joyce8/EMBER2024-capa huggingface dataset:
Function at 0x423fc0
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
lea ecx, [ebp + 8]
push ecx
push 0x2011f
push 0
push dword [eax]
push dword [ebp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x423fe7
xor al, al
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
push 0
lea ecx, [ebp - 4]
push ecx
push 0
push 0x2011f
push 0
push 0
push 0
push dword [eax]
push dword [ebp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x423fe1
push str.Shlwapi.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x423fe1
push str.SHCopyKeyW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x423fe1
push 0
push dword [ebp - 4]
push 0
push dword [ebp + 8]
call eax
push 0x51707c
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x424050
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0x14]
push 0
push 0
push 0x2001f
push 0x100
push 0
push dword [esi]
lea ecx, [ebp - 0xc]
push edi
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
call fcn.0040c1c0
test eax, eax
je 0x4240b6
push 0
push 0
push 0x2001f
push 0
push 0
push dword [esi]
lea ecx, [ebp - 0xc]
push edi
call fcn.0040c1c0
test eax, eax
je 0x4240b6
mov esi, dword [ebp - 0xc]
xor bl, bl
jmp 0x42410b
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp - 0xc]
mov edx, dword [eax]
mov eax, dword [ebp + 8]
mov edi, dword [eax]
test edx, edx
jne 0x4240ce
mov edi, 0xd
jmp 0x4240f9
mov ecx, edx
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4240d3
sub ecx, ebx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push 0
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
test esi, esi
je 0x424106
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
test edi, edi
sete bl
test esi, esi
je 0x424116
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43f670
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push dword [ebp + 8]
xor edi, edi
call fcn.0043f420
mov esi, eax
add esp, 4
test esi, esi
jne 0x43f68f
lea eax, [edi + 7]
pop edi
pop esi
pop ebp
ret
push ebx
call fcn.0043f4d0
push esi
test eax, eax
je 0x43f6d1
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ebx, eax
test ebx, ebx
jne 0x43f709
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x43f709
mov eax, edi
inc edi
cmp eax, 3
jge 0x43f709
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ebx, eax
test ebx, ebx
je 0x43f6a6
jmp 0x43f709
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ebx, eax
test ebx, ebx
jne 0x43f709
lea ecx, [ecx]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x43f709
mov eax, edi
inc edi
cmp eax, 3
jge 0x43f709
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ebx, eax
test ebx, ebx
je 0x43f6e0
push esi
call fcn.0044fb10
add esp, 4
xor ecx, ecx
test ebx, ebx
pop ebx
mov eax, 0xa
pop edi
cmovne eax, ecx
pop esi
pop ebp
ret

Function at 0x43f7d0
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 8]
call fcn.0043f420
mov esi, eax
add esp, 4
test esi, esi
jne 0x43f7eb
lea eax, [esi + 7]
pop esi
pop ebp
ret
push ebx
call fcn.0043f4d0
push esi
test eax, eax
je 0x43f7fe
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jmp 0x43f804
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ebx, ebx
cmp eax, 0xffffffff
push esi
setne bl
call fcn.0044fb10
add esp, 4
mov eax, ebx
pop ebx
pop esi
pop ebp
ret

Function at 0x43f8f0
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
jne 0x43f900
xor eax, eax
pop esi
pop ebp
ret
call fcn.0043f4d0
test eax, eax
jne 0x43f921
mov ecx, esi
lea edx, [ecx + 1]
mov edi, edi
mov al, byte [ecx]
inc ecx
test al, al
jne 0x43f910
sub ecx, edx
cmp ecx, 0x104
ja 0x43f8fb
push esi
call fcn.0043f420
mov esi, eax
add esp, 4
test esi, esi
jne 0x43f936
lea eax, [esi + 7]
pop esi
pop ebp
ret
push ebx
call fcn.0043f4d0
push esi
test eax, eax
je 0x43f949
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jmp 0x43f94f
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push esi
mov ebx, eax
call fcn.0044fb10
add esp, 4
cmp ebx, 0xffffffff
jne 0x43f965
pop ebx
xor eax, eax
pop esi
pop ebp
ret
movsx eax, bl
and eax, 0x10
pop ebx
shr eax, 4
pop esi
pop ebp
ret
Function at 0x43fc30
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3a8
mov eax, dword [0x567680]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x5690d0]
push esi
push edi
mov edi, dword [ebp + 8]
test eax, eax
je 0x43fc6f
push 0x118
push eax
lea eax, [ebp - 0x13c]
push eax
call fcn.004ec760
add esp, 0xc
mov byte [ebp - 0x24], 0
jmp 0x43fcfa
call fcn.0043f4d0
test eax, eax
je 0x43fcb4
lea eax, [ebp - 0x3a8]
push eax
push 0x118
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x3a8]
push eax
call fcn.0043ff70
mov esi, eax
add esp, 4
test esi, esi
jne 0x43fcdb
pop edi
mov eax, 7
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e9514
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x274]
push eax
push 0x118
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x274]
push eax
call fcn.0043f5a0
mov esi, eax
add esp, 4
test esi, esi
je 0x43fc9f
push 0x118
lea eax, [ebp - 0x13c]
push esi
push eax
call fcn.004ec760
push esi
mov byte [ebp - 0x24], 0
call fcn.0044fb10
add esp, 0x10
lea ecx, [ebp - 0x13c]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x43fd03
sub ecx, edx
test ecx, ecx
jle 0x43fd22
lea eax, [ebp - 0x13c]
cmp byte [eax + ecx - 1], 0x5c
jne 0x43fd22
dec ecx
test ecx, ecx
jg 0x43fd16
cmp ecx, 0x136
jae 0x43fe0e
push ebx
mov byte [ebp + ecx - 0x13c], 0
mov ebx, 0x3e
lea esp, [esp]
lea eax, [ebp - 0x13c]
push eax
push str._setilqs_
push edi
call fcn.004ee69f
mov esi, edi
add esp, 0xc
lea ecx, [esi + 1]
lea ebx, [ebx]
mov al, byte [esi]
inc esi
test al, al
jne 0x43fd60
sub esi, ecx
lea eax, [edi + esi]
push eax
push 0xf
call fcn.004483d0
add esp, 8
mov ecx, 3
lea esp, [esp]
movzx eax, byte [edi + esi]
xor edx, edx
div ebx
lea esi, [esi + 5]
movzx eax, byte [edx + str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789]
mov byte [edi + esi - 5], al
movzx eax, byte [edi + esi - 4]
xor edx, edx
div ebx
movzx eax, byte [edx + str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789]
mov byte [edi + esi - 4], al
movzx eax, byte [edi + esi - 3]
xor edx, edx
div ebx
movzx eax, byte [edx + str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789]
mov byte [edi + esi - 3], al
movzx eax, byte [edi + esi - 2]
xor edx, edx
div ebx
movzx eax, byte [edx + str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789]
mov byte [edi + esi - 2], al
movzx eax, byte [edi + esi - 1]
xor edx, edx
div ebx
movzx eax, byte [edx + str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789]
mov byte [edi + esi - 1], al
dec ecx
jne 0x43fd80
push edi
mov byte [edi + esi], cl
call fcn.0043f7d0
add esp, 4
test eax, eax
jne 0x43fd40
mov ecx, dword [ebp - 4]
pop ebx
pop edi
xor ecx, ebp
pop esi
call fcn.004e9514
mov esp, ebp
pop ebp
ret
call fcn.004eec88
int3
Function at 0x43fe20
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x5690cc], 0
push esi
jne 0x43fe60
call fcn.0043f7c0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov esi, eax
mov dword [0x5690d4], esi
cmp esi, 0xffffffff
jne 0x43fe4f
call fcn.0043f980
xor eax, eax
pop esi
pop ebp
ret
mov dword [0x5690cc], 1
call fcn.0043f980
jmp 0x43fe66
mov esi, dword [0x5690d4]
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
mov eax, dword [ebp + 8]
test eax, eax
jle 0x43feb0
test esi, esi
jne 0x43fef1
push 0xc
call fcn.0043f5e0
mov esi, eax
add esp, 4
test esi, esi
je 0x43fef1
movq xmm0, qword [0x51e6f4]
movq qword [esi], xmm0
mov eax, dword [0x51e6fc]
push esi
push dword [0x5690d4]
mov dword [esi + 8], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, esi
pop esi
pop ebp
ret
test esi, esi
je 0x43fef1
test eax, eax
jns 0x43fef1
mov eax, dword [esi]
cmp eax, dword [0x51e6f4]
jne 0x43fef1
mov eax, dword [esi + 4]
cmp eax, dword [0x51e6f8]
jne 0x43fef1
mov eax, dword [esi + 8]
cmp eax, dword [0x51e6fc]
jne 0x43fef1
push esi
call fcn.0043f5d0
add esp, 4
push 0
push dword [0x5690d4]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
xor esi, esi
mov eax, esi
pop esi
pop ebp
ret
Function at 0x44caa0
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 0xc]
cmp edi, 2
jge 0x44cab4
mov eax, 0x17
pop edi
pop ebp
ret
push ebx
mov ebx, dword [ebp + 8]
push esi
movzx eax, byte [ebx + edi - 1]
movzx ecx, byte [ebx]
movzx eax, byte [eax + 0x521dd8]
movzx ecx, byte [ecx + 0x521dd8]
lea eax, [eax + eax*2]
shl ecx, 2
xor eax, ecx
xor eax, edi
cdq
mov ecx, 0x7f
idiv ecx
movzx esi, byte [edx + str.Pk_]
dec esi
js 0x44cb21
jmp 0x44caf0
movzx eax, byte [esi + 0x521848]
cmp eax, edi
jne 0x44cb17
movzx eax, word [esi*2 + 0x5218c0]
push edi
add eax, str.ABORTABLEFTEMPORARYADDATABASELECTHENDEFAULTRANSACTIONATURALTERAISEACHECKEYAFTEREFERENCESCAPELSEXCEPTRIGGEREGEXPLAINITIALLYANALYZEXCLUSIVEXISTSTATEMENTANDEFERRABLEATTACHAVINGLOBEFOREIGNOREINDEXAUTOINCREMENTBEGINNERENAMEBETWEENOTNULLIKEBYCASCADEFERREDELETECASECASTCOLLATECOLUMNCOMMITCONFLICTCONSTRAINTERSECTCREATECROSSCURRENT_DATECURRENT_TIMESTAMPLANDESCDETACHDISTINCTDROPRAGMATCHFAILIMITFROMFULLGROUPDATEIFIMMEDIATEINSERTINSTEADINTOFFSETISNULLJOINORDEREPLACEOUTERESTRICTPRIMARYQUERYRIGHTROLLBACKROWHENUNIONUNIQUEUSINGVACUUMVALUESVIEWHEREVIRTUAL
push ebx
push eax
call fcn.00450320
add esp, 0xc
test eax, eax
je 0x44cb2b
movzx esi, byte [esi + 0x5217d0]
dec esi
jns 0x44caf0
pop esi
pop ebx
mov eax, 0x17
pop edi
pop ebp
ret
movzx eax, byte [esi + 0x5219b0]
pop esi
pop ebx
pop edi
pop ebp
ret

Function at 0x44cb50
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.0044caa0
Function at 0x45df20
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50c4c3
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x567680]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi + 4], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov byte [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi], 0x522ab0
mov eax, dword [0x5671f0]
mov ecx, 0x5671f0
mov dword [ebp - 4], 0
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi + 0x28], eax
push dword [ebp + 8]
lea ecx, [edi + 0x28]
mov byte [ebp - 4], 1
call fcn.004026d0
mov eax, dword [ebp + 0xc]
mov dword [edi + 0x2c], eax
mov dword [edi + 0x30], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x460c20
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
mov eax, dword [0x567680]
xor eax, ebp
mov dword [ebp - 4], eax
movzx eax, word [ebp + 8]
push esi
mov esi, dword [0x56b414]
push edi
push 0xf0
push eax
push esi
mov dword [ebp - 0x10c], ecx
mov edi, 1
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x460dae
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x460dae
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x460dae
mov edx, 0x1234
push ebx
movzx eax, word [esi]
xor ecx, ecx
cmp cx, ax
je 0x460d99
mov ecx, dword [esi + 4]
mov ebx, eax
movzx eax, word [esi + 2]
mov dword [ebp - 0x110], ecx
mov ecx, 0x403
add esi, 8
cmp cx, ax
jne 0x460d0e
push 3
lea eax, [ebp - 0x104]
push esi
lea ecx, [ebp - 0x108]
mov dword [ebp - 0x108], eax
call fcn.00461ba0
push dword [ebp - 0x108]
mov eax, dword [ebp - 0x10c]
push 0
push 0x143
push ebx
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
xor ecx, ecx
cmp eax, 0xffffffff
mov eax, dword [ebp - 0x108]
cmove edi, ecx
lea ecx, [ebp - 0x104]
cmp eax, ecx
je 0x460d86
push eax
call fcn.004ea042
add esp, 4
jmp 0x460d86
cmp dx, ax
jne 0x460d8b
push 3
lea eax, [ebp - 0x104]
push esi
lea ecx, [ebp - 0x108]
mov dword [ebp - 0x134], 1
mov dword [ebp - 0x130], 0xffffffff
mov dword [ebp - 0x108], eax
call fcn.00461ba0
mov eax, dword [ebp - 0x108]
lea ecx, [ebp - 0x104]
mov dword [ebp - 0x12c], eax
cmp eax, ecx
je 0x460d60
push eax
call fcn.004ea042
add esp, 4
lea eax, [ebp - 0x134]
push eax
mov eax, dword [ebp - 0x10c]
push 0
push 0x40b
push ebx
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
xor ecx, ecx
cmp eax, 0xffffffff
cmove edi, ecx
mov edx, 0x1234
add esi, dword [ebp - 0x110]
test edi, edi
jne 0x460c86
pop ebx
mov eax, edi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e9514
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.004e9514
mov esp, ebp
pop ebp
ret 4
Function at 0x4624e0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0xcf
mov esi, ecx
call fcn.00460c20
mov eax, dword [ebp + 0x14]
mov dword [ebp - 4], 0
mov dword [eax], 0
lea eax, [ebp - 4]
push eax
push 0
push esi
push 0x4644c0
push 0
push 0
call fcn.004ef708
add esp, 0x18
mov dword [esi + 0x30], eax
push 0
push 0x3e8
push 0x5df
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetTimer]
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4673a0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50e148
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x567680]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], 0
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov ecx, eax
shr ecx, 8
movzx edi, al
movzx ebx, cl
cmp eax, 0x80000000
jae 0x4673ee
mov esi, eax
shr esi, 0x10
cmp edi, 6
jb 0x467418
cmp ebx, 2
jb 0x467418
mov esi, dword [ebp + 8]
push esi
call fcn.00467490
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x5671f0]
mov ecx, 0x5671f0
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
push esi
push ebx
push edi
lea eax, [ebp - 0x10]
push 0x52327c
push eax
mov dword [ebp - 4], 0
call fcn.00405320
mov esi, dword [ebp - 0x10]
add esi, 0xfffffff0
push esi
call fcn.00405030
mov edi, dword [ebp + 8]
add eax, 0x10
mov dword [edi], eax
add esp, 0x18
mov dword [ebp - 4], 0xffffffff
lea eax, [esi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x467478
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x473030
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov eax, ecx
push 0
push dword [eax + 0x20]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
push 0x404
mov dword [ebp - 0xc], esi
call fcn.004e8060
mov edi, eax
mov eax, 4
add esp, 4
xor ebx, ebx
cmp esi, eax
jbe 0x4730fd
mov edx, 0x404
test ebx, ebx
jne 0x4730fd
add eax, 0x400
cmp eax, esi
mov ecx, eax
cmova ecx, esi
push ebx
mov eax, esi
sub eax, ecx
push ebx
sub esi, eax
push eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
cmp esi, 0x404
push dword [eax + 0x20]
mov dword [ebp - 0x10], ecx
cmova esi, edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebx
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
push esi
push edi
push dword [eax + 0x20]
call dword [sym.imp.KERNEL32.dll_ReadFile]
lea eax, [esi - 3]
test eax, eax
jle 0x4730ea
dec eax
cmp byte [eax + edi], 0x50
jne 0x4730df
cmp byte [eax + edi + 1], 0x4b
jne 0x4730df
cmp byte [eax + edi + 2], 5
jne 0x4730df
cmp byte [eax + edi + 3], 6
je 0x4730e5
test eax, eax
jg 0x4730c3
jmp 0x4730ea
mov ebx, dword [ebp - 8]
add ebx, eax
mov esi, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
mov edx, 0x404
cmp eax, esi
jb 0x473071
push edi
call fcn.004e8ec3
add esp, 4
test ebx, ebx
je 0x473113
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
push 0xffffffffffffff99
call fcn.00472120
int3
Function at 0x476650
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50e10b
mov eax, dword fs:[0]
push eax
sub esp, 0x260
mov eax, dword [0x567680]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
push str.extensions
push eax
lea eax, [ebp - 0x26c]
push eax
call fcn.00402b60
add esp, 0xc
lea ecx, [ebp - 0x260]
push ecx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, dword [ebp - 0x26c]
add esi, 0xfffffff0
mov edi, eax
mov dword [ebp - 0x268], edi
lea edx, [esi + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4766cd
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
cmp edi, 0xffffffff
je 0x476840
mov ebx, 0x18
jmp 0x4766e0
test byte [ebp - 0x260], 0x10
je 0x4767de
mov eax, dword [0x5671f0]
mov ecx, 0x5671f0
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x264], esi
lea eax, [ebp - 0x234]
mov dword [ebp - 4], 0
test eax, 0xffff0000
jne 0x47677e
movzx edi, ax
push 0
push edi
call fcn.00403090
add esp, 8
test eax, eax
je 0x47673c
push edi
push eax
lea ecx, [ebp - 0x264]
call fcn.004082e0
mov esi, dword [ebp - 0x264]
mov edi, dword [ebp - 0x268]
mov eax, dword [ebp + 8]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [eax]
test eax, eax
je 0x47682f
mov ecx, esi
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x4767b1
test dx, dx
je 0x47677a
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x4767b1
add ecx, 4
add eax, 4
test dx, dx
jne 0x476758
xor eax, eax
jmp 0x4767b6
lea ecx, [ebp - 0x234]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x476787
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x264]
call fcn.0040b9d0
mov esi, dword [ebp - 0x264]
jmp 0x476742
sbb eax, eax
or eax, 1
test eax, eax
sete bl
add esi, 0xfffffff0
or ecx, 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4767d5
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
test bl, bl
jne 0x476824
mov ebx, 0x18
lea eax, [ebp - 0x260]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x476839
mov ecx, dword [0x568ad4]
lea eax, [ecx + 1]
imul eax, ecx
cdq
idiv ebx
cmp edx, 1
jne 0x4766e0
push 0x99
push 0x98
push str._d__d_n
call fcn.004ea95e
add esp, 0xc
jmp 0x4766e0
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov al, 1
jmp 0x476842
push 0x80004005
call fcn.00403100
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e9514
mov esp, ebp
pop ebp
ret 8
Function at 0x48da90
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
call fcn.00464ea0
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push 5
push esi
push ebx
or edi, 0xffffffff
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 8], eax
test eax, eax
je 0x48db68
push 0xf0
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ecx, eax
mov eax, dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], 0
test ecx, ecx
je 0x48daee
push ecx
push ebx
call eax
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
mov eax, dword [sym.imp.KERNEL32.dll_LoadResource]
push dword [ebp - 8]
xor esi, esi
push ebx
call eax
test eax, eax
je 0x48db55
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 8], eax
test eax, eax
je 0x48db55
push dword [ebp - 4]
push eax
call fcn.0048fd80
add esp, 8
mov ebx, eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push ebx
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_DialogBoxIndirectParamW]
mov edi, eax
test edi, edi
je 0x48db34
cmp edi, 0xffffffff
jne 0x48db3c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp ebx, dword [ebp - 8]
je 0x48db5d
test ebx, ebx
je 0x48db5d
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalHandle]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x48db5d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
je 0x48db68
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48f1a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5112b6
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x567680]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x41c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x420], eax
mov dword [ebp - 0x430], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], 0
mov dword [ebp - 0x418], 0
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push 0x60
push 0
push esi
mov byte [ebp - 4], 1
call ebx
mov edi, eax
mov dword [ebp - 0x424], edi
test edi, edi
jne 0x48f24c
push 2
push eax
push esi
call ebx
mov edi, eax
mov dword [ebp - 0x424], eax
test edi, edi
jne 0x48f24c
call fcn.0045f3f0
mov esi, eax
jmp 0x48f33c
push dword [ebp - 0x420]
push dword [ebp - 0x41c]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x48f26f
call fcn.0045f3f0
jmp 0x48f32f
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [ebp - 0x41c], ebx
test ebx, ebx
jne 0x48f28d
call fcn.0045f3f0
jmp 0x48f32f
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov dword [ebp - 0x420], esi
lea eax, [esi + 1]
cmp eax, esi
jae 0x48f2ae
mov esi, 0x8007000e
jmp 0x48f331
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.0048e510
jmp 0x48f2d8
cmp dword [ebp - 0x418], 0
mov dword [ebp - 4], 1
jne 0x48f2ef
mov esi, 0x8007000e
jmp 0x48f331
push esi
push dword [ebp - 0x418]
push esi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
jne 0x48f30f
call fcn.0045f3f0
jmp 0x48f32f
mov eax, dword [ebp - 0x418]
push dword [ebp + 0x14]
xor edx, edx
mov word [eax + ecx*2], dx
push dword [ebp - 0x418]
lea ecx, [ebp - 0x42c]
call fcn.0048f040
mov esi, eax
test edi, edi
je 0x48f33c
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x48f360
lea ecx, [ebp - 0x418]
call fcn.0048e920
jmp 0x48f360
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004e9514
mov esp, ebp
pop ebp
ret 0x10