joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4361c0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d87d0
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x51a3c4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
push 0x34
call fcn.004a4277
mov edi, eax
add esp, 4
mov dword [ebp - 0x10], edi
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi], vtable.tinyui::RenderGdiplus.0
mov dword [edi + 0xc], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x18], vtable.tinyui::GdiClip.0
push 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
push esi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push esi
push 0
mov dword [edi + 0xc], eax
call dword [sym.imp.USER32.dll_ReleaseDC]
mov dword [ebx], edi
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x438d70
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push esi
push edi
xor eax, eax
mov esi, ecx
push eax
push 0x51ba14
push 0x51b9f0
push eax
push esi
mov word [ebp - 0x1e], ax
mov dword [ebp - 8], eax
mov dword [ebp - 4], esi
call fcn.004aa04c
mov dword [ebp - 0x30], eax
add esp, 0x14
cmp dword [esi + 0x274], 8
lea eax, [esi + 0x260]
jb 0x438daf
mov eax, dword [eax]
mov ecx, dword [esi + 0x278]
mov edx, dword [ebp + 0x1c]
movss xmm0, dword [ebp + 0x18]
mov edi, dword [ebp + 0x20]
mov dword [ebp - 0xc], eax
mov eax, dword [ecx + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x34], eax
mov ax, word [ebp + 0x14]
mov word [ebp - 0x20], ax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x18], eax
xor eax, eax
test edx, edx
movss dword [ebp - 0x14], xmm0
sete al
cmp eax, edi
jne 0x438e07
mov eax, dword [ecx + 0xc0]
mov ecx, dword [ecx + 0xc4]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], ecx
jmp 0x438e0d
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x2c], eax
lea ecx, [ebp - 0x34]
mov eax, dword [esi]
push ecx
mov ecx, esi
call dword [eax + 0x74]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x442c70
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d91f5
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x51a3c4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esi + 0x10], 0
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x442cae
mov eax, dword [esi]
xor ecx, ecx
push ecx
mov word [eax], cx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x442dee
mov edi, dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
push 0xd
call edi
test eax, eax
je 0x442d8e
push 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
mov edi, eax
cmp edi, 0xffffffff
je 0x442de8
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ebx, eax
test ebx, ebx
je 0x442de8
push edi
call dword [sym.imp.KERNEL32.dll_GlobalSize]
shr eax, 1
xor ecx, ecx
mov dword [ebp - 0x28], 0
push eax
mov word [ebp - 0x28], cx
lea ecx, [ebp - 0x28]
push ebx
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
call fcn.00408d10
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
cmp esi, eax
je 0x442d47
cmp dword [ebp - 0x14], 8
mov ecx, esi
push dword [ebp - 0x18]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.00408d10
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x442de8
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x442d82
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x442e0a
push edx
push ecx
call fcn.004a42a7
add esp, 8
jmp 0x442de8
push 1
call edi
test eax, eax
je 0x442de8
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov edi, eax
cmp edi, 0xffffffff
je 0x442de8
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ebx, eax
test ebx, ebx
je 0x442de8
push edi
call dword [sym.imp.KERNEL32.dll_GlobalSize]
push eax
push ebx
lea ecx, [ebp - 0x40]
call fcn.004163c0
push 0
mov edx, esi
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x40]
call fcn.004133f0
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea ecx, [ebp - 0x40]
call fcn.00413f00
call dword [sym.imp.USER32.dll_CloseClipboard]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a44be
mov esp, ebp
pop ebp
ret
call fcn.004aba7f
int3
Function at 0x442e10
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0
mov esi, ecx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x442e85
push ebx
push edi
call dword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
je 0x442e7d
mov eax, dword [esi + 0x10]
lea ebx, [eax + eax]
lea eax, [ebx + 2]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x442e7d
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
cmp dword [esi + 0x14], 8
mov dword [ebp - 4], eax
jb 0x442e59
mov esi, dword [esi]
push ebx
push esi
push eax
call fcn.004a88a0
mov eax, dword [ebp - 4]
add esp, 0xc
xor ecx, ecx
push edi
mov word [ebx + eax], cx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4440d0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d92e8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x51a3c4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xor eax, eax
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov dword [ebp - 4], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], 7
mov word [esi + 0x18], ax
mov byte [ebp - 4], 1
mov eax, dword [ebp + 8]
mov edx, eax
lea ebx, [edx + 2]
mov cx, word [edx]
add edx, 2
test cx, cx
jne 0x444134
sub edx, ebx
lea ecx, [esi + 0x18]
sar edx, 1
push edx
push eax
call fcn.00408d10
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x30], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x34], eax
mov eax, esi
mov dword [esi + 0x3c], 0
mov dword [esi + 0x38], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4459e0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d937b
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x51a3c4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xor eax, eax
mov dword [esi + 0x20], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 7
mov word [esi + 0x20], ax
mov dword [ebp - 4], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], 7
mov word [esi + 0x38], ax
lea ecx, [esi + 0x54]
mov byte [ebp - 4], 1
call fcn.00445390
mov dword [esi + 0xd4], 0
xor eax, eax
mov word [esi + 0xd4], ax
mov dword [esi + 0xe4], 0
mov dword [esi + 0xe8], 7
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 8], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x50], eax
mov dword [esi + 0xc8], eax
mov dword [esi + 0xcc], eax
mov eax, esi
mov dword [esi + 0xc], 0x4000
mov dword [esi + 0xd0], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4461b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov ebx, ecx
push edi
mov edi, dword [ebp + 8]
push dword [ebx]
push 1
push dword [ebx + 8]
push edi
call fcn.004bf92e
mov esi, dword [ebx + 8]
mov ecx, eax
add esp, 0x10
cmp ecx, 1
sete al
mov byte [esp + 0x13], al
mov eax, esi
cdq
idiv dword [ebx + 0x18]
mov dword [ebx + 0x1c], eax
cmp ecx, 1
jne 0x446345
add dword [ebx + 0x14], esi
cmp dword [ebx + 0x4c], 8
push 0xffffffffffffffff
push eax
lea eax, [ebx + 0x38]
push ecx
mov ecx, esp
jb 0x446206
mov eax, dword [eax]
mov dword [ecx], eax
mov edx, 0x18
push ecx
mov eax, esp
lea ecx, [ebx + 0x20]
mov dword [eax], str.read
call fcn.00443ed0
mov eax, dword [ebx + 0x1c]
add esp, 0x10
mov edx, dword [ebx + 0x18]
xor ecx, ecx
mov dword [esp + 0x14], 0
mov esi, edi
mov dword [esp + 0x1c], edx
test eax, eax
je 0x4462f4
mov edi, edx
jmp 0x44624b
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
dec eax
mov dword [esp + 0x18], eax
cmp edx, 1
jne 0x44625b
xor edx, edx
cmp byte [esi], dl
jmp 0x446260
xor edx, edx
cmp word [esi], dx
sete dl
mov eax, edi
test edx, edx
je 0x446298
test ecx, ecx
je 0x44628a
cmp esi, ecx
je 0x44628a
imul edi, dword [esp + 0x14]
mov eax, esi
sub eax, ecx
push eax
push ecx
sub ecx, edi
push ecx
call fcn.004a88a0
mov eax, dword [ebx + 0x18]
add esp, 0xc
mov edx, dword [esp + 0x14]
lea ecx, [eax + esi]
inc edx
mov dword [esp + 0x14], edx
jmp 0x44629c
mov edx, dword [esp + 0x14]
add esi, eax
mov edi, eax
cmp dword [esp + 0x18], 0
jne 0x446243
test ecx, ecx
je 0x4462c1
cmp esi, ecx
je 0x4462c1
sub esi, ecx
imul eax, edx
push esi
push ecx
sub ecx, eax
push ecx
call fcn.004a88a0
add esp, 0xc
mov esi, dword [esp + 0x14]
test esi, esi
je 0x4462f1
push 0xffffffffffffffff
push esi
push ecx
mov eax, esp
mov edx, 1
push ecx
lea ecx, [ebx + 0x20]
mov dword [eax], 0
mov eax, esp
mov dword [eax], str.nulls_removed
call fcn.00443ed0
add esp, 0x10
sub dword [ebx + 0x1c], esi
mov edi, dword [ebp + 8]
cmp dword [ebx + 0x18], 1
jle 0x446345
test byte [ebx + 4], 0x80
je 0x446345
mov ecx, dword [ebx + 0x1c]
test ecx, ecx
je 0x446322
nop word [eax + eax]
movzx eax, word [edi + ecx*2 - 2]
dec ecx
rol ax, 8
mov word [edi + ecx*2], ax
test ecx, ecx
jne 0x446310
push 0xffffffffffffffff
push 0xffffffffffffffff
push ecx
mov eax, esp
xor edx, edx
push ecx
lea ecx, [ebx + 0x20]
mov dword [eax], 0
mov eax, esp
mov dword [eax], str.endian_swap
call fcn.00443ed0
add esp, 0x10
mov al, byte [esp + 0x13]
test al, al
jne 0x446358
mov ecx, ebx
call fcn.00445ac0
mov al, byte [esp + 0x13]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x459290
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d989d
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x51a3c4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov dword [ebp - 0x3c], ebx
mov esi, ecx
mov dword [ebp - 0x30], esi
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x38], eax
test ebx, ebx
jne 0x4592e2
mov dword [esi], edx
mov dword [esi + 4], edx
jmp 0x45944e
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x18], 0xf
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push ebx
push 0
mov dword [ebp - 4], 0
push 0
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x2c], 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
test edi, edi
jle 0x459352
push 0
lea ecx, [edi - 1]
push ecx
lea ecx, [ebp - 0x2c]
call fcn.00413860
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x459352
cmp dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x2c]
push 0
cmovae eax, dword [ebp - 0x2c]
push 0
push ecx
push eax
lea eax, [edi - 1]
push eax
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x2c]
push 0x4ff254
cmovae eax, dword [ebp - 0x2c]
push eax
call fcn.004be5fa
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x459404
push 2
push 0
push ebx
call fcn.004bf40c
add esp, 0xc
push ebx
call fcn.004bee4d
add esp, 4
mov edi, eax
mov dword [ebp - 0x30], edi
push 0
push 0
push ebx
call fcn.004bf40c
add esp, 0xc
lea ecx, [edi + 1]
push ecx
call fcn.004b2c35
mov edi, eax
add esp, 4
test edi, edi
je 0x4593ee
push ebx
push dword [ebp - 0x30]
push 1
push edi
call fcn.004bf92e
mov ecx, dword [ebp - 0x30]
add esp, 0x10
cmp eax, ecx
jne 0x4593ee
push ebx
mov byte [ecx + edi], 0
call fcn.004be804
movss xmm2, dword [0x502f24]
add esp, 4
mov ecx, edi
call fcn.00454b70
push edi
mov ebx, eax
call fcn.004b2c1a
add esp, 4
jmp 0x459406
push ebx
call fcn.004be804
add esp, 4
test edi, edi
je 0x459404
push edi
call fcn.004b2c1a
add esp, 4
xor ebx, ebx
push dword [ebp - 0x38]
mov edx, ebx
mov ecx, esi
push dword [ebp - 0x34]
push dword [ebp + 8]
push dword [ebp - 0x3c]
call fcn.00458e80
mov edx, dword [ebp - 0x18]
add esp, 0x10
cmp edx, 0x10
jb 0x45944e
mov ecx, dword [ebp - 0x2c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x459444
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45946c
push edx
push ecx
call fcn.004a42a7
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004a44be
mov esp, ebp
pop ebp
ret
call fcn.004aba7f
int3
Function at 0x46f180
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d9ffd
mov eax, dword fs:[0]
push eax
sub esp, 0x6c
mov eax, dword [0x51a3c4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
mov edx, esi
cmp dword [esi + 0x14], 8
jb 0x46f1ba
mov edx, dword [esi]
cmp dword [edi + 0x504], 8
lea eax, [edi + 0x4f0]
jb 0x46f1cf
mov eax, dword [edi + 0x4f0]
mov ebx, dword [esi + 0x10]
mov ecx, dword [edi + 0x500]
cmp ecx, ebx
mov dword [ebp - 0x74], ebx
lea ebx, [edi + 0x4f0]
jne 0x46f20b
test ecx, ecx
je 0x46f36d
sub eax, edx
mov dword [ebp - 0x78], eax
mov ax, word [eax + edx]
cmp ax, word [edx]
jne 0x46f20b
mov eax, dword [ebp - 0x78]
add edx, 2
sub ecx, 1
jne 0x46f1f2
jmp 0x46f36d
cmp ebx, esi
je 0x46f222
cmp dword [esi + 0x14], 8
jb 0x46f217
mov esi, dword [esi]
push dword [ebp - 0x74]
mov ecx, ebx
push esi
call fcn.00408d10
mov ecx, dword [edi + 0x4ec]
test ecx, ecx
je 0x46f23c
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [edi + 0x4ec], 0
push ebx
lea ecx, [ebp - 0x28]
call fcn.004088c0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmovae eax, dword [ebp - 0x28]
push eax
call esi
test eax, eax
jne 0x46f2d0
push 0x51b3b0
lea ecx, [ebp - 0x40]
call fcn.004088c0
mov byte [ebp - 4], 1
mov eax, dword [edi + 0x27c]
add eax, 0x1ec
cmp dword [eax + 0x14], 8
jb 0x46f288
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x70]
push eax
call fcn.0041c1c0
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
push ecx
mov edx, eax
lea ecx, [ebp - 0x58]
call fcn.0041c230
add esp, 0x10
lea ecx, [ebp - 0x28]
push eax
call fcn.0040b440
lea ecx, [ebp - 0x58]
call fcn.004074f0
lea ecx, [ebp - 0x70]
call fcn.004074f0
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0
call fcn.004074f0
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call esi
test eax, eax
je 0x46f365
push 0x10
call dword [sym.imp.gdiplus.dll_GdipAlloc]
mov esi, eax
mov dword [ebp - 0x74], esi
test esi, esi
je 0x46f31e
cmp dword [ebp - 0x14], 8
lea eax, [esi + 4]
lea ecx, [ebp - 0x28]
cmovae ecx, dword [ebp - 0x28]
push eax
push ecx
mov dword [esi], vtable.Gdiplus::Image.0
mov dword [eax], 0
call dword [sym.imp.gdiplus.dll_GdipLoadImageFromFile]
mov dword [esi + 8], eax
jmp 0x46f320
xor esi, esi
mov dword [edi + 0x4ec], esi
mov eax, dword [esi + 8]
mov dword [esi + 8], 0
test eax, eax
jne 0x46f365
cmp byte [edi + 0x4d9], al
mov esi, dword [edi + 0x4ec]
sete al
lea eax, [eax*2 + 1]
push eax
push dword [esi + 4]
call dword [sym.imp.gdiplus.dll_GdipImageRotateFlip]
test eax, eax
je 0x46f35b
mov dword [esi + 8], eax
push 0
lea ecx, [edi + 4]
call fcn.00436f30
lea ecx, [ebp - 0x28]
call fcn.004074f0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a44be
mov esp, ebp
pop ebp
ret 4
Function at 0x473ec5
Capabilities:
Check os version

Disassembly:
mov eax, dword fs:[0x18]
sub esp, 0x74
mov eax, dword [eax + 0x30]
cmp dword [eax + 0xa4], 6
jae 0x4740a9
cmp dword [0x521c50], 0
jne 0x4740a2
push ebx
push ebp
push edi
xor ebp, ebp
mov edx, str.NtOpenKeyedEvent
push ebp
mov ecx, 0x519028
call fcn.00474764
mov ebx, eax
test ebx, ebx
jne 0x473f15
push ebp
push ebp
push 1
push 0xc0000264
call dword [sym.imp.KERNEL32.dll_RaiseException]
push 0x5c
pop edx
push 0x4b
pop eax
push 0x65
pop ecx
push 0x72
mov word [esp + 0x36], ax
pop eax
push 0x6e
mov word [esp + 0x3a], ax
pop eax
push 0x6c
mov word [esp + 0x3c], ax
pop eax
push 0x4f
pop edi
push 0x62
mov word [esp + 0x40], ax
pop eax
push 0x6a
mov word [esp + 0x44], ax
pop eax
push 0x63
mov word [esp + 0x46], ax
mov word [esp + 0x38], cx
mov word [esp + 0x3e], cx
mov word [esp + 0x48], cx
pop ecx
push 0x74
pop ebp
push 0x73
pop eax
push 0x43
mov word [esp + 0x4e], ax
pop eax
push 0x72
mov word [esp + 0x52], ax
mov word [esp + 0x34], dx
mov word [esp + 0x50], dx
pop edx
push 0x69
pop eax
push 0x53
mov word [esp + 0x56], ax
pop eax
push 0x65
mov word [esp + 0x5a], ax
pop eax
push 0x75
mov word [esp + 0x5c], ax
pop eax
push 0x66
mov word [esp + 0x62], ax
pop eax
push 0x4d
mov word [esp + 0x68], ax
pop eax
push 0x65
mov word [esp + 0x4a], cx
mov word [esp + 0x5e], cx
pop ecx
push 0x6d
mov word [esp + 0x6a], ax
pop eax
push 0x6f
mov word [esp + 0x6e], ax
pop eax
push 0x79
mov word [esp + 0x70], ax
pop eax
mov word [esp + 0x3e], di
mov word [esp + 0x48], bp
mov word [esp + 0x50], dx
mov word [esp + 0x54], bp
mov word [esp + 0x5c], di
mov word [esp + 0x60], bp
mov word [esp + 0x62], di
mov word [esp + 0x68], cx
mov word [esp + 0x6e], dx
mov word [esp + 0x70], ax
push 0x45
pop eax
mov word [esp + 0x72], ax
lea edi, [esp + 0x24]
push 0x76
pop eax
mov word [esp + 0x74], ax
push 0x6e
pop eax
mov word [esp + 0x78], ax
xor eax, eax
mov word [esp + 0x7c], ax
push 0x4c
pop eax
mov word [esp + 0x10], ax
mov word [esp + 0x12], ax
lea eax, [esp + 0x30]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x10]
mov dword [esp + 0x20], eax
xor eax, eax
mov word [esp + 0x7a], bp
xor ebp, ebp
mov dword [esp + 0x18], 0x18
mov dword [esp + 0x1c], ebp
stosd dword es:[edi], eax
mov word [esp + 0x76], cx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [esp + 0x18]
push eax
push 0x2000000
lea eax, [esp + 0x14]
push eax
call ebx
test eax, eax
jns 0x474083
push ebp
push ebp
push 1
push 0xc0000264
call dword [sym.imp.KERNEL32.dll_RaiseException]
mov ecx, dword [esp + 0xc]
mov edx, 0x521c50
xor eax, eax
lock cmpxchg dword [edx], ecx
pop edi
pop ebp
pop ebx
test eax, eax
je 0x4740a2
push dword [esp]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x521c50]
jmp 0x4740ab
xor eax, eax
add esp, 0x74
ret
Function at 0x474833
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
cmp byte [0x521c5c], 0
push esi
mov esi, ecx
je 0x47485b
push 0x800
push 0
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
jmp 0x47491d
push ebx
push edi
test esi, esi
je 0x474919
xor ebx, ebx
cmp word [esi], bx
je 0x474919
mov edi, 0x200
lea eax, [ebp - 0x404]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov ecx, eax
test ecx, ecx
je 0x474919
cmp ecx, edi
jae 0x474919
push 0x5c
pop eax
mov word [ebp + ecx*2 - 0x404], ax
inc ecx
cmp ecx, edi
jae 0x474919
movzx eax, word [esi]
test ax, ax
je 0x4748c9
mov edx, eax
mov word [ebp + ecx*2 - 0x404], dx
inc ecx
cmp ecx, edi
jae 0x474919
add esi, 2
movzx eax, word [esi]
mov edx, eax
test ax, ax
jne 0x4748af
xor eax, eax
mov word [ebp + ecx*2 - 0x404], ax
mov eax, dword [0x521c54]
test eax, eax
je 0x4748e7
lea ecx, [ebp - 4]
push ecx
push ebx
call eax
mov esi, eax
jmp 0x4748ec
mov esi, 0xc000000d
push 8
push ebx
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test esi, esi
js 0x474915
mov ecx, dword [0x521c54]
test ecx, ecx
je 0x474915
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
call ecx
mov eax, edi
jmp 0x47491b
xor eax, eax
pop edi
pop ebx
pop esi
leave
ret

Function at 0x474d40
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4da1fd
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x51a3c4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp byte [0x521c6c], 0
mov esi, dword [ebp + 8]
jne 0x474dbe
lea eax, [ebp - 0x28]
mov byte [0x521c6c], 1
push eax
call fcn.00474e20
add esp, 4
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
jb 0x474d9b
mov eax, dword [ebp - 0x28]
push eax
call fcn.00474c70
add esp, 4
test eax, eax
je 0x474daf
mov byte [0x521c6d], 1
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0xffffffff
call fcn.004074f0
cmp byte [0x521c6d], 0
je 0x474df5
test esi, esi
je 0x474df5
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x474df5
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0
push eax
push esi
call fcn.00474a80
xor eax, eax
add esp, 8
cmp dword [ebp - 0x2c], 4
sete al
jmp 0x474df7
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a44be
mov esp, ebp
pop ebp
ret
Function at 0x4768d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x476929
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x476929
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x47691a
cmp esi, edx
jae 0x476929
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x476908
cmp esi, edx
jae 0x476929
cmp word [esi], 0
je 0x476929
mov eax, esi
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret
Function at 0x47c610
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 4]
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, eax
mov dword [ebp - 8], edx
cmp edx, 0xffffffff
jne 0x47c638
call fcn.0047c190
test eax, eax
js 0x47c645
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov dword [eax], edx
mov dword [eax + 4], ecx
xor eax, eax
mov esp, ebp
pop ebp
ret 4