joyce8/EMBER2024-capa huggingface dataset:
Function at 0x468b60
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
mov eax, dword [0x51e080]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc4], eax
push ebx
push esi
mov esi, ecx
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0xc8], ecx
push edi
test eax, eax
je 0x468bce
test ecx, ecx
je 0x468bce
cmp dword [esi + 0x30], 1
je 0x468bce
lea edi, [esi + 0x10]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esi + 0x54], 0
je 0x468d0d
push 4
lea eax, [ebp - 0xc0]
mov ecx, esi
push eax
call fcn.00468730
mov ebx, dword [ebp - 0xc0]
cmp ebx, dword [esi + 0x40]
jbe 0x468be6
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d3878
mov esp, ebp
pop ebp
ret 8
lea ecx, [ebx + 6]
mov eax, 0x10
and ecx, 0xf
sub eax, ecx
neg ecx
sbb ecx, ecx
and ecx, eax
lea eax, [ebx + 0x16]
add eax, ecx
mov dword [ebp - 0xc0], eax
mov eax, dword [esi + 0x58]
inc eax
add eax, ecx
mov ecx, dword [esi + 0x50]
mov dword [esi + 0x58], eax
cmp eax, ecx
jb 0x468c19
sub eax, ecx
mov dword [esi + 0x58], eax
push 1
lea eax, [ebp - 0xb9]
mov ecx, esi
push eax
call fcn.00468730
push ebx
push dword [ebp - 0xc4]
mov ecx, esi
call fcn.00468730
push 0x10
lea eax, [ebp - 0xb8]
mov ecx, esi
push eax
call fcn.00468730
mov eax, dword [ebp - 0xc0]
sub dword [esi + 0x54], eax
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp byte [ebp - 0xb9], 0
je 0x468d14
mov eax, dword [esi + 4]
mov esi, dword [eax + 0x480]
lea eax, [ebp - 0x60]
push eax
push ebx
push dword [ebp - 0xc4]
mov ecx, esi
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x60], 0x67452301
mov dword [ebp - 0x5c], 0xefcdab89
mov dword [ebp - 0x58], 0x98badcfe
mov dword [ebp - 0x54], 0x10325476
call fcn.004b2200
lea eax, [ebp - 0x60]
mov ecx, esi
push eax
call fcn.004b2580
mov eax, dword [ebp - 0xb8]
cmp eax, dword [ebp - 0x60]
jne 0x468bce
mov eax, dword [ebp - 0xb4]
cmp eax, dword [ebp - 0x5c]
jne 0x468bce
mov eax, dword [ebp - 0xb0]
cmp eax, dword [ebp - 0x58]
jne 0x468bce
mov eax, dword [ebp - 0xac]
cmp eax, dword [ebp - 0x54]
jne 0x468bce
mov eax, dword [ebp - 0xc8]
mov dword [eax], ebx
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d3878
mov esp, ebp
pop ebp
ret 8
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 4]
mov eax, 2
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004d3878
mov esp, ebp
pop ebp
ret 8
Function at 0x468d30
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
mov eax, dword [0x51e080]
xor eax, ebp
mov dword [ebp - 8], eax
mov edx, dword [ebp + 0xc]
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0xcc], edx
mov ecx, dword [ebp + 8]
xor ebx, ebx
push edi
mov dword [ebp - 0xc4], ecx
mov dword [ebp - 0xc8], ebx
test ecx, ecx
je 0x468f00
test edx, edx
je 0x468f00
cmp dword [esi + 0x30], 1
je 0x468f00
lea edi, [esi + 0x10]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esi + 0x54], 0
je 0x468e31
push 4
lea eax, [ebp - 0xd0]
mov ecx, esi
push eax
call fcn.00468730
mov ebx, dword [ebp - 0xd0]
cmp ebx, dword [esi + 0x40]
ja 0x468ef9
lea ecx, [ebx + 6]
mov eax, 0x10
and ecx, 0xf
sub eax, ecx
neg ecx
sbb ecx, ecx
and ecx, eax
lea eax, [ebx + 0x16]
add eax, ecx
mov dword [ebp - 0xd4], eax
mov eax, dword [esi + 0x58]
inc eax
add eax, ecx
mov ecx, dword [esi + 0x50]
mov dword [esi + 0x58], eax
cmp eax, ecx
jb 0x468de2
sub eax, ecx
mov dword [esi + 0x58], eax
push 1
lea eax, [ebp - 0xbd]
mov ecx, esi
push eax
call fcn.00468730
push ebx
push dword [ebp - 0xc4]
mov ecx, esi
call fcn.00468730
push 0x10
lea eax, [ebp - 0xbc]
mov ecx, esi
push eax
call fcn.00468730
mov eax, dword [ebp - 0xd4]
sub dword [esi + 0x54], eax
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp byte [ebp - 0xbd], 0
jne 0x468e60
mov ebx, dword [ebp - 0xc8]
jmp 0x468e38
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp ebx, 0x5dc
ja 0x468f18
push 5
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0xc4]
add ebx, 5
mov edx, dword [ebp - 0xcc]
jmp 0x468d5c
mov eax, dword [esi + 4]
mov esi, dword [eax + 0x480]
lea eax, [ebp - 0x64]
push eax
push ebx
push dword [ebp - 0xc4]
mov ecx, esi
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x64], 0x67452301
mov dword [ebp - 0x60], 0xefcdab89
mov dword [ebp - 0x5c], 0x98badcfe
mov dword [ebp - 0x58], 0x10325476
call fcn.004b2200
lea eax, [ebp - 0x64]
mov ecx, esi
push eax
call fcn.004b2580
mov eax, dword [ebp - 0xbc]
cmp eax, dword [ebp - 0x64]
jne 0x468f00
mov eax, dword [ebp - 0xb8]
cmp eax, dword [ebp - 0x60]
jne 0x468f00
mov eax, dword [ebp - 0xb4]
cmp eax, dword [ebp - 0x5c]
jne 0x468f00
mov eax, dword [ebp - 0xb0]
cmp eax, dword [ebp - 0x58]
jne 0x468f00
mov eax, dword [ebp - 0xcc]
mov dword [eax], ebx
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004d3878
mov esp, ebp
pop ebp
ret 0xc
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004d3878
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp - 8]
mov eax, 2
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004d3878
mov esp, ebp
pop ebp
ret 0xc
Function at 0x46abd0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
lea esi, [edi + 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push esi
mov dword [edi + 0x38], 0
mov dword [edi + 0x4c], 0
mov dword [edi + 0x48], 0
mov dword [edi + 0x58], 0
mov dword [edi + 0x54], 0
mov dword [edi + 0x64], 0
mov dword [edi + 0x68], 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [edi + 0x30], 1
jne 0x46ac27
mov ecx, edi
call fcn.0046acd0
cmp dword [edi + 0x28], 0
jne 0x46ac69
mov eax, dword [ebp + 8]
lea esi, [edi + 0x34]
mov ecx, dword [edi + 8]
movups xmm0, xmmword [eax]
movups xmmword [edi + 0x6c], xmm0
movups xmm0, xmmword [eax + 0x10]
movups xmmword [edi + 0x7c], xmm0
movq xmm0, qword [eax + 0x20]
mov eax, dword [eax + 8]
push eax
push esi
movq qword [edi + 0x8c], xmm0
mov dword [edi + 0xc], eax
call fcn.004339f0
test eax, eax
je 0x46ac76
mov dword [esi], 0
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 4
push 0
push 0
push 1
push 0
mov dword [edi + 0x28], 1
mov dword [edi + 0x2c], 1
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [edi + 0x3c], eax
lea eax, [ebp - 4]
push eax
push 0
push edi
push 0x468f30
push 0
push 0
mov dword [edi + 0x30], 0
call fcn.004d9be5
add esp, 0x18
mov dword [edi], eax
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x46c870
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc0
mov eax, dword [0x51e080]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, ecx
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 8]
mov ecx, dword [ebx + 0x3c]
push esi
mov dword [ebp - 0xa8], ebx
mov dword [ebp - 0xb0], esi
call fcn.004ab560
test eax, eax
jne 0x46caa8
lea ecx, [esi + 0x14]
mov dword [ebp - 0xb8], ecx
test ecx, ecx
je 0x46c91f
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x84]
push eax
mov eax, dword [ebp + 0x10]
add eax, 0xffffffec
mov dword [ebp - 0x84], 0x6a09e667
push eax
push ecx
mov dword [ebp - 0x80], 0xbb67ae85
mov dword [ebp - 0x7c], 0x3c6ef372
mov dword [ebp - 0x78], 0xa54ff53a
mov dword [ebp - 0x74], 0x510e527f
mov dword [ebp - 0x70], 0x9b05688c
mov dword [ebp - 0x6c], 0x1f83d9ab
mov dword [ebp - 0x68], 0x5be0cd19
call fcn.004b2370
lea eax, [ebp - 0x84]
push eax
call fcn.004b2880
xor ecx, ecx
nop dword [eax]
nop word [eax + eax]
mov eax, dword [ebp + ecx*4 - 0x84]
cmp eax, dword [edi + ecx*4]
jne 0x46caa8
inc ecx
cmp ecx, 8
jb 0x46c930
mov eax, dword [ebx + 0x14]
mov eax, dword [eax + 0x4a8]
mov dword [ebp - 0xac], eax
lea esi, [eax + 4]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
test edi, edi
je 0x46c988
mov ecx, dword [ebp - 0xac]
lea eax, [ebp - 0xb4]
push eax
lea eax, [ebp - 0xbc]
push eax
push edi
push 0x20
push 0x77fc87de
call fcn.004088a0
test eax, eax
je 0x46c991
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x46c9d4
mov eax, dword [ebp - 0xb4]
test eax, eax
je 0x46c9aa
mov ebx, dword [eax + 0x68]
mov dword [ebp - 0xac], 0
jmp 0x46c9b6
mov dword [ebp - 0xac], 1
xor ebx, ebx
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [ebp - 0xac], 0
jne 0x46c9ce
test ebx, ebx
jne 0x46ca93
mov ebx, dword [ebp - 0xa8]
mov eax, dword [ebp - 0xb8]
mov ecx, dword [ebp - 0xb0]
add ecx, 0x18
mov eax, dword [eax]
test eax, eax
je 0x46caa8
cmp eax, 0x400
ja 0x46caa8
cmp word [ecx + eax*2 - 2], 0
jne 0x46caa8
mov eax, dword [ebx + 0x14]
push ecx
mov ecx, dword [eax + 0x47c]
call fcn.00478900
test eax, eax
jne 0x46caa8
mov eax, dword [ebx + 0x14]
mov esi, dword [eax + 0x4c8]
lea eax, [ebp - 0xa8]
push eax
mov ecx, esi
call fcn.0047ac20
test eax, eax
je 0x46ca44
lea eax, [ebp - 0xa8]
mov ecx, esi
push eax
call fcn.0047acd0
mov eax, dword [ebp - 0xa8]
mov esi, dword [ebp - 0xb0]
lea edx, [eax + 0x78]
add eax, 0xfffd5d00
mov ecx, dword [esi + 0x10]
cmp ecx, eax
jb 0x46ca93
cmp ecx, edx
ja 0x46ca93
push 3
lea eax, [ebp - 0xa4]
push eax
call fcn.004ae980
push dword [ebp + 0x10]
mov ecx, dword [ebx + 0x14]
lea eax, [ebp - 0xa4]
push esi
push edi
push eax
mov ecx, dword [ecx + 0x49c]
call fcn.004a72a0
push ecx
mov ecx, ebx
call fcn.0046d3e0
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004d3878
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp - 8]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004d3878
mov esp, ebp
pop ebp
ret 0xc
Function at 0x471e60
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 8], ecx
test edi, edi
je 0x471fa1
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x471fa1
mov esi, edi
lea edx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x471e87
mov ebx, ecx
sub esi, edx
sar esi, 1
lea ecx, [ebx + 2]
nop dword [eax + eax]
mov ax, word [ebx]
add ebx, 2
test ax, ax
jne 0x471ea0
sub ebx, ecx
sar ebx, 1
mov dword [ebp - 0x10], ebx
lea eax, [ebx + esi]
mov dword [ebp - 4], eax
lea eax, [eax*2 + 2]
push eax
call fcn.004d9a7e
lea ecx, [esi + esi]
mov dword [ebp + 8], eax
push ecx
push edi
push eax
call fcn.004d6950
lea eax, [ebx + ebx]
mov ebx, dword [ebp + 8]
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
lea eax, [ebx + esi*2]
push eax
call fcn.004d6950
mov eax, dword [ebp - 4]
add esp, 0x1c
xor ecx, ecx
mov word [ebx + eax*2], cx
mov ecx, dword [ebp - 8]
push ebx
call fcn.00471fb0
cmp dword [ebp + 0x10], 0
je 0x471f8d
mov eax, dword [ebp - 4]
lea eax, [eax*2 + 0x10]
push eax
call fcn.004d9a7e
mov ebx, eax
lea eax, [esi + esi]
push eax
push edi
push ebx
call fcn.004d6950
movq xmm0, qword [0x50de04]
lea ecx, [esi + esi]
movq qword [ecx + ebx], xmm0
lea edi, [ebx + 0xe]
mov eax, dword [0x50de0c]
lea edi, [edi + esi*2]
mov dword [ecx + ebx + 8], eax
mov ax, word [0x50de10]
mov word [ecx + ebx + 0xc], ax
xor eax, eax
mov ecx, ebx
mov word [edi], ax
call fcn.004958d0
push dword [ebp - 0xc]
push dword [ebp + 0xc]
push edi
call fcn.004d6950
mov eax, dword [ebp - 0x10]
add esp, 0x1c
xor ecx, ecx
add eax, esi
push ecx
push ebx
push dword [ebp + 8]
mov word [ebx + eax*2 + 0xe], cx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push ebx
call fcn.004d9a63
mov ebx, dword [ebp + 8]
add esp, 4
push ebx
call fcn.004d9a63
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x473550
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x51e080]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov ebx, ecx
mov dword [ebp - 0x11c], 2
mov ecx, dword [ebp + 0xc]
xor esi, esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x114], ecx
mov dword [ebp - 0x118], 0
nop word [eax + eax]
cmp dword [ebx + 0x2c], 0
je 0x473622
push 0
push dword [ebp + 0x10]
push ecx
push edi
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
jne 0x473625
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x473622
cmp esi, 5
jge 0x473611
nop
inc esi
cmp dword [ebx + 0x2c], 0
je 0x473612
lea eax, [ebp - 0x11c]
mov dword [ebp - 0x10c], edi
push eax
push 0
push 0
lea eax, [ebp - 0x110]
mov dword [ebp - 0x110], 1
push eax
push 0
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
je 0x473622
test eax, eax
je 0x47360c
lea eax, [ebp - 0x110]
push eax
push edi
call dword [sym.imp.WS2_32.dll___WSAFDIsSet]
test eax, eax
jne 0x473612
cmp esi, 5
jl 0x4735c0
inc esi
cmp esi, 5
jge 0x473622
mov ecx, dword [ebp - 0x114]
jmp 0x473590
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004d3878
mov esp, ebp
pop ebp
ret 0x10

Function at 0x473640
Capabilities:
Get socket status
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
mov eax, dword [0x51e080]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
push ebx
push esi
xor esi, esi
mov dword [ebp - 0x114], edx
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
mov dword [ebp - 0x120], 2
mov dword [ebp - 0x11c], 0
mov dword [ebp - 0x118], esi
cmp dword [ebx + 0x2c], 0
je 0x473751
push 0
push dword [ebp + 0x10]
push edx
push edi
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
je 0x473767
jle 0x4736de
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp - 0x114]
sub ecx, eax
add dword [ebp - 0x118], eax
add edx, eax
mov dword [ebp - 0x114], edx
mov dword [ebp + 0x10], ecx
test ecx, ecx
jne 0x473748
mov eax, dword [ebp - 0x118]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d3878
mov esp, ebp
pop ebp
ret 0x10
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x473751
cmp esi, 5
jge 0x473741
inc esi
cmp dword [ebx + 0x2c], 0
je 0x473742
lea eax, [ebp - 0x120]
mov dword [ebp - 0x10c], edi
push eax
push 0
lea eax, [ebp - 0x110]
mov dword [ebp - 0x110], 1
push eax
push 0
push 0
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
je 0x473751
test eax, eax
je 0x47373c
lea eax, [ebp - 0x110]
push eax
push edi
call dword [sym.imp.WS2_32.dll___WSAFDIsSet]
test eax, eax
jne 0x473742
cmp esi, 5
jl 0x4736f0
inc esi
mov edx, dword [ebp - 0x114]
cmp esi, 5
jl 0x473680
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d3878
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004d3878
mov esp, ebp
pop ebp
ret 0x10
Function at 0x474080
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
mov ebx, ecx
push esi
push edi
mov edx, dword [ebx + 0x24]
mov esi, dword [edx + 0x458]
lea edi, [esi + esi]
lea eax, [edi + 2]
push eax
push dword [edx + 0x44c]
push dword [ebx + 0x60]
call fcn.004d6950
add esp, 0xc
mov eax, 0x104
sub eax, esi
push eax
mov eax, dword [ebx + 0x60]
add eax, edi
push eax
push 0xffffffffffffffff
push dword [ebp + 8]
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, dword [ebx + 0x60]
add edi, ecx
movzx eax, word [ecx]
test ax, ax
je 0x4740f7
mov edx, eax
mov esi, 0x5c
cmp dx, 0x2f
jne 0x4740e9
mov word [ecx], si
movzx eax, word [ecx + 2]
add ecx, 2
mov edx, eax
test ax, ax
jne 0x4740e0
push 0x50dff4
push dword [ebx + 0x60]
call fcn.004d61dd
add esp, 8
test eax, eax
jne 0x4741ba
push eax
push 0x80
push 3
push eax
push eax
push accept
push dword [ebx + 0x60]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4741c8
mov eax, dword [ebx + 0x28]
mov esi, dword [eax + 0x6c]
lea eax, [esi + 4]
push eax
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [ebp - 8]
mov ecx, esi
push eax
lea eax, [ebp - 0x10]
push eax
push edi
call fcn.00404ad0
mov edi, dword [ebp - 8]
test edi, edi
je 0x4741b1
cmp dword [edi + 0x20], 0
je 0x4741b1
mov esi, dword [ebp + 0x10]
mov eax, dword [edi + 0x1c]
push eax
mov dword [esi], eax
call fcn.004d9a7e
push dword [esi]
mov ecx, dword [ebp + 0xc]
push dword [edi + 0x20]
push eax
mov dword [ecx], eax
call fcn.004d6950
add esp, 0x10
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0x2e
push dword [ebx + 0x60]
call fcn.004d644c
add esp, 8
mov dword [ebx + 0x64], eax
test eax, eax
je 0x4741a6
add eax, 2
mov dword [ebx + 0x64], eax
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
lea eax, [ebp - 0x1c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
cmp dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x1c]
jl 0x4741fa
jg 0x4741e5
cmp eax, 0x100000
jbe 0x4741fa
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edi, dword [ebp + 0x10]
push eax
mov dword [edi], eax
call fcn.004d9a7e
mov ecx, dword [ebp + 0xc]
add esp, 4
push 0
mov dword [ecx], eax
lea ecx, [ebp - 0xc]
push ecx
push dword [edi]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [edi]
cmp eax, dword [ebp - 0xc]
je 0x47418c
push dword [ebx + 0x38]
call fcn.004d9a63
mov eax, dword [ebp + 0xc]
add esp, 4
mov dword [edi], 0
pop edi
pop esi
mov dword [eax], 0
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x475c20
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov eax, dword [0x51e080]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x28]
push eax
mov ebx, ecx
mov dword [ebp - 0x38], edi
push 0x50de70
mov dword [ebp - 0x2c], ebx
call fcn.00476c80
mov esi, dword [ebp - 0x28]
test esi, esi
je 0x475da0
lea eax, [ebp - 0x28]
mov ecx, ebx
push eax
push 0x50e314
call fcn.00476c80
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x475da0
push eax
call fcn.004de9d1
add esp, 4
mov edi, 1
test eax, eax
jne 0x475c9c
push 1
xor edi, edi
push edi
push edi
push esi
push str.open
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x475d83
cmp eax, 2
jne 0x475d83
mov ecx, esi
xorps xmm0, xmm0
movups xmmword [ebp - 0x24], xmm0
movups xmmword [ebp - 0x14], xmm0
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x475cb5
sub ecx, edx
sar ecx, 1
cmp ecx, 0x40
jne 0x475d52
lea eax, [ebp - 8]
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x28], eax
nop word [eax + eax]
lea edi, [ebp - 0x31]
xor ebx, ebx
movzx eax, word [esi]
lea ecx, [eax - 0x30]
cmp cx, 9
jbe 0x475d03
lea ecx, [eax - 0x61]
cmp cx, 5
ja 0x475d99
add eax, 0xffa9
movzx edx, word [esi + 2]
add esi, 4
lea ecx, [edx - 0x30]
cmp cx, 9
jbe 0x475d22
lea ecx, [edx - 0x61]
cmp cx, 5
ja 0x475d99
add edx, 0xffa9
shl al, 4
and dl, 0xf
or al, dl
inc ebx
mov byte [edi], al
dec edi
cmp ebx, 4
jb 0x475ce5
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x34]
mov dword [ecx], eax
sub ecx, 4
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x30], eax
cmp eax, 8
jb 0x475ce0
xor edi, edi
mov ebx, dword [ebp - 0x2c]
test edi, edi
jne 0x475d83
lea ecx, [ebp - 0x64]
call fcn.00406d70
lea eax, [ebp - 0x24]
mov dword [ebp - 0x64], 0x13d8e02a
mov dword [ebp - 0x54], eax
mov eax, ecx
mov ecx, dword [ebx + 0x24]
push eax
mov dword [ebp - 0x58], 4
mov ecx, dword [ecx + 0x470]
call fcn.004039d0
mov ecx, 0x1f4
test edi, edi
mov eax, 0xc8
cmovne eax, ecx
mov ecx, dword [ebp - 0x38]
mov dword [ecx], eax
jmp 0x475da6
mov edi, 1
jmp 0x475d4f
mov dword [edi], 0x1f4
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004d3878
mov esp, ebp
pop ebp
ret 8
Function at 0x475dc0
Capabilities:
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
mov eax, ecx
mov dword [ebp - 8], 0
push ebx
push esi
mov dword [ebp - 0x14], eax
or ebx, 0xffffffff
mov eax, dword [eax + 0x24]
push edi
push 0
push 0x508b5541
mov eax, dword [eax + 0x478]
mov ecx, eax
mov dword [ebp - 4], eax
call fcn.00407340
test eax, eax
je 0x475dfe
lea edi, [ebx + 2]
jmp 0x475fb2
push 0x208
call fcn.004d9a7e
add esp, 4
mov esi, eax
push 0x208
call fcn.004d9a7e
add esp, 4
mov edi, eax
push 0x208
call fcn.004d9a7e
add esp, 4
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x70]
push 0x58
push 0
push eax
call fcn.004d6ed0
mov ecx, dword [ebp + 0xc]
add esp, 0xc
test ecx, ecx
je 0x475e67
push ecx
push 0x104
push esi
call fcn.004d9c76
add esp, 0xc
push 0x50d864
push 0x104
push esi
call fcn.004de7d9
add esp, 0xc
jmp 0x475e6c
xor eax, eax
mov word [esi], ax
mov ecx, dword [ebp - 4]
lea edx, [ebp - 0x10]
mov dword [ebp - 0x70], 0x58
mov dword [ebp - 0x64], str.XML_files_.xml_
mov dword [ebp - 0x54], esi
mov eax, dword [ecx + 0x54]
mov ecx, dword [ecx + 0x6c]
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x50], 0x104
mov dword [ebp - 0x3c], 0x880802
mov eax, dword [ecx]
push 0x2ddc6a4f
push edx
call dword [eax]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 4]
push edi
push 0xa6a44314
mov eax, dword [eax + 0x60]
mov ecx, dword [eax + 0x4cc]
call fcn.00471b30
test eax, eax
je 0x475ed1
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea eax, [ebp - 0x70]
mov dword [ebp - 0x44], edi
push eax
call dword [sym.imp.COMDLG32.dll_GetSaveFileNameW]
test eax, eax
jne 0x475f06
push dword [ebp - 0xc]
call fcn.004d9a63
add esp, 4
push edi
call fcn.004d9a63
add esp, 4
push esi
call fcn.004d9a63
mov edi, 1
jmp 0x475faf
push 0x5c
push esi
call fcn.004d644c
add esp, 8
mov dword [ebp + 0xc], eax
test eax, eax
je 0x475f3f
xor ecx, ecx
mov word [eax], cx
mov eax, dword [ebp - 4]
push esi
push 0xa6a44314
mov ecx, dword [eax + 0x60]
mov ecx, dword [ecx + 0x4cc]
call fcn.00471bb0
mov eax, dword [ebp + 0xc]
mov ecx, 0x5c
mov word [eax], cx
push dword [ebp - 0xc]
call fcn.004d9a63
add esp, 4
push edi
call fcn.004d9a63
mov ecx, dword [ebp - 0x14]
lea eax, [ebp + 0xc]
add esp, 4
push 1
push 0
push eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call fcn.00474260
mov edi, eax
mov eax, esi
test edi, edi
jne 0x475fa5
push edi
push 0x80
push 2
push edi
push edi
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
mov eax, esi
cmp ebx, 0xffffffff
je 0x475fa5
push edi
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0xc]
push dword [ebp - 8]
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, esi
test eax, eax
je 0x475fb2
push eax
call fcn.004d9a63
add esp, 4
mov eax, dword [ebp - 8]
test eax, eax
je 0x475fc2
push eax
call fcn.004d9a63
add esp, 4
cmp ebx, 0xffffffff
je 0x475fce
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x477a20
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
mov ebx, ecx
push esi
lea ecx, [eax + 0x15]
add eax, 0x17
push edi
lea ecx, [ebx + ecx*4]
mov dword [ecx], 0
lea edi, [ebx + eax*4]
mov dword [ebp + 8], ecx
mov eax, dword [edi]
test eax, eax
je 0x477a55
push eax
call fcn.004d9a63
add esp, 4
mov dword [edi], 0
push 0x50e3ac
push dword [ebp + 0xc]
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x477ab2
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push 0
mov dword [ebp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x477ab2
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x477ab2
push dword [ebp + 8]
mov ecx, dword [ebx + 0xc]
push edi
push dword [ebp + 0xc]
mov ecx, dword [ecx + 0x494]
push eax
call fcn.004ce7b0
neg eax
pop edi
sbb eax, eax
pop esi
neg eax
pop ebx
pop ebp
ret 8
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret 8