joyce8/EMBER2024-capa huggingface dataset:
Function at 0x451600
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x469224
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x481288]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x4882d8
call fcn.00450f10
add esp, 4
test eax, eax
jne 0x451658
push 0x10
push 0x478a38
push 0x478a60
mov eax, dword [ebp + 8]
push eax
call fcn.00458ce0
add esp, 0x10
xor eax, eax
jmp 0x451810
cmp dword [0x485c34], 1
jne 0x4516aa
push 0x4882d8
push 0
push 1
call fcn.00450b20
add esp, 0xc
test eax, eax
jne 0x45168b
push 0x4882d8
push 0
push 2
call fcn.00450b20
add esp, 0xc
test eax, eax
je 0x4516aa
push 0x10
push 0x478aa4
push 0x478ad0
mov ecx, dword [ebp + 8]
push ecx
call fcn.00458ce0
add esp, 0x10
xor eax, eax
jmp 0x451810
push 0x4884e0
call fcn.00414d31
add esp, 4
test eax, eax
jbe 0x45180b
lea ecx, [ebp - 0x30]
call fcn.00401190
mov dword [ebp - 4], 0
lea edx, [ebp - 0x30]
push edx
call fcn.00451340
add esp, 4
test eax, eax
jne 0x4516fc
mov dword [ebp - 0x34], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00401200
mov eax, dword [ebp - 0x34]
jmp 0x451810
lea ecx, [ebp - 0x30]
call fcn.00401220
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x4517b1
push 0x4882d8
push 0x4884e0
call fcn.0044f810
add esp, 8
test eax, eax
je 0x451764
push 0x10
push 0x478b14
push 0x478b40
mov eax, dword [ebp + 8]
push eax
call fcn.00458ce0
add esp, 0x10
mov dword [ebp - 0x38], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00401200
mov eax, dword [ebp - 0x38]
jmp 0x451810
push 0x4882d8
push 0x4884e0
push 0
call fcn.00450b20
add esp, 0xc
test eax, eax
je 0x4517af
push 0x10
push 0x478b8c
push 0x478bb8
mov ecx, dword [ebp + 8]
push ecx
call fcn.00458ce0
add esp, 0x10
mov dword [ebp - 0x3c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00401200
mov eax, dword [ebp - 0x3c]
jmp 0x451810
jmp 0x4517fc
push 0x4882d8
push 0x4884e0
push 0
call fcn.00450b20
add esp, 0xc
test eax, eax
je 0x4517fc
push 0x10
push 0x478c04
push 0x478c30
mov edx, dword [ebp + 8]
push edx
call fcn.00458ce0
add esp, 0x10
mov dword [ebp - 0x40], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00401200
mov eax, dword [ebp - 0x40]
jmp 0x451810
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00401200
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004151d0
mov esp, ebp
pop ebp
ret
Function at 0x451830
Capabilities:
Get common file path
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x469251
mov eax, dword fs:[0]
push eax
sub esp, 0x438
mov eax, dword [0x481288]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x478970
push 0x208
push 0x104
push 0x4882d8
call fcn.004157ac
add esp, 0x10
push 0
push 1
push 0xf0
push 0x3e8
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 1
jne 0x4518c6
mov dword [0x48a804], 0
push 0x4880d0
push str._sUsers_
push 0x208
push 0x104
push 0x4882d8
call fcn.004157ac
add esp, 0x14
push 0
push 1
push 0xf0
push 0x3ea
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 1
jne 0x451999
mov dword [0x48a804], 1
push 0x478988
lea ecx, [ebp - 0x2c]
call fcn.004011c0
mov dword [ebp - 4], 0
push 1
push 5
lea edx, [ebp - 0x234]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x451974
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00403bf0
lea ecx, [ebp - 0x2c]
call fcn.00402490
mov dword [ebp - 0x238], eax
mov ecx, dword [ebp - 0x238]
sub ecx, 1
push ecx
lea ecx, [ebp - 0x2c]
call fcn.00403c70
movzx edx, word [eax]
cmp edx, 0x5c
je 0x451967
push 0x47898c
lea ecx, [ebp - 0x2c]
call fcn.00403c10
push 0x478990
lea ecx, [ebp - 0x2c]
call fcn.00403c10
lea ecx, [ebp - 0x2c]
call fcn.00401220
push eax
push 0x4882d8
call fcn.00414f38
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00401200
push 0
push 1
push 0xf0
push 0x3e9
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 1
jne 0x451aad
mov dword [0x48a804], 2
mov ecx, dword [ebp + 8]
push ecx
call fcn.004506a0
add esp, 4
test eax, eax
jne 0x4519fa
push 0x10
push 0x4789b0
push 0x4789d8
mov edx, dword [ebp + 8]
push edx
call fcn.00458ce0
add esp, 0x10
xor eax, eax
jmp 0x451ab2
push 0x104
push 0x4882d8
push 0x414
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0x4882d8
call fcn.00414d31
add esp, 4
cmp eax, 0x103
jae 0x451aad
push 0x4882d8
call fcn.00414d31
add esp, 4
movzx ecx, word [eax*2 + 0x4882d6]
cmp ecx, 0x5c
je 0x451aad
mov word [ebp - 0x444], 0
push 0x206
push 0
lea edx, [ebp - 0x442]
push edx
call fcn.00415680
add esp, 0xc
push 0x4882d8
push 0x478a08
push 0x208
push 0x104
lea eax, [ebp - 0x444]
push eax
call fcn.004157ac
add esp, 0x14
lea ecx, [ebp - 0x444]
push ecx
push 0x478a10
push 0x208
push 0x104
push 0x4882d8
call fcn.004157ac
add esp, 0x14
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004151d0
mov esp, ebp
pop ebp
ret
Function at 0x452f10
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [0x487a84], 1
push 0
push 0
mov eax, dword [ebp + 8]
push eax
push 0x452b20
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov dword [0x487a88], ecx
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x457a50
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 1
mov eax, dword [0x487fec]
push eax
push 0x30
push 0x7f1
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x485580
push 0x7f1
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
cmp dword [0x48472c], 0
je 0x457aaa
push 5
push 0x7f1
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x457ac2
push 0
push 0x7f1
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop ebp
ret

Function at 0x457b30
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 4
push 0x16
push 0x45
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
push 5
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop ebp
ret
Function at 0x458f10
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 8], 0
je 0x458f26
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00458ce0
add esp, 0x10
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
je 0x458f5c
cmp dword [0x4829cc], 0
je 0x458f5c
push 5
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [0x4829cc], 1
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x4591b0
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 8], 0
jl 0x4591c7
mov eax, dword [ebp + 8]
cmp eax, dword [0x484728]
jl 0x4591cc
jmp 0x4592b1
mov dword [ebp - 4], 0
cmp dword [0x4846dc], 0
jl 0x4591fc
mov ecx, dword [0x4846dc]
cmp ecx, dword [0x484728]
jge 0x4591fc
mov edx, dword [0x4846dc]
imul edx, edx, 0xc
mov eax, dword [edx + 0x4846e8]
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
mov dword [0x4846dc], ecx
cmp dword [ebp - 4], 0
je 0x459253
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
push 0x41
push 0
push 0
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x14]
push edx
push 0
mov eax, dword [0x4846dc]
imul eax, eax, 0xc
mov ecx, dword [eax + 0x4846e8]
push ecx
call dword [sym.imp.USER32.dll_SetWindowPos]
push 0
push 1
push 0x3ea
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_SetTimer]
jmp 0x459274
push 0x43
push 0
push 0
push 0
push 0
push 0
mov eax, dword [0x4846dc]
imul eax, eax, 0xc
mov ecx, dword [eax + 0x4846e8]
push ecx
call dword [sym.imp.USER32.dll_SetWindowPos]
cmp dword [0x4846dc], 0
jl 0x4592b1
cmp dword [0x4846dc], 3
jg 0x4592b1
mov edx, dword [0x48ac9c]
push edx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push 0
push 5
push 0x3e8
mov eax, dword [0x4846dc]
imul eax, eax, 0xc
mov ecx, dword [eax + 0x4846e8]
push ecx
call dword [sym.imp.USER32.dll_SetTimer]
mov esp, ebp
pop ebp
ret

Function at 0x459aa0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x481288]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 3
push 0
push str.SoftwareMicrosoftWindowsShellNoRoamMUICache
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x459ad8
jmp 0x459b39
mov word [ebp - 0x210], 0
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.00415680
add esp, 0xc
push str.QQ.exe
mov edx, dword [ebp + 8]
push edx
push str._sBin_s
push 0x208
push 0x104
lea eax, [ebp - 0x210]
push eax
call fcn.004157ac
add esp, 0x18
lea ecx, [ebp - 0x210]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004151d0
mov esp, ebp
pop ebp
ret
Function at 0x459b50
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov dword [ebp - 4], 1
push 4
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x459bf8
push 4
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x459bee
lea edx, [ebp - 0x28]
push edx
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jne 0x459be8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x34], ecx
cmp dword [ebp - 0x34], 5
je 0x459bc3
cmp dword [ebp - 0x34], 6
je 0x459bd2
jmp 0x459bdf
push str.The_specified_handle_was_not_opened_with_SERVICE_QUERY_STATUS_access._n
call fcn.0041602b
add esp, 4
jmp 0x459bdf
push str.The_specified_handle_is_invalid._n
call fcn.0041602b
add esp, 4
mov dword [ebp - 4], 0
jmp 0x459bee
mov edx, dword [ebp - 0x24]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x459c10
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
push 4
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x459c68
push 0x10
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x459c5e
lea edx, [ebp + 8]
push edx
push 1
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x459c80
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x481288]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x48a1c8
call fcn.0043a650
add esp, 4
mov word [ebp - 0x210], 0
push 0x206
push 0
lea eax, [ebp - 0x20e]
push eax
call fcn.00415680
add esp, 0xc
push 0x4799b0
push 0x486b18
call fcn.004159fc
add esp, 8
test eax, eax
je 0x459dac
push 0x48a1c8
call fcn.00414d31
add esp, 4
test eax, eax
jne 0x459dac
push 0x4888f0
call fcn.00414d31
add esp, 4
test eax, eax
jne 0x459dac
push 0x486b18
push 0x4799b4
push 0x208
push 0x104
lea ecx, [ebp - 0x210]
push ecx
call fcn.004157ac
add esp, 0x14
lea edx, [ebp - 0x214]
push edx
push 0x20006
push 0
push 0x4799bc
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0
je 0x459d6a
lea eax, [ebp - 0x214]
push eax
push str.SOFTWARETencent
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
lea ecx, [ebp - 0x210]
push ecx
call fcn.00414d31
add esp, 4
shl eax, 1
push eax
lea edx, [ebp - 0x210]
push edx
push 1
push 0
push str.OldQQPath
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0x218], eax
mov ecx, dword [ebp - 0x214]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004151d0
mov esp, ebp
pop ebp
ret
Function at 0x459e50
Capabilities:
Create process on windows
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push 0x479a84
call fcn.00459b50
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 4
je 0x459fd0
push 0x479a98
call fcn.00459c10
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x459fd0
mov dword [ebp - 0xc], 1
push 4
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x459eee
push 0xf01ff
push 0x479aac
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x459ee4
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 2
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 0x479ac0
call fcn.00459c10
add esp, 4
mov dword [ebp - 0x10], eax
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x479ad4
call fcn.00459b50
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 4
je 0x459fd0
push 1
push 0
push str._unregserver
push 0x479b04
push 0x479b1c
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 0x1c], eax
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
push 0
push str._regserver
push str.msiexec.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 0x1c], eax
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x479b64
call fcn.00459c10
add esp, 4
mov dword [ebp - 0x20], eax
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.MSIServer
call fcn.00459b50
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 4
je 0x459fd0
push str.http:__support.microsoft.com_kb_290301_zh_cn
push 0x479b8c
push 0x10
push 0x479bfc
push 0x479c08
push 0
call fcn.00458f70
add esp, 0x18
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x45a370
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
push 0
mov eax, dword [ebp + 8]
push eax
push 0x459fe0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov dword [0x487338], ecx
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x45a800
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 0x10]
push eax
movzx ecx, word [ebp + 0xc]
push ecx
mov edx, dword [0x4846d8]
push edx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x45a82c
xor eax, eax
jmp 0x45a8e6
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [0x4846d8]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x18]
push edx
mov eax, dword [0x4846d8]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x45a860
xor eax, eax
jmp 0x45a8e6
mov ecx, dword [ebp - 0x10]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.00415c30
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
push 0
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
push 0
mov edx, dword [ebp - 0x14]
push edx
call fcn.00401a80
add esp, 8
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ecx + 8]
call eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov edx, dword [ebp + 8]
cmp dword [edx], 0
jne 0x45a8e1
xor eax, eax
jmp 0x45a8e6
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x45be40
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
jmp 0x45be58
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x100
jae 0x45beab
mov ecx, dword [ebp - 4]
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], 0
jmp 0x45be79
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], 8
jge 0x45be9c
mov eax, dword [ebp - 8]
shr eax, 1
mov ecx, dword [ebp - 8]
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
xor eax, ecx
mov dword [ebp - 8], eax
jmp 0x45be70
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
mov dword [edx*4 + 0x4ed7a0], eax
jmp 0x45be4f
mov esp, ebp
pop ebp
ret
Function at 0x45c820
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 0x10], 0
jne 0x45c830
xor eax, eax
jmp 0x45c8a3
mov dword [ebp - 4], 0
cmp dword [ebp + 0x10], 0x1000000
jbe 0x45c849
mov dword [ebp - 0x14], 0x1000000
jmp 0x45c84f
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], 0
push 0
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 0xc]
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0x10]
sub ecx, dword [ebp - 0xc]
mov dword [ebp + 0x10], ecx
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0xc]
mov dword [ebp - 4], edx
cmp dword [ebp - 8], 0
jne 0x45c89a
jmp 0x45c8a0
cmp dword [ebp + 0x10], 0
ja 0x45c837
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x45c8b0
Capabilities:
Check if file exists
Create directory
Get disk information
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x481288]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
push eax
call fcn.00414d31
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x45c9d7
mov word [ebp - 0x210], 0
push 0x1fe
push 0
lea edx, [ebp - 0x20e]
push edx
call fcn.00415680
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0045c610
add esp, 8
test eax, eax
je 0x45c951
lea edx, [ebp - 0x210]
push edx
call fcn.0045c8b0
add esp, 4
test eax, eax
je 0x45c945
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x45c9dc
xor eax, eax
jmp 0x45c9dc
mov word [ebp - 0x418], 0
push 0x1fe
push 0
lea ecx, [ebp - 0x416]
push ecx
call fcn.00415680
add esp, 0xc
mov edx, dword [ebp + 8]
push edx
push 0x4829d4
push 0x200
push 0x100
lea eax, [ebp - 0x418]
push eax
call fcn.004157ac
add esp, 0x14
lea ecx, [ebp - 0x418]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 1
je 0x45c9c3
cmp dword [ebp - 0x214], 0
je 0x45c9c3
mov dword [ebp - 0x41c], 1
jmp 0x45c9cd
mov dword [ebp - 0x41c], 0
mov eax, dword [ebp - 0x41c]
jmp 0x45c9dc
mov eax, 1
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.004151d0
mov esp, ebp
pop ebp
ret