joyce8/EMBER2024-capa huggingface dataset:
Function at 0x480b70
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58282e
mov eax, dword fs:[0]
push eax
sub esp, 0xa4
mov eax, dword [0x604e14]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_EndUpdateResourceW]
mov dword [ebp - 0x18], eax
lea edx, [ebp + 8]
push edx
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x608f38
call fcn.00481640
lea ecx, [ebp - 0x9c]
push ecx
mov ecx, 0x608f38
call fcn.00480e30
push eax
lea ecx, [ebp - 0x14]
call fcn.00481700
movzx edx, al
test edx, edx
je 0x480d56
lea ecx, [ebp - 0x14]
call fcn.004816e0
mov eax, dword [eax + 4]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
cmp dword [ecx + 0x208], 1
jne 0x480d0d
lea edx, [ebp - 0x24]
push edx
mov eax, dword [ebp - 0x1c]
push eax
call fcn.0045ee60
add esp, 8
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x480d0d
lea ecx, [ebp - 0x8c]
call fcn.00461040
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x24]
push ecx
mov edx, dword [ebp - 0x20]
push edx
lea ecx, [ebp - 0x8c]
call fcn.00461100
cmp eax, 1
jne 0x480ca8
mov eax, dword [ebp - 0x1c]
cmp dword [eax + 0x208], 1
jne 0x480c68
push 0
push 0x5b7488
push 0x5b7490
lea ecx, [ebp - 0x8c]
call fcn.0046b3a0
lea ecx, [ebp - 0x8c]
call fcn.0046c9a0
mov dword [ebp - 0x90], eax
push 0x5b7498
lea ecx, [ebp - 0x8c]
call fcn.00461620
push eax
lea ecx, [ebp - 0x90]
push ecx
lea ecx, [ebp - 0x8c]
call fcn.004613c0
push eax
lea ecx, [ebp - 0x8c]
call fcn.004625a0
push 0
push 0
push 3
push 0
push 1
push 0x40000000
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xffffffff
je 0x480cef
push 0
lea eax, [ebp - 0x94]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
mov edx, dword [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x20]
push edx
call fcn.0045ee40
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8c]
call fcn.004610a0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xa0], eax
mov ecx, dword [ebp - 0xa0]
push ecx
call fcn.0052604e
add esp, 4
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0xa8], edx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xa4], eax
mov ecx, dword [ebp - 0xa4]
push ecx
mov edx, dword [ebp - 0xa8]
push edx
lea eax, [ebp - 0xb0]
push eax
mov ecx, 0x608f38
call fcn.00480e60
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x483660
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov dword [eax], 0x67452301
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], 0xefcdab89
mov edx, dword [ebp - 4]
mov dword [edx + 8], 0x98badcfe
mov eax, dword [ebp - 4]
mov dword [eax + 0xc], 0x10325476
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], 0xc3d2e1f0
mov edx, dword [ebp - 4]
mov dword [edx + 0x14], 0
mov eax, dword [ebp - 4]
mov dword [eax + 0x18], 0
mov esp, ebp
pop ebp
ret
Function at 0x498aa0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x10]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
movzx eax, byte [edx + 0x14]
xor eax, 3
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x498b70
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x10]
sub ecx, 1
mov dword [ebp + 0x10], ecx
test eax, eax
jbe 0x498b70
mov edx, dword [ebp - 4]
movzx eax, byte [edx + 4]
cmp eax, 8
jne 0x498b03
push 0xfffffffffffffffd
mov ecx, dword [ebp - 4]
add ecx, 0x68
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00498aa0
add esp, 0xc
mov eax, dword [ebp - 4]
movzx ecx, byte [eax + 5]
xor ecx, 3
and ecx, dword [ebp - 0xc]
je 0x498b3b
mov edx, dword [ebp - 4]
movzx eax, byte [edx + 5]
and eax, 0xf8
mov ecx, dword [ebp - 8]
movzx edx, byte [ecx + 0x14]
and edx, 3
movzx ecx, dl
or eax, ecx
mov edx, dword [ebp - 4]
mov byte [edx + 5], al
mov eax, dword [ebp - 4]
mov dword [ebp + 0xc], eax
jmp 0x498b6b
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ecx], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
cmp edx, dword [ecx + 0x1c]
jne 0x498b5b
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov dword [eax + 0x1c], edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00498b80
add esp, 8
jmp 0x498abc
mov eax, dword [ebp + 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x49ae90
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x604e14]
xor eax, ebp
mov dword [ebp - 8], eax
lea eax, [ebp - 0x218]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0048fe20
add esp, 8
mov dword [ebp - 0x21c], 0x200
lea edx, [ebp - 0x218]
push edx
call fcn.0048fb60
add esp, 4
mov dword [ebp - 0x220], eax
mov eax, dword [ebp - 0x21c]
cmp eax, dword [ebp + 0x10]
jbe 0x49aee9
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x21c], ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x21c]
push eax
push 1
mov ecx, dword [ebp - 0x220]
push ecx
call fcn.0055b441
add esp, 0x10
mov dword [ebp - 4], eax
mov edx, dword [ebp - 0x218]
add edx, dword [ebp - 4]
mov dword [ebp - 0x218], edx
mov eax, dword [ebp + 0x10]
sub eax, dword [ebp - 4]
mov dword [ebp + 0x10], eax
je 0x49af2d
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x21c]
je 0x49aec0
lea edx, [ebp - 0x218]
push edx
call fcn.0048fd30
add esp, 4
cmp dword [ebp + 0x10], 0
je 0x49af60
push 0xffffffffffffffff
mov eax, dword [ebp + 8]
push eax
call fcn.0048d880
add esp, 8
test eax, eax
ja 0x49af60
mov dword [ebp - 0x224], 0
jmp 0x49af6a
mov dword [ebp - 0x224], 1
mov eax, dword [ebp - 0x224]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00555ac5
mov esp, ebp
pop ebp
ret
Function at 0x49b0a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
push eax
call fcn.0048ce80
add esp, 4
sub eax, 1
mov dword [ebp - 8], eax
mov dword [ebp - 4], 1
jmp 0x49b0ca
mov ecx, dword [ebp + 0x10]
add ecx, 1
mov dword [ebp + 0x10], ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 8]
sub eax, 1
mov dword [ebp - 8], eax
test edx, edx
je 0x49b1e6
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0048d2f0
add esp, 8
cmp eax, 3
jne 0x49b193
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0048d430
add esp, 8
test eax, eax
je 0x49b150
cmp dword [ebp - 4], 0
je 0x49b141
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0048d710
add esp, 8
push edx
push eax
push 0x5b8de4
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0055886d
add esp, 0x10
test eax, eax
jle 0x49b141
mov dword [ebp - 0x14], 1
jmp 0x49b148
mov dword [ebp - 0x14], 0
mov edx, dword [ebp - 0x14]
mov dword [ebp - 4], edx
jmp 0x49b191
cmp dword [ebp - 4], 0
je 0x49b184
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0048d6a0
fstp qword [esp]
push 0x5b8dec
mov edx, dword [ebp + 0xc]
push edx
call fcn.0055886d
add esp, 0x10
test eax, eax
jle 0x49b184
mov dword [ebp - 0x18], 1
jmp 0x49b18b
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 4], eax
jmp 0x49b1e1
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0048f450
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 4], 0
je 0x49b1d4
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x10]
push edx
push 1
mov eax, dword [ebp - 0xc]
push eax
call fcn.0055ddb0
add esp, 0x10
cmp eax, dword [ebp - 0x10]
jne 0x49b1d4
mov dword [ebp - 0x1c], 1
jmp 0x49b1db
mov dword [ebp - 0x1c], 0
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 4], ecx
jmp 0x49b0c1
push 0
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0049a4b0
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x4a4520
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push 0x1a0
push 0
push 0
mov eax, dword [ebp + 0xc]
push eax
call dword [ebp + 8]
add esp, 0x10
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4a4549
xor eax, eax
jmp 0x4a46fb
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
add edx, 0x80
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x10]
mov dword [eax], 0
mov ecx, dword [ebp - 0x10]
mov byte [ecx + 4], 8
mov edx, dword [ebp - 8]
mov byte [edx + 0x14], 0x21
mov eax, dword [ebp - 8]
movzx ecx, byte [eax + 0x14]
and ecx, 3
mov edx, dword [ebp - 0x10]
mov byte [edx + 5], cl
mov eax, dword [ebp - 0x10]
movzx ecx, byte [eax + 5]
or ecx, 0x60
mov edx, dword [ebp - 0x10]
mov byte [edx + 5], cl
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.004a43a0
add esp, 8
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
mov dword [edx + 0xc], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 0xc]
mov dword [ecx + 0x10], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
mov dword [eax + 0x70], ecx
mov edx, dword [ebp - 8]
add edx, 0x78
mov eax, dword [ebp - 8]
mov dword [eax + 0x88], edx
mov ecx, dword [ebp - 8]
add ecx, 0x78
mov edx, dword [ebp - 8]
mov dword [edx + 0x8c], ecx
mov eax, dword [ebp - 8]
mov dword [eax + 0x40], 0
mov ecx, dword [ebp - 8]
mov dword [ecx + 8], 0
mov edx, dword [ebp - 8]
mov dword [edx + 4], 0
mov eax, dword [ebp - 8]
mov dword [eax], 0
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x10]
mov dword [edx + 0x68], 0
mov eax, dword [ebp - 8]
mov dword [eax + 0x34], 0
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x3c], 0
mov edx, dword [ebp - 8]
mov dword [edx + 0x58], 0
mov eax, dword [ebp - 8]
mov byte [eax + 0x15], 0
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
mov dword [ecx + 0x1c], edx
mov eax, dword [ebp - 8]
mov dword [eax + 0x18], 0
mov ecx, dword [ebp - 8]
add ecx, 0x1c
mov edx, dword [ebp - 8]
mov dword [edx + 0x20], ecx
mov eax, dword [ebp - 8]
mov dword [eax + 0x24], 0
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x28], 0
mov edx, dword [ebp - 8]
mov dword [edx + 0x2c], 0
mov eax, dword [ebp - 8]
mov dword [eax + 0x30], 0
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x44], 0x1a0
mov edx, dword [ebp - 8]
mov dword [edx + 0x50], 0xc8
mov eax, dword [ebp - 8]
mov dword [eax + 0x54], 0xc8
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x4c], 0
mov dword [ebp - 4], 0
jmp 0x4a46b5
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 9
jge 0x4a46ce
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov dword [ecx + eax*4 + 0x98], 0
jmp 0x4a46ac
push 0
push 0x4a4700
mov edx, dword [ebp - 0x10]
push edx
call fcn.004968f0
add esp, 0xc
test eax, eax
je 0x4a46f8
mov eax, dword [ebp - 0x10]
push eax
call fcn.004a47e0
add esp, 4
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x4b08a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x604e14]
xor eax, ebp
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
push eax
call fcn.0048ce80
add esp, 4
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 1
jge 0x4b08e6
push 0
mov ecx, dword [ebp + 8]
push ecx
call fcn.0048de20
add esp, 8
mov eax, 1
jmp 0x4b0a53
push 1
mov edx, dword [ebp + 8]
push edx
call fcn.0048d710
add esp, 8
mov dword [ebp - 0x224], eax
mov eax, dword [ebp - 0x224]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x78]
push edx
call fcn.0045c640
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4b0924
mov eax, dword [ebp - 8]
movzx ecx, byte [eax + 4]
test ecx, ecx
je 0x4b093c
push 0
mov edx, dword [ebp + 8]
push edx
call fcn.0048de20
add esp, 8
mov eax, 1
jmp 0x4b0a53
cmp dword [ebp - 0x228], 1
jle 0x4b09b4
push 2
mov eax, dword [ebp + 8]
push eax
call fcn.0048d2f0
add esp, 8
cmp eax, 4
jne 0x4b09b4
push 0x208
push 0
lea ecx, [ebp - 0x220]
push ecx
call fcn.00556110
add esp, 0xc
push 0x104
lea edx, [ebp - 0x220]
push edx
push 0
push 2
mov eax, dword [ebp + 8]
push eax
call fcn.0048d7e0
add esp, 0xc
push eax
call fcn.00556680
add esp, 4
push eax
push 0
push 2
mov ecx, dword [ebp + 8]
push ecx
call fcn.0048d7e0
add esp, 0xc
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
jmp 0x4b09cf
mov edx, dword [ebp - 8]
add edx, 5
push edx
push 0x104
lea eax, [ebp - 0x220]
push eax
call fcn.0055a82f
add esp, 0xc
push 0
push 0
push 2
push 0
push 1
push 0x40000000
lea ecx, [ebp - 0x220]
push ecx
call fcn.00460cf0
add esp, 0x1c
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x4b0a0b
push 0
mov edx, dword [ebp + 8]
push edx
call fcn.0048de20
add esp, 8
mov eax, 1
jmp 0x4b0a53
push 0
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x212]
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x20e]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
push eax
call fcn.00460e10
add esp, 4
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0048de20
add esp, 8
mov eax, 1
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00555ac5
mov esp, ebp
pop ebp
ret
Function at 0x4b4260
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0xc]
mov dword [eax], 0
push 1
mov ecx, dword [ebp + 8]
push ecx
call fcn.0048d2f0
add esp, 8
cmp eax, 4
jne 0x4b4397
push 0x208
push 0
mov edx, dword [ebp + 0xc]
add edx, 4
push edx
call fcn.00556110
add esp, 0xc
push 0x104
mov eax, dword [ebp + 0xc]
add eax, 4
push eax
push 0
push 1
mov ecx, dword [ebp + 8]
push ecx
call fcn.0048d7e0
add esp, 0xc
push eax
call fcn.00556680
add esp, 4
push eax
push 0
push 1
mov edx, dword [ebp + 8]
push edx
call fcn.0048d7e0
add esp, 0xc
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
push 0
push 3
push 0
push 1
push SysReAllocString
mov eax, dword [ebp + 0xc]
add eax, 4
push eax
call fcn.00460cf0
add esp, 0x1c
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x4b431c
xor eax, eax
jmp 0x4b4478
push 0
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
push edx
call fcn.0045ee00
add esp, 4
mov dword [ebp - 8], eax
push 0
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4b437a
push 0x8000
push 0
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [ebp - 0x10]
push edx
call fcn.00460e10
add esp, 4
xor eax, eax
jmp 0x4b4478
mov eax, dword [ebp - 0x10]
push eax
call fcn.00460e10
add esp, 4
mov ecx, dword [ebp + 0xc]
mov dword [ecx], 1
mov edx, dword [ebp - 0x14]
mov dword [ebp - 4], edx
jmp 0x4b440c
push 1
mov eax, dword [ebp + 8]
push eax
call fcn.0048d710
add esp, 8
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x78]
push eax
call fcn.0045c640
add esp, 8
mov ecx, dword [ebp + 0xc]
mov dword [ecx + 0x20c], eax
mov edx, dword [ebp + 0xc]
cmp dword [edx + 0x20c], 0
je 0x4b43e1
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x20c]
movzx edx, byte [ecx + 4]
test edx, edx
je 0x4b43e8
xor eax, eax
jmp 0x4b4478
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x20c]
mov edx, dword [ecx + 0x20e]
mov dword [ebp - 8], edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x20c]
mov edx, dword [ecx + 0x212]
mov dword [ebp - 4], edx
cmp dword [ebp + 0x10], 0
je 0x4b444b
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov ecx, dword [ebp + 0xc]
add ecx, 0x210
call fcn.00461100
test eax, eax
jne 0x4b4449
mov edx, dword [ebp + 0xc]
cmp dword [edx], 0
je 0x4b4445
push 0x8000
push 0
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
jmp 0x4b4478
jmp 0x4b4473
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 8]
mov dword [ecx + 0x214], edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
mov dword [eax + 0x218], ecx
push 1
mov ecx, dword [ebp + 0xc]
add ecx, 0x210
call fcn.0045bd00
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x4b4480
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0xc]
cmp dword [eax], 0
je 0x4b457d
cmp dword [ebp + 0x10], 0
je 0x4b4558
mov ecx, dword [ebp + 0xc]
cmp dword [ecx + 0x214], 0
je 0x4b4558
push 0
push 0
push 2
push 0
push 1
push 0x40000000
mov edx, dword [ebp + 0xc]
add edx, 4
push edx
call fcn.00460cf0
add esp, 0x1c
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x4b44f1
push 0x8000
push 0
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x214]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
jmp 0x4b45b5
mov dword [ebp - 4], 0
push 0
lea edx, [ebp - 4]
push edx
mov ecx, dword [ebp + 0xc]
add ecx, 0x210
call fcn.0045bce0
push eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x214]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4b454c
push 0x8000
push 0
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x214]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [ebp - 8]
push edx
call fcn.00460e10
add esp, 4
xor eax, eax
jmp 0x4b45b5
mov eax, dword [ebp - 8]
push eax
call fcn.00460e10
add esp, 4
mov ecx, dword [ebp + 0xc]
cmp dword [ecx + 0x214], 0
je 0x4b457b
push 0x8000
push 0
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x4b45b2
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0x20c]
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x214]
mov dword [edx + 0x20e], ecx
mov ecx, dword [ebp + 0xc]
add ecx, 0x210
call fcn.0045bce0
mov edx, dword [ebp + 0xc]
mov ecx, dword [edx + 0x20c]
mov dword [ecx + 0x212], eax
mov eax, dword [ebp + 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x4db310
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax + 0x58], 0
je 0x4db34a
mov ecx, dword [ebp - 8]
cmp dword [ecx + 0x60], 0
je 0x4db34a
push 0xa
push 0
push 0
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x58]
push eax
push 0x5c48a0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 4], eax
jmp 0x4db34f
or eax, 0xffffffff
jmp 0x4db351
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x4e0050
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov dword [ebp - 0x30], ecx
mov dword [0x608fa8], 0
push 0
push 0x4e01c0
push 0
push 0xae
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.USER32.dll_CreateDialogParamW]
mov ecx, dword [ebp - 0x30]
mov dword [ecx + 0x214], eax
mov edx, dword [ebp - 0x30]
mov eax, dword [edx]
push eax
push 0
push 0x80
mov ecx, dword [ebp - 0x30]
mov edx, dword [ecx + 0x214]
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax]
push ecx
push 1
push 0x80
mov edx, dword [ebp - 0x30]
mov eax, dword [edx + 0x214]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 0x30]
add ecx, 4
push ecx
mov edx, dword [ebp - 0x30]
mov eax, dword [edx + 0x214]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov ecx, dword [ebp - 0x30]
mov edx, dword [ecx + 0x214]
push edx
call fcn.0052d3ff
push eax
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 0x210]
push ecx
mov edx, dword [ebp - 0x30]
mov eax, dword [edx + 0x20c]
mov ecx, dword [ebp - 0x30]
mov ecx, dword [ecx + 0x20c]
mov edx, dword [eax]
mov eax, dword [edx + 0x13c]
call eax
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x30]
mov eax, dword [edx + 0x214]
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
push 1
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x30]
mov ecx, dword [edx + 0x20c]
call fcn.00404b40
push 5
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 0x20c]
call fcn.00533cad
push 5
mov ecx, dword [ebp - 0x30]
mov edx, dword [ecx + 0x214]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0
push 0
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x4e01b0
mov ecx, dword [ebp - 0x30]
mov edx, dword [ecx + 0x214]
push edx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4e019a
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x30]
mov edx, dword [ecx + 0x214]
push edx
call dword [sym.imp.USER32.dll_IsDialogMessageW]
test eax, eax
jne 0x4e01ae
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea ecx, [ebp - 0x2c]
push ecx
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x4e015a
mov esp, ebp
pop ebp
ret
Function at 0x4e0aa0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [ebp + 0xc], 0
jne 0x4e0ab4
call fcn.0040ec70
mov dword [ebp + 0xc], eax
push 2
movzx eax, word [ebp + 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4e0ad2
xor eax, eax
jmp 0x4e0b44
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4e0aed
xor eax, eax
jmp 0x4e0b44
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4e0b04
xor eax, eax
jmp 0x4e0b44
mov edx, dword [ebp - 8]
push edx
call fcn.004e09c0
add esp, 4
mov word [ebp - 4], ax
cmp dword [ebp + 0x10], 0
je 0x4e0b23
movzx eax, word [ebp - 4]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov edx, dword [ebp - 0xc]
push edx
call fcn.004fa020
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.USER32.dll_LoadBitmapW]
mov esp, ebp
pop ebp
ret

Function at 0x4e27d0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x604e14]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x120], 0
push 0x110
push 0
lea eax, [ebp - 0x11c]
push eax
call fcn.00556110
add esp, 0xc
mov dword [ebp - 0x120], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x80000000
jae 0x4e2875
lea ecx, [ebp - 0x120]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x11c], 4
jne 0x4e2841
mov eax, 5
jmp 0x4e28d8
cmp dword [ebp - 0x11c], 5
jne 0x4e285c
cmp dword [ebp - 0x118], 0
jne 0x4e285c
mov eax, 6
jmp 0x4e28d8
cmp dword [ebp - 0x11c], 5
jb 0x4e286c
mov eax, 7
jmp 0x4e28d8
mov eax, 1
jmp 0x4e28d8
mov edx, dword [ebp - 4]
and edx, 0xffff
movzx eax, dx
and eax, 0xff
movzx ecx, al
cmp ecx, 4
jge 0x4e2892
xor eax, eax
jmp 0x4e28d8
lea edx, [ebp - 0x120]
push edx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x11c], 4
jne 0x4e28ba
cmp dword [ebp - 0x118], 0xa
jne 0x4e28ba
mov eax, 3
jmp 0x4e28d8
cmp dword [ebp - 0x11c], 4
jne 0x4e28d3
cmp dword [ebp - 0x118], 0x5a
jne 0x4e28d3
mov eax, 4
jmp 0x4e28d8
mov eax, 2
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00555ac5
mov esp, ebp
pop ebp
ret