joyce8/EMBER2024-capa huggingface dataset:
Function at 0x490530
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x4905b1
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x490540
sub ecx, edx
sar ecx, 1
je 0x4905b1
push str.Program_Manager
push str.Progman
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
je 0x49056e
push eax
call fcn.004919a0
add esp, 4
push 5
push 0
push 0
push esi
push str.open
call fcn.004914d0
add esp, 0x14
test al, al
je 0x490590
mov ecx, 1
mov eax, ecx
pop esi
pop ebp
ret
push 5
push 0
push 0
push esi
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor ecx, ecx
cmp eax, 0x20
pop esi
setg cl
mov eax, ecx
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret

Function at 0x491280
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x2c]
sub esp, 0xc
mov ecx, dword [0x5441c8]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x543738]
cmp eax, dword [ecx + 4]
jg 0x49136a
cmp dword [0x53a318], 0
jne 0x491356
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call fcn.0048f360
add esp, 8
cmp eax, 0x20
jne 0x4912d4
push 0xa
push str.safe_cloud
jmp 0x49134c
cmp eax, 1
jne 0x491345
lea eax, [ebp - 8]
mov dword [ebp - 0xc], 4
push eax
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0xc]
mov dword [ebp - 8], 4
push eax
push str.safe_jisu
push str.SOFTWARE360safe
push reloc.gdiplus.dll_Ordinal_1
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x49133c
cmp dword [ebp - 4], 1
jne 0x49133c
push str.safe_jisu
mov ecx, 0x53a308
call fcn.00407160
mov ecx, dword [ebp + 8]
push 0x53a308
call fcn.004071e0
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret
push 0xa
push str.safe_geren
jmp 0x49134c
push 0xb
push str.safe_unknow
mov ecx, 0x53a308
call fcn.00407020
mov ecx, dword [ebp + 8]
push 0x53a308
call fcn.004071e0
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret
push 0x543738
call fcn.004c1fd5
add esp, 4
cmp dword [0x543738], 0xffffffff
jne 0x4912a6
push 0x4f7630
call fcn.004c1d8a
push 0x543738
call fcn.004c1f8b
add esp, 8
jmp 0x4912a6
Function at 0x4919a0
Capabilities:
Hide graphical window
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x491a12
push esi
push ebx
call dword [sym.imp.USER32.dll_IsIconic]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
test eax, eax
je 0x4919c2
push 9
push ebx
call esi
push 5
push ebx
call esi
push 0
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebx, eax
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov esi, dword [sym.imp.USER32.dll_AttachThreadInput]
push eax
call esi
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_BringWindowToTop]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetActiveWindow]
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call esi
pop esi
pop ebx
pop ebp
ret

Function at 0x492630
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb0
mov eax, dword [0x53ac84]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
call fcn.00483350
mov ecx, eax
test ecx, ecx
je 0x492763
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
test ebx, ebx
je 0x492751
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x492751
push edi
mov dword [ebp - 0xb0], vtable.MD5_CTX.0
lea edi, [ebp - 0x54]
mov dword [ebp - 0x98], eax
mov ecx, 0x10
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0xac], 0x67452301
mov dword [ebp - 0xa8], 0xefcdab89
mov dword [ebp - 0xa4], 0x98badcfe
mov dword [ebp - 0xa0], 0x10325476
rep stosd dword es:[edi], eax
push edx
push ebx
lea ecx, [ebp - 0xb0]
mov byte [ebp - 0x54], 0x80
call fcn.00492f80
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0xb0]
call fcn.00492770
movzx eax, byte [ebp - 5]
mov ecx, dword [ebp - 8]
push eax
movzx eax, byte [ebp - 6]
push eax
movzx eax, ch
push eax
movzx eax, cl
mov ecx, dword [ebp - 0xc]
push eax
movzx eax, byte [ebp - 9]
push eax
movzx eax, byte [ebp - 0xa]
push eax
mov edx, dword [ebp - 0x14]
movzx eax, ch
push eax
movzx eax, cl
mov ecx, dword [ebp - 0x10]
push eax
movzx eax, byte [ebp - 0xd]
push eax
movzx eax, byte [ebp - 0xe]
push eax
movzx eax, ch
push eax
movzx eax, cl
push eax
movzx eax, byte [ebp - 0x11]
push eax
movzx eax, byte [ebp - 0x12]
push eax
movzx ecx, dh
push ecx
movzx ecx, dl
push ecx
push 0x4fb0c8
push esi
call fcn.00483270
add esp, 0x48
pop edi
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.004c20c9
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.004831b0
int3
Function at 0x492770
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x53ac84]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
xor edx, edx
push edi
mov edi, dword [ebp + 8]
lea eax, [esi + 0x16]
lea ecx, [ecx]
movzx ecx, byte [eax - 2]
lea eax, [eax + 4]
mov byte [ebp + edx - 0xc], cl
movzx ecx, byte [eax - 5]
mov byte [ebp + edx - 0xb], cl
movzx ecx, byte [eax - 4]
mov byte [ebp + edx - 0xa], cl
movzx ecx, byte [eax - 3]
mov byte [ebp + edx - 9], cl
add edx, 4
cmp edx, 8
jb 0x492790
mov eax, dword [esi + 0x14]
mov ecx, 0x38
shr eax, 3
and eax, 0x3f
cmp eax, 0x38
jb 0x4927d3
mov ecx, 0x78
sub ecx, eax
lea ebx, [esi + 0x5c]
push ecx
push ebx
mov ecx, esi
call fcn.00492f80
push 8
lea eax, [ebp - 0xc]
mov ecx, esi
push eax
call fcn.00492f80
lea ecx, [edi + 1]
mov edi, 4
lea edx, [esi + 6]
lea esp, [esp]
movzx eax, byte [edx - 2]
lea edx, [edx + 4]
mov byte [ecx - 1], al
lea ecx, [ecx + 4]
movzx eax, byte [edx - 5]
mov byte [ecx - 4], al
movzx eax, byte [edx - 4]
mov byte [ecx - 3], al
movzx eax, byte [edx - 3]
mov byte [ecx - 2], al
sub edi, 1
jne 0x492800
xor eax, eax
mov edi, esi
mov ecx, 0x27
rep stosd dword es:[edi], eax
mov ecx, dword [ebp - 4]
pop edi
mov dword [esi + 4], 0x67452301
xor ecx, ebp
mov dword [esi + 8], 0xefcdab89
mov dword [esi + 0xc], 0x98badcfe
mov dword [esi + 0x10], 0x10325476
pop esi
mov byte [ebx], 0x80
pop ebx
call fcn.004c20c9
mov esp, ebp
pop ebp
ret 4
Function at 0x4931b0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
call fcn.00483350
mov ecx, eax
test ecx, ecx
je 0x4932cc
mov eax, dword [ecx]
push esi
push edi
call dword [eax + 0xc]
lea edi, [eax + 0x10]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], edi
mov eax, dword [eax]
cmp dword [eax - 0xc], 0
je 0x49329b
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x49329b
push ebx
lea eax, [ebp - 0x3c]
xor esi, esi
push eax
mov eax, dword [ebp + 0xc]
xor edi, edi
mov dword [ebp - 4], esi
xor ebx, ebx
push dword [eax]
call fcn.004932e0
add esp, 8
test eax, eax
je 0x493228
mov eax, dword [ebp - 0x34]
mov esi, eax
movzx eax, ax
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x30]
mov edi, eax
shr esi, 0x10
shr edi, 0x10
movzx ebx, ax
push ebx
push edi
push dword [ebp - 4]
lea eax, [ebp - 8]
push esi
push str._d._d._d._d
push eax
call fcn.00483270
mov eax, dword [ebp + 0x10]
add esp, 0x18
test eax, eax
je 0x493248
mov dword [eax], esi
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x493254
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
mov eax, dword [ebp + 0x18]
test eax, eax
je 0x49325d
mov dword [eax], edi
mov eax, dword [ebp + 0x1c]
test eax, eax
je 0x493266
mov dword [eax], ebx
mov edi, dword [ebp - 8]
add edi, 0xfffffff0
push edi
call fcn.00483ae0
mov esi, dword [ebp + 8]
add eax, 0x10
add esp, 4
mov dword [esi], eax
or eax, 0xffffffff
lock xadd dword [edi + 0xc], eax
dec eax
pop ebx
test eax, eax
jg 0x4932c4
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
add edi, 0xfffffff0
push edi
call fcn.00483ae0
mov esi, dword [ebp + 8]
add eax, 0x10
add esp, 4
mov dword [esi], eax
or eax, 0xffffffff
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x4932c4
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.004831b0
int3
Function at 0x493450
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80c
mov eax, dword [0x53ac84]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
push ebx
push edi
xor edi, edi
mov dword [ebp - 0x80c], ecx
push edi
push 0x80
push 3
push edi
push 1
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x493555
push 2
push edi
push 0xffffff00
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0x800
lea eax, [ebp - 0x804]
mov dword [ebp - 0x808], edi
push edi
push eax
call fcn.004c4ac0
add esp, 0xc
lea eax, [ebp - 0x808]
push edi
push eax
push 0x800
lea eax, [ebp - 0x804]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x493555
mov eax, dword [ebp - 0x808]
cmp eax, 0x100
ja 0x493555
shr eax, 1
cmp eax, 0x11
jb 0x49354e
push esi
lea esi, [ebp + eax*2 - 0x826]
lea eax, [ebp - 0x804]
cmp esi, eax
je 0x49354d
push 0x11
sub esi, 2
push str.____360skin_ver_
push esi
call fcn.004cb95e
add esp, 0xc
test eax, eax
je 0x493527
lea eax, [ebp - 0x804]
cmp esi, eax
jne 0x493504
jmp 0x49354d
test esi, esi
je 0x49354d
mov eax, dword [ebp - 0x80c]
test eax, eax
je 0x49354d
push dword [ebp + 0x10]
push 0
push eax
push esi
call fcn.00493570
add esp, 0x10
test al, al
je 0x49354d
mov edi, 1
pop esi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop ebx
call fcn.004c20c9
mov esp, ebp
pop ebp
ret
Function at 0x494d60
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 4]
push esi
push eax
call fcn.00494b90
add esp, 8
push dword [ebp - 4]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x494d9b
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
push eax
call fcn.00483ae0
mov esi, dword [ebp + 8]
add esp, 4
add eax, 0x10
mov dword [esi], eax
jmp 0x494da8
push esi
mov esi, dword [ebp + 8]
push esi
call fcn.004947b0
add esp, 8
mov eax, dword [ebp - 4]
or ecx, 0xffffffff
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x494dc3
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x496800
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x810
mov eax, dword [0x53ac84]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0x808], eax
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
test ebx, ebx
je 0x49698c
mov esi, dword [esi]
cmp dword [esi - 0xc], 0
je 0x49698c
push 0x800
lea eax, [ebp - 0x804]
push 0
push eax
call fcn.004c4ac0
add esp, 0xc
mov dword [ebp - 0x80c], 0x400
lea eax, [ebp - 0x80c]
mov dword [ebp - 0x810], 1
push eax
lea eax, [ebp - 0x804]
push eax
lea eax, [ebp - 0x810]
push eax
mov eax, dword [ebp - 0x808]
push dword [eax]
push esi
push ebx
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x49698c
lea esi, [ebp - 0x804]
lea ecx, [esi + 2]
lea esp, [esp]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x4968a0
sub esi, ecx
sar esi, 1
jne 0x4968cb
mov ecx, edi
call fcn.00483b50
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c20c9
mov esp, ebp
pop ebp
ret
mov edx, dword [edi]
lea ebx, [ebp - 0x804]
sub ebx, edx
sar ebx, 1
mov eax, dword [edx - 0xc]
mov dword [ebp - 0x808], eax
test esi, esi
js 0x49699f
mov eax, dword [edx - 8]
mov ecx, 1
sub ecx, dword [edx - 4]
sub eax, esi
or ecx, eax
jge 0x496903
push esi
mov ecx, edi
call fcn.00483480
mov edx, dword [edi]
cmp ebx, dword [ebp - 0x808]
ja 0x496953
mov eax, dword [edx - 8]
lea ecx, [esi + esi]
lea ebx, [edx + ebx*2]
test ecx, ecx
je 0x496967
test ebx, ebx
jne 0x49692e
call fcn.004cb66d
mov dword [eax], 0x16
call fcn.004c7d71
jmp 0x496967
add eax, eax
cmp eax, ecx
jae 0x496946
call fcn.004cb66d
mov dword [eax], 0x22
call fcn.004c7d71
jmp 0x496967
push ecx
push ebx
push edx
call fcn.004c4dc0
add esp, 0xc
jmp 0x496967
push esi
lea eax, [ebp - 0x804]
push eax
push dword [edx - 8]
push edx
call fcn.00489fb0
add esp, 0x10
mov eax, dword [edi]
cmp esi, dword [eax - 8]
jg 0x49699f
mov dword [eax - 0xc], esi
xor ecx, ecx
mov eax, dword [edi]
pop edi
mov word [eax + esi*2], cx
mov al, 1
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c20c9
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004c20c9
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.004831b0
int3
Function at 0x4969b0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x14]
test ebx, ebx
je 0x496a8c
mov eax, dword [ebp + 8]
mov eax, dword [eax]
cmp dword [eax - 0xc], 0
je 0x496a8c
mov eax, dword [ebp + 0x10]
push esi
push edi
mov eax, dword [eax]
mov ecx, dword [eax - 0x10]
lea esi, [eax - 0x10]
mov dword [ebp + 0x14], eax
mov eax, dword [ecx]
call dword [eax + 0x10]
cmp dword [esi + 0xc], 0
mov ecx, eax
lea eax, [esi + 0xc]
jl 0x4969f7
cmp ecx, dword [esi]
jne 0x4969f7
lock inc dword [eax]
jmp 0x496a25
mov eax, dword [ecx]
lea edi, [esi + 4]
push 2
push dword [edi]
call dword [eax]
mov esi, eax
test esi, esi
je 0x496a91
mov eax, dword [edi]
mov dword [esi + 4], eax
mov eax, dword [edi]
inc eax
push eax
push dword [ebp + 0x14]
push eax
lea eax, [esi + 0x10]
push eax
call fcn.00489fb0
add esp, 0x10
mov edi, dword [esi + 4]
add esi, 0x10
mov dword [ebp + 0x14], esi
test edi, edi
js 0x496a96
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edi
or ecx, eax
jge 0x496a4f
push edi
lea ecx, [ebp + 0x14]
call fcn.00483480
mov esi, dword [ebp + 0x14]
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
lea eax, [edi + edi]
push eax
mov eax, dword [ebp + 8]
push esi
push 1
push ecx
push dword [eax]
push ebx
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
test eax, eax
sete bl
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x496a85
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
pop edi
pop esi
mov al, bl
pop ebx
pop ebp
ret
xor al, al
pop ebx
pop ebp
ret
call fcn.004835c0
push 0x80070057
call fcn.004831b0
int3
Function at 0x49f7a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x53ac84]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push esi
mov esi, dword [ebp + 8]
push edi
push 0x60
push 0
mov dword [ebp - 0x410], eax
mov eax, dword [ebp + 0x10]
push esi
mov dword [ebp - 0x40c], eax
mov dword [ebp - 0x414], ecx
mov dword [ebp - 0x418], 0
mov dword [ebp - 0x408], 0
call ebx
mov edi, eax
test edi, edi
jne 0x49f810
push 2
push eax
push esi
call ebx
mov edi, eax
test edi, edi
jne 0x49f810
call fcn.00486030
mov esi, eax
jmp 0x49f8fc
push dword [ebp - 0x40c]
push dword [ebp - 0x410]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x49f833
call fcn.00486030
jmp 0x49f8ef
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
jne 0x49f84b
call fcn.00486030
jmp 0x49f8ef
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
lea eax, [esi + 1]
cmp eax, esi
jae 0x49f866
mov esi, 0x8007000e
jmp 0x49f8f1
mov ecx, 2
mul ecx
test edx, edx
ja 0x49f92a
jb 0x49f880
cmp eax, 0xffffffff
ja 0x49f92a
cmp eax, 0x400
jbe 0x49f8a3
push eax
lea ecx, [ebp - 0x408]
call fcn.0049ec10
cmp dword [ebp - 0x408], 0
jne 0x49f8af
mov esi, 0x8007000e
jmp 0x49f8f1
lea eax, [ebp - 0x404]
mov dword [ebp - 0x408], eax
push esi
push dword [ebp - 0x408]
push esi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
jne 0x49f8cf
call fcn.00486030
jmp 0x49f8ef
mov eax, dword [ebp - 0x408]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x418]
push dword [ebp - 0x408]
call fcn.0049f600
mov esi, eax
test edi, edi
je 0x49f8fc
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x404]
cmp dword [ebp - 0x408], eax
je 0x49f915
lea ecx, [ebp - 0x408]
call fcn.0049ef20
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004c20c9
mov esp, ebp
pop ebp
ret 0x10
push 0x80070216
call fcn.004831b0
int3
Function at 0x4a1a50
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0xc
test eax, eax
jne 0x4a1a71
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov dword [eax + 4], 0
mov esp, ebp
pop ebp
ret
push ebx
push esi
push edi
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push eax
mov dword [ebp + 0xc], 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4a1bd6
lea eax, [ebp - 0xc]
xor ebx, ebx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x4a1af3
push dword [ebp - 0xc]
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x4a1af3
push ebx
lea eax, [ebp - 4]
mov dword [ebp - 4], ebx
push eax
push dword [ebp - 0xc]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4a1aec
lea eax, [ebp + 0xc]
push eax
push 1
push edi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
setns bl
jmp 0x4a1af3
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x4a1bd6
mov edi, dword [ebp + 0xc]
push 0x10
call sub.gdiplus.dll_GdipAlloc
mov esi, eax
test esi, esi
je 0x4a1b34
lea eax, [ebp - 4]
mov dword [esi], vtable.Gdiplus::Bitmap.0
push eax
push edi
mov dword [ebp - 4], 0
call sub.gdiplus.dll_GdipCreateBitmapFromStream
mov dword [esi + 8], eax
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
jmp 0x4a1b36
xor esi, esi
push dword [ebp + 0xc]
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], 0
push esi
mov dword [ebp - 8], 0
call fcn.00420bb0
mov ecx, dword [ebp - 0xc]
test ecx, ecx
je 0x4a1b9c
mov eax, dword [ecx + 8]
mov dword [ecx + 8], 0
test eax, eax
jne 0x4a1b9c
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [esi], ecx
lea ecx, [ebp - 0xc]
mov dword [esi + 4], eax
call fcn.0041a920
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x4a1bf3
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp + 8]
mov edi, dword [ebp - 8]
mov dword [esi], 0
mov dword [esi + 4], 0
test edi, edi
je 0x4a1b86
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [edi + 4], eax
jne 0x4a1b86
mov eax, dword [edi]
mov ecx, edi
call dword [eax]
lock xadd dword [edi + 8], ebx
dec ebx
jne 0x4a1b86
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 4]
jmp 0x4a1b86
mov esi, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov dword [esi], 0
mov dword [esi + 4], 0
test ecx, ecx
je 0x4a1bf3
mov edx, dword [ecx]
push ecx
call dword [edx + 8]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a2080
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x53ac84]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
lea eax, [ebp - 0x34]
mov ebx, ecx
push eax
xor esi, esi
call fcn.004a1da0
cmp dword [ebp - 0x20], 8
lea eax, [ebp - 0x34]
jb 0x4a20ab
mov eax, dword [ebp - 0x34]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4a20bb
mov esi, 1
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x38], 0
push eax
mov ecx, ebx
call fcn.004a1c00
cmp dword [ebp - 8], 8
lea eax, [ebp - 0x1c]
jb 0x4a20d9
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4a20eb
mov dword [ebp - 0x38], 1
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x3c], 0
push eax
push 0x20019
push 0
push dword [ebx + 0x18]
push reloc.gdiplus.dll_Ordinal_1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
neg eax
sbb eax, eax
and eax, 1
cmp dword [ebp - 0x38], 0
je 0x4a2121
test esi, esi
jne 0x4a2125
lea esi, [eax + 2]
jmp 0x4a212e
test esi, esi
je 0x4a212c
mov esi, 1
jmp 0x4a212e
xor esi, esi
mov edx, dword [ebp - 8]
cmp edx, 8
jb 0x4a2164
mov ecx, dword [ebp - 0x1c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4a215a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4a21c0
push edx
push ecx
call fcn.004c1e27
add esp, 8
mov edx, dword [ebp - 0x20]
xor eax, eax
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 7
mov word [ebp - 0x1c], ax
cmp edx, 8
jb 0x4a21ae
mov ecx, dword [ebp - 0x34]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4a21a4
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4a21c0
push edx
push ecx
call fcn.004c1e27
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.004c20c9
mov esp, ebp
pop ebp
ret
call fcn.004c7d81
int3
Function at 0x4a21d0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x53ac84]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
xor eax, eax
push str.chrome.dll
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 7
mov word [edi], ax
lea eax, [ebp - 0x34]
push eax
call fcn.004a1f40
mov edx, eax
cmp dword [edx + 0x14], 8
jb 0x4a220f
mov edx, dword [edx]
mov ecx, edx
mov dword [ebp - 0xc], 0
xor eax, eax
mov dword [ebp - 8], 7
push esi
mov word [ebp - 0x1c], ax
lea esi, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4a2230
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x1c]
call fcn.00407020
mov edx, dword [ebp - 0x20]
cmp edx, 8
jb 0x4a2283
mov ecx, dword [ebp - 0x34]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4a2279
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4a2347
push edx
push ecx
call fcn.004c1e27
add esp, 8
cmp dword [ebp - 8], 8
lea eax, [ebp - 0x1c]
jb 0x4a228f
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4a22fd
cmp dword [ebp - 8], 8
lea eax, [ebp - 0x1c]
jb 0x4a22a6
mov eax, dword [ebp - 0x1c]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.004a2360
mov esi, eax
add esp, 8
cmp edi, esi
je 0x4a22f5
mov ecx, edi
call fcn.004072c0
mov eax, dword [esi]
mov dword [edi], eax
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 8]
mov dword [edi + 8], eax
mov eax, dword [esi + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [edi + 0x10], eax
mov eax, dword [esi + 0x14]
mov dword [edi + 0x14], eax
xor eax, eax
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
lea ecx, [ebp - 0x34]
call fcn.00407320
mov edx, dword [ebp - 8]
pop esi
cmp edx, 8
jb 0x4a2334
mov ecx, dword [ebp - 0x1c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4a232a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4a234c
push edx
push ecx
call fcn.004c1e27
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, edi
xor ecx, ebp
pop edi
call fcn.004c20c9
mov esp, ebp
pop ebp
ret 4
call fcn.004c7d81
call fcn.004c7d81
int3