joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4491b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
lea esp, [esp]
mov ecx, dword [ebp + 8]
push 0
lea eax, [ebp - 4]
push eax
push 4
push ebx
push ecx
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x449215
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
je 0x449209
cmp esi, 0xe8
jne 0x449200
push 0xa
inc edi
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp edi, 0xa
jl 0x4491c0
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 0xd
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
sub eax, 4
neg eax
pop edi
sbb eax, eax
pop esi
and eax, 0xd
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x449230
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x10
push esi
push edi
xor esi, esi
push esi
push 0x190000
push 3
push esi
push esi
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x449271
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x44933c
pop edi
lea eax, [esi + 0xd]
pop esi
mov esp, ebp
pop ebp
ret
push 0
push 0
lea ecx, [ebp - 0xc]
push ecx
push edi
mov dword [ebp - 0xc], 3
call dword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
test eax, eax
jne 0x4492ad
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jne 0x449333
push edi
lea esi, [eax + 0xd]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea edx, [ebp - 8]
push edx
push 4
lea eax, [ebp + 0xc]
push eax
push edi
mov dword [ebp - 8], esi
call ebx
test eax, eax
jne 0x4492e9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jne 0x449332
pop ebx
push edi
lea esi, [eax + 0xd]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
cmp dword [ebp + 0x10], esi
je 0x449332
lea ecx, [ebp - 4]
xor eax, eax
push ecx
push edi
mov byte [ebp - 4], 0
mov word [ebp - 3], ax
mov byte [ebp - 1], al
call fcn.004491b0
mov esi, eax
add esp, 8
test esi, esi
jne 0x449332
mov eax, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
inc edx
sub eax, edx
neg eax
sbb eax, eax
and eax, 0xd
push 0
mov esi, eax
lea eax, [ebp - 8]
push eax
push 4
lea ecx, [ebp - 0x10]
push ecx
push edi
call ebx
pop ebx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4493d0
Capabilities:
Check if file exists
Check mutex on windows
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x428
mov eax, dword [0x553948]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push 0x208
push eax
lea ecx, [ebp - 0x41a]
push ecx
mov word [ebp - 0x41c], ax
call fcn.004e41d0
xor edx, edx
push 0x208
push edx
lea eax, [ebp - 0x20e]
push eax
mov word [ebp - 0x210], dx
call fcn.004e41d0
add esp, 0x18
push 0x105
lea ecx, [ebp - 0x210]
push ecx
lea edx, [ebp - 0x428]
push edx
lea eax, [ebp - 0x424]
push eax
lea ecx, [ebp - 0x420]
push ecx
push 0x105
lea edx, [ebp - 0x41c]
push edx
push 0x511a90
mov dword [ebp - 0x420], 0
mov dword [ebp - 0x424], 0
mov dword [ebp - 0x428], 0
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x44948f
mov eax, dword [ebp - 0x420]
push 0x104
push esi
push eax
call fcn.00449150
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0x10
jge 0x4494e1
push str.GlobalARM_Update_Mutex
push 0
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
test eax, eax
je 0x4494bf
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.thsnYaVieBoda
jmp 0x4494d6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x4494d1
push str.thsnYaVieBoda
jmp 0x4494d6
push str.TsnIorcAeBoda
push 0x104
push esi
call fcn.0042c070
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x4494f4
push eax
push 0x104
push esi
call fcn.0042c070
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00401316
mov esp, ebp
pop ebp
ret
Function at 0x44d6a0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x553948]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 4]
mov edx, dword [edi]
or ecx, 0x2001f
push ecx
xor esi, esi
push eax
push edx
lea ecx, [ebp - 0x210]
mov dword [ebp - 0x218], eax
mov dword [ebp - 0x210], esi
mov dword [ebp - 0x20c], esi
mov dword [ebp - 0x208], esi
call fcn.0044cf90
mov ebx, eax
cmp ebx, esi
je 0x44d71a
mov eax, dword [ebp - 0x210]
cmp eax, esi
je 0x44d705
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401316
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x220]
push eax
mov eax, dword [ebp - 0x210]
push esi
push esi
push esi
lea ecx, [ebp - 0x214]
push ecx
lea edx, [ebp - 0x204]
push edx
push esi
push eax
mov dword [ebp - 0x214], pe_nt_image_headers32
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x44d79c
mov edi, edi
lea ecx, [ebp - 0x204]
push ecx
lea ecx, [ebp - 0x210]
call fcn.0044d6a0
mov ebx, eax
cmp ebx, esi
jne 0x44d6f4
lea edx, [ebp - 0x220]
push edx
mov edx, dword [ebp - 0x210]
push esi
push esi
push esi
lea eax, [ebp - 0x214]
push eax
lea ecx, [ebp - 0x204]
push ecx
push esi
push edx
mov dword [ebp - 0x214], pe_nt_image_headers32
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x44d750
mov eax, dword [ebp - 0x210]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, esi
je 0x44d7b5
push eax
call ebx
mov dword [ebp - 0x210], esi
mov eax, dword [ebp - 0x218]
push eax
mov ecx, edi
mov dword [ebp - 0x20c], esi
call fcn.0044ce70
mov edi, eax
mov eax, dword [ebp - 0x210]
cmp eax, esi
je 0x44d7d8
push eax
call ebx
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401316
mov esp, ebp
pop ebp
ret 4
Function at 0x450240
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x504276
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x553948]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
xor edx, edx
mov dword [ebp - 0x430], edx
mov dword [ebp - 4], edx
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], edx
mov dword [ebp - 0x418], edx
push 2
push edx
push eax
mov byte [ebp - 4], 1
call fcn.0044da20
mov esi, eax
mov dword [ebp - 0x420], esi
test esi, esi
jne 0x4502bc
call fcn.0044cc60
mov edi, eax
jmp 0x4503a1
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x4502d5
call fcn.0044cc60
jmp 0x450398
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [ebp - 0x424], ebx
test ebx, ebx
jne 0x4502f3
call fcn.0044cc60
jmp 0x450398
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
lea eax, [edi + 1]
mov dword [ebp - 0x41c], edi
cmp eax, edi
jae 0x450314
mov edi, 0x8007000e
jmp 0x45039a
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.0044e1d0
mov dword [ebp - 4], 1
jmp 0x45034c
mov eax, dword [ebp - 0x418]
test eax, eax
jne 0x45035d
mov edi, 0x8007000e
jmp 0x45039a
push edi
push eax
push edi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x450376
call fcn.0044cc60
jmp 0x450398
mov edx, dword [ebp - 0x418]
xor ecx, ecx
mov word [edx + eax*2], cx
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 0x418]
push eax
push ecx
lea ecx, [ebp - 0x42c]
call fcn.0044fba0
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea edx, [ebp - 0x414]
cmp dword [ebp - 0x418], edx
je 0x4503ba
lea ecx, [ebp - 0x418]
call fcn.0044d640
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00401316
mov esp, ebp
pop ebp
ret 0x10

Function at 0x452ef0
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push edi
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts.pdfUserChoice
push 0x80000001
mov dword [ebp - 4], 0
call esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x452f3a
mov ecx, dword [ebp - 4]
push ecx
call edi
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts.pdfUserChoice
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea edx, [ebp - 4]
push edx
push 2
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts.pdf
push 0x80000001
mov dword [ebp - 4], 0
call esi
test eax, eax
jne 0x452f6e
mov eax, dword [ebp - 4]
push str.Application
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ecx, dword [ebp - 4]
push ecx
call edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x453750
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5048a6
mov eax, dword fs:[0]
push eax
sub esp, 0x254
mov eax, dword [0x553948]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor edi, edi
cmp edx, edi
je 0x45385b
xor eax, eax
mov word [ebp - 0x234], ax
mov eax, edx
mov dword [ebp - 0x220], 7
mov dword [ebp - 0x224], edi
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x4537a6
sub eax, esi
sar eax, 1
push eax
push edx
lea ecx, [ebp - 0x234]
call fcn.004063e0
mov eax, dword [ebp - 0x220]
mov edx, dword [ebp - 0x234]
mov ebx, 8
mov dword [ebp - 4], edi
mov esi, edx
cmp eax, ebx
jae 0x453862
lea esi, [ebp - 0x234]
mov ecx, esi
mov edi, dword [ebp - 0x224]
cmp eax, ebx
lea ecx, [ecx + edi*2]
mov eax, edx
jae 0x4537fd
lea eax, [ebp - 0x234]
cmp eax, ecx
je 0x453818
push 0x40fb24
push esi
push ecx
push eax
lea ecx, [ebp - 0x258]
push ecx
call fcn.0040fae0
add esp, 0x14
lea edx, [ebp - 0x254]
push edx
push 0x20019
push 0
push str.SoftwareAdobeAcrobatExe
push 0x80000000
mov dword [ebp - 0x254], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x453866
cmp dword [ebp - 0x220], ebx
jb 0x45385b
mov eax, dword [ebp - 0x234]
push eax
call fcn.00406fa9
add esp, 4
xor al, al
jmp 0x4539c1
mov ecx, edx
jmp 0x4537e8
push 0x208
lea ecx, [ebp - 0x218]
push 0
push ecx
call fcn.004e41d0
add esp, 0xc
lea edx, [ebp - 0x25c]
push edx
mov edx, dword [ebp - 0x254]
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x260]
push ecx
push 0
push 0
push edx
mov dword [ebp - 0x25c], 0x206
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
mov eax, dword [ebp - 0x254]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x4538dd
cmp dword [ebp - 0x220], ebx
jb 0x45385b
mov ecx, dword [ebp - 0x234]
push ecx
call fcn.00406fa9
add esp, 4
xor al, al
jmp 0x4539c1
lea edx, [ebp - 0x218]
push edx
lea ecx, [ebp - 0x250]
call fcn.00408ac0
mov esi, dword [ebp - 0x23c]
mov edi, dword [ebp - 0x250]
mov byte [ebp - 4], 1
mov edx, edi
cmp esi, ebx
jae 0x4539dd
lea edx, [ebp - 0x250]
mov eax, edx
mov ecx, dword [ebp - 0x240]
lea eax, [eax + ecx*2]
mov ecx, edi
cmp esi, ebx
jae 0x453926
lea ecx, [ebp - 0x250]
cmp ecx, eax
je 0x45394d
push 0x40fb24
push edx
push eax
push ecx
lea edx, [ebp - 0x258]
push edx
call fcn.0040fae0
mov esi, dword [ebp - 0x23c]
mov edi, dword [ebp - 0x250]
add esp, 0x14
mov eax, dword [ebp - 0x234]
cmp dword [ebp - 0x220], ebx
jae 0x453961
lea eax, [ebp - 0x234]
mov ecx, dword [ebp - 0x224]
push ecx
push 0
push eax
lea ecx, [ebp - 0x250]
call fcn.0040a590
cmp eax, 0xffffffff
setne bl
cmp esi, 8
jb 0x45398a
push edi
call fcn.00406fa9
add esp, 4
xor edx, edx
cmp dword [ebp - 0x220], 8
mov dword [ebp - 0x23c], 7
mov dword [ebp - 0x240], 0
mov word [ebp - 0x250], dx
jb 0x4539bf
mov eax, dword [ebp - 0x234]
push eax
call fcn.00406fa9
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00401316
mov esp, ebp
pop ebp
ret
mov eax, edi
jmp 0x453911
Function at 0x455850
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x553948]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x455918
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.004e41d0
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
push esi
call dword [sym.imp.USER32.dll_GetClassNameW]
test eax, eax
jle 0x455918
cmp eax, 0x103
jae 0x455918
lea edx, [ebp - 0x20c]
push str.STATIC
push edx
call fcn.00408866
add esp, 8
test eax, eax
jne 0x455918
push 0x208
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.004e41d0
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x414]
push ecx
push esi
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
jle 0x455918
cmp eax, 0x103
jae 0x455918
lea edx, [ebp - 0x414]
push str.swBrowser
push edx
call fcn.00408866
add esp, 8
test eax, eax
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401316
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor al, al
pop esi
call fcn.00401316
mov esp, ebp
pop ebp
ret 4
Function at 0x455c80
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x504bdb
mov eax, dword fs:[0]
push eax
sub esp, 0x43c
mov eax, dword [0x553948]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x448]
push eax
xor ebx, ebx
push 1
push ebx
push str.4021007
mov dword [ebp - 0x448], ebx
call fcn.00438680
add esp, 0x10
movzx eax, ax
cmp word [ebp - 0x448], bx
je 0x455cf5
lea ecx, [ebp - 0x448]
push ecx
push ebx
push ebx
push str.4021007
call fcn.00438680
add esp, 0x10
movzx eax, ax
cmp ax, bx
jne 0x455d01
xor al, al
jmp 0x455ead
mov byte [ebp - 0x43d], bl
cmp edi, ebx
je 0x455ea7
cmp edi, 0xffff
je 0x455ea7
push edi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x455ea7
cmp dword [0x555374], ebx
je 0x455ea7
lea edx, [ebp - 0x444]
push edx
push edi
mov dword [ebp - 0x444], ebx
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test eax, eax
je 0x455ea7
mov eax, dword [ebp - 0x444]
cmp eax, ebx
je 0x455ea7
cmp eax, dword [0x555374]
jne 0x455ea7
push 0x208
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.004e41d0
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x420]
push ecx
push edi
call dword [sym.imp.USER32.dll_GetClassNameW]
test eax, eax
jle 0x455e87
cmp eax, 0x103
jae 0x455e87
mov edx, dword [ebx + 0x551808]
push edx
lea eax, [ebp - 0x420]
push eax
call fcn.00408866
add esp, 8
test eax, eax
jne 0x455e87
push 0x208
push eax
lea ecx, [ebp - 0x218]
push ecx
call fcn.004e41d0
add esp, 0xc
push 0x104
lea edx, [ebp - 0x218]
push edx
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov esi, eax
test esi, esi
jle 0x455e18
cmp esi, 0x103
jae 0x455e16
mov eax, dword [ebx + 0x551804]
push eax
lea ecx, [ebp - 0x218]
push ecx
call fcn.00408866
add esp, 8
test eax, eax
je 0x455e26
test esi, esi
jne 0x455e87
mov edx, dword [ebx + 0x551804]
cmp word [edx], 0
jne 0x455e87
mov eax, dword [ebp - 0x444]
push eax
lea ecx, [ebp - 0x43c]
push ecx
call fcn.00466200
add esp, 8
cmp dword [ebp - 0x42c], 0
mov dword [ebp - 4], 0
je 0x455e75
cmp dword [ebp - 0x428], 8
mov eax, dword [ebp - 0x43c]
jae 0x455e61
lea eax, [ebp - 0x43c]
mov edx, dword [ebx + 0x55180c]
push edx
push eax
call fcn.00408866
add esp, 8
test eax, eax
je 0x455e95
lea ecx, [ebp - 0x43c]
mov dword [ebp - 4], 0xffffffff
call fcn.0040a440
add ebx, 0xc
cmp ebx, 0xc
jb 0x455d6c
jmp 0x455ea7
lea ecx, [ebp - 0x43c]
mov byte [ebp - 0x43d], 1
call fcn.0040a440
mov al, byte [ebp - 0x43d]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00401316
mov esp, ebp
pop ebp
ret
Function at 0x456440
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x45645b
pop edi
pop ebx
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x456492
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
add eax, esi
and ecx, 0xf
jbe 0x45648e
jmp 0x456480
cmp esi, eax
jae 0x456492
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x456480
cmp esi, eax
jb 0x456499
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x456840
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x507968
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x553948]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x555378]
test eax, eax
jne 0x456901
mov ebx, dword [sym.imp.KERNEL32.dll_GetTempPathW]
push eax
push eax
call ebx
mov esi, eax
test esi, esi
je 0x4568f8
xor ecx, ecx
lea eax, [esi + 1]
mov edx, 2
mul edx
seto cl
push 0x556c48
neg ecx
or ecx, eax
push ecx
call fcn.0041880c
mov edi, eax
add esp, 8
test edi, edi
je 0x4568f8
lea eax, [esi + esi + 2]
push eax
push 0
push edi
call fcn.004e41d0
add esp, 0xc
push edi
push esi
call ebx
test eax, eax
je 0x4568ef
cmp eax, esi
ja 0x4568ef
push edi
lea ecx, [ebp - 0x2c]
call fcn.00408ac0
lea ecx, [ebp - 0x2c]
push ecx
mov dword [ebp - 4], 0
call fcn.0042ba10
add esp, 4
lea ecx, [ebp - 0x2c]
call fcn.0040a440
push edi
call fcn.00418a67
add esp, 4
mov eax, dword [0x555378]
test eax, eax
je 0x45690b
cmp dword [eax + 0x14], 8
jb 0x45690d
mov eax, dword [eax]
jmp 0x45690d
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00401316
mov esp, ebp
pop ebp
ret
Function at 0x458100
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5051b2
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x553948]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xor eax, eax
xor ebx, ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], eax
mov dword [esi + 0x50], eax
mov dword [esi + 0x54], eax
mov byte [esi + 0x58], bl
mov dword [esi + 8], ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov eax, dword [0x514084]
mov dword [esi + 0x2c], eax
mov ecx, dword [0x514088]
mov dword [esi + 0x30], ecx
mov edx, dword [0x51408c]
mov dword [esi + 0x34], edx
mov eax, dword [0x514090]
mov dword [esi + 0x38], eax
mov dword [esi + 0x5c], 0xffffffff
mov dword [esi + 0x60], ebx
mov dword [esi + 0x7c], ebx
mov dword [esi + 0x80], ebx
mov dword [esi + 0x84], ebx
mov dword [esi + 0x8c], ebx
mov dword [esi + 0x90], ebx
mov dword [esi + 0x94], ebx
mov dword [esi + 0x98], ebx
xor ecx, ecx
mov dword [esi + 0xb0], 7
mov dword [esi + 0xac], ebx
mov word [esi + 0x9c], cx
lea edx, [esi + 0x64]
push edx
mov byte [ebp - 4], 4
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x60], eax
cmp eax, ebx
jne 0x458200
lea ecx, [ebp - 0x20]
call fcn.004e3bc1
push 0x541908
lea eax, [ebp - 0x20]
push eax
call fcn.004e3d99
push esi
call fcn.00421670
mov ecx, eax
call fcn.00457a50
mov dword [esi + 0x5c], eax
cmp eax, ebx
jge 0x45822a
lea ecx, [ebp - 0x20]
call fcn.004e3bc1
push 0x541908
lea ecx, [ebp - 0x20]
push ecx
call fcn.004e3d99
push 0x556c48
push 0x10010
call fcn.0041884b
mov edi, eax
add esp, 8
cmp edi, ebx
je 0x458267
push 0x10000
lea edx, [edi + 8]
push ebx
push edx
mov dword [edi], ebx
mov dword [edi + 4], ebx
mov dword [edi + 0x10008], ebx
mov dword [edi + 0x1000c], ebx
call fcn.004e41d0
add esp, 0xc
jmp 0x458269
xor edi, edi
mov dword [ebp - 0x14], edi
mov byte [ebp - 4], 5
cmp edi, ebx
je 0x458280
push 0x41
push edi
push esi
call fcn.0045a0a0
add esp, 0xc
push edi
call fcn.00406fa9
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45b320
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5055ce
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x553948]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.004e2f5e
mov dword [ebp - 4], 0
push 4
call fcn.004051ca
mov edi, eax
add esp, 4
mov dword [ebp - 0x18], edi
mov byte [ebp - 4], 1
test edi, edi
je 0x45b3af
call fcn.004e2b52
mov dword [edi], eax
call fcn.004e2911
push 0
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.004e2846
mov byte [ebp - 4], 2
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x45b3a1
inc eax
mov dword [ebx + 4], eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10]
call fcn.004e286e
jmp 0x45b3b1
xor edi, edi
mov byte [ebp - 4], 0
mov dword [esi + 0x38], edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret