop edi
pop esi
pop ebx
leave
ret 8