joyce8/EMBER2024-capa huggingface dataset:
Function at 0x416180
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
cmp dword [ecx + 0x38], 0
push ebx
push esi
push edi
mov dword [esp + 0xc], ecx
je 0x416274
mov esi, dword [ebp + 0x10]
mov ebx, esi
mov edx, dword [ebp + 0xc]
mov edi, edx
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
test esi, esi
jl 0x416263
jg 0x4161c0
test edx, edx
je 0x416263
nop dword [eax]
call fcn.004187a0
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x416214
jg 0x4161d7
test esi, esi
je 0x416214
cmp ebx, eax
jg 0x4161e7
jl 0x4161e1
cmp edi, esi
jae 0x4161e7
mov esi, edi
mov dword [esp + 0x14], ebx
mov eax, dword [esp + 0x10]
push esi
push eax
mov eax, dword [esp + 0x14]
mov eax, dword [eax + 0x20]
push dword [eax]
call fcn.0055fcd0
mov ecx, dword [esp + 0x18]
add esp, 0xc
sub edi, esi
sbb ebx, dword [esp + 0x14]
mov eax, dword [ecx + 0x30]
sub dword [eax], esi
mov eax, dword [ecx + 0x20]
add dword [eax], esi
jmp 0x416247
mov eax, dword [esp + 0x10]
movzx ecx, byte [eax]
mov eax, dword [esp + 0xc]
push ecx
mov eax, dword [eax]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x597998]
mov ecx, dword [esp + 0x10]
call esi
cmp eax, 0xffffffff
je 0x41625d
mov ecx, dword [esp + 0xc]
add edi, 0xffffffff
mov esi, 1
adc ebx, 0xffffffff
add dword [esp + 0x10], esi
test ebx, ebx
jg 0x4161c0
jl 0x41625d
test edi, edi
jne 0x4161c0
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
sub edx, edi
mov eax, edx
sbb esi, ebx
mov edx, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ecx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x10], eax
test eax, eax
je 0x416296
mov eax, dword [ecx + 0x30]
mov eax, dword [eax]
jmp 0x416298
xor eax, eax
cdq
mov ebx, eax
mov eax, edx
mov dword [esp + 0x14], eax
test edi, edi
jl 0x416316
jg 0x4162ab
test esi, esi
je 0x416316
test eax, eax
jl 0x4162fa
jg 0x4162b5
test ebx, ebx
je 0x4162fa
cmp edi, eax
jg 0x4162c5
jl 0x4162bf
cmp esi, ebx
jae 0x4162c5
mov ebx, esi
mov dword [esp + 0x14], edi
push ebx
push dword [ebp + 8]
push dword [esp + 0x18]
call fcn.0055fcd0
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
sub esi, ebx
sbb edi, dword [esp + 0x14]
add edx, ebx
mov eax, dword [ecx + 0x30]
sub dword [eax], ebx
mov eax, dword [ecx + 0x20]
add dword [eax], ebx
test edi, edi
jl 0x416316
jg 0x4162fd
test esi, esi
je 0x416316
jmp 0x4162fd
mov edx, dword [ebp + 8]
mov eax, dword [ecx + 0x4c]
test eax, eax
je 0x416316
push eax
push esi
push 1
push edx
call fcn.0056f465
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x416870
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x5fcfe4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, ecx
cmp ebx, 0xffffffff
jne 0x4168a0
pop edi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0055d0aa
mov esp, ebp
pop ebp
ret 4
mov eax, dword [edi + 0x20]
push esi
mov ecx, dword [eax]
test ecx, ecx
je 0x4168dc
mov edx, dword [edi + 0x30]
mov esi, dword [edx]
lea eax, [esi + ecx]
cmp ecx, eax
jae 0x4168dc
lea ecx, [esi - 1]
mov dword [edx], ecx
mov edx, dword [edi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop esi
pop edi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0055d0aa
mov esp, ebp
pop ebp
ret 4
cmp dword [edi + 0x4c], 0
je 0x4169d7
mov esi, dword [edi + 0xc]
lea eax, [edi + 0x3c]
cmp dword [esi], eax
jne 0x416904
mov edx, dword [edi + 0x54]
mov ecx, dword [edi + 0x50]
sub edx, ecx
mov dword [esi], ecx
mov eax, dword [edi + 0x1c]
mov dword [eax], ecx
mov eax, dword [edi + 0x2c]
mov dword [eax], edx
mov eax, dword [edi + 0x38]
mov dword [ebp - 0x2c], eax
test eax, eax
jne 0x41693a
push dword [edi + 0x4c]
movsx eax, bl
push eax
call fcn.0056ca6e
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop esi
pop edi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0055d0aa
mov esp, ebp
pop ebp
ret 4
mov byte [ebp - 0x25], bl
mov esi, dword [eax]
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 4]
push eax
mov esi, dword [esi + 0x1c]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x34]
mov ecx, esi
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [edi + 0x40]
push eax
call dword [0x597998]
mov ecx, dword [ebp - 0x2c]
call esi
sub eax, 0
je 0x4169a7
sub eax, 1
je 0x4169a7
sub eax, 2
jne 0x4169d7
push dword [edi + 0x4c]
movsx eax, byte [ebp - 0x25]
push eax
call fcn.0056ca6e
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop esi
pop edi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0055d0aa
mov esp, ebp
pop ebp
ret 4
mov esi, dword [ebp - 0x30]
lea eax, [ebp - 0x24]
sub esi, eax
je 0x4169c7
lfence
push dword [edi + 0x4c]
push esi
push 1
push eax
call fcn.0056f465
add esp, 0x10
cmp esi, eax
jne 0x4169d7
lea eax, [ebp - 0x25]
mov byte [edi + 0x3d], 1
cmp dword [ebp - 0x34], eax
jne 0x4168c7
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop esi
pop edi
xor ecx, ebp
pop ebx
call fcn.0055d0aa
mov esp, ebp
pop ebp
ret 4
Function at 0x4184f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x5fcfe4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x4185cb
cmp byte [ebx + 0x3d], 0
je 0x4185cb
mov eax, dword [ebx]
push esi
push 0xffffffffffffffff
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x597998]
mov ecx, ebx
call esi
cmp eax, 0xffffffff
je 0x4185b9
push edi
mov edi, dword [ebx + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
mov esi, dword [edi]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebx + 0x40]
push eax
mov esi, dword [esi + 0x20]
mov ecx, esi
call dword [0x597998]
mov ecx, edi
call esi
pop edi
sub eax, 0
je 0x41857e
sub eax, 1
je 0x418582
sub eax, 2
jne 0x4185b9
mov byte [ebx + 0x3d], al
mov al, 1
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0055d0aa
mov esp, ebp
pop ebp
ret
mov byte [ebx + 0x3d], 0
mov esi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub esi, eax
je 0x4185a2
lfence
push dword [ebx + 0x4c]
push esi
push 1
push eax
call fcn.0056f465
add esp, 0x10
cmp esi, eax
jne 0x4185b9
cmp byte [ebx + 0x3d], 0
pop esi
sete al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0055d0aa
mov esp, ebp
pop ebp
ret
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0055d0aa
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop ebx
call fcn.0055d0aa
mov esp, ebp
pop ebp
ret

Function at 0x419f48
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, ecx
xor esi, esi
call fcn.0041c8e3
push 5
push dword [ebp + 8]
mov edi, dword [eax + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x419f7b
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
push edi
push dword [ebp + 0xc]
mov ecx, ebx
push esi
call fcn.00419f90
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x41b062
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0xffffffffffffffff
push esi
call fcn.00430829
test eax, eax
je 0x41b0ba
push esi
mov ebx, 0x811c9dc5
xor edi, edi
call fcn.0057051f
xor edx, edx
mov dword [ebp - 4], 0xa
pop ecx
mov ecx, eax
div dword [ebp - 4]
inc eax
test ecx, ecx
je 0x41b0b1
lfence
mov edx, ecx
movzx ecx, word [esi + edi*2]
add edi, eax
imul ebx, ebx, 0x1000193
xor ebx, ecx
cmp edi, edx
jb 0x41b09f
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 4
call fcn.0041bd14
int3
Function at 0x41c14f
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x586acd
call fcn.0055d792
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x74], ebx
jne 0x41c175
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x41c1cf
lea ecx, [ebp - 0x10]
call fcn.0040b490
mov edi, dword [edi + 0x74]
lea ecx, [ebp - 0x10]
push ecx
mov dword [ebp - 4], ebx
mov eax, dword [edi]
mov esi, dword [eax + 0x8c]
mov ecx, esi
call dword [0x597998]
mov ecx, edi
call esi
mov esi, dword [ebp + 8]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push esi
call fcn.005706a3
push eax
call fcn.0040aa50
add esp, 0x14
test esi, esi
je 0x41c1c2
push esi
call fcn.0057051f
pop ecx
mov ebx, eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.0040b460
mov eax, ebx
call fcn.0055d760
ret 8

Function at 0x41ed13
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
xor esi, esi
mov ebx, ecx
push edi
cmp dword [ebp + 8], esi
je 0x41ed52
call fcn.0041c8e3
push 0xf0
push dword [ebp + 8]
mov edi, dword [eax + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x41ed52
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x41ed5a
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
push esi
mov ecx, ebx
call fcn.0042bc11
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x41f7ef
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
je 0x41f87b
cmp dword [esi + 0x20], 0
je 0x41f87b
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x41f87b
cmp dword [ebp + 8], 0
je 0x41f87b
xor edi, edi
mov ebx, edi
call fcn.0041c8e3
push 0x5a0408
push dword [ebp + 8]
mov eax, dword [eax + 0xc]
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 8], eax
test eax, eax
je 0x41f85f
mov ebx, dword [ebp - 4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp - 8]
mov edi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x41f87b
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
push edi
push ebx
push esi
call fcn.00432e3d
mov edi, eax
add esp, 0xc
test edi, edi
je 0x41f877
mov ecx, esi
call fcn.0041f571
mov eax, edi
jmp 0x41f87d
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x425d00
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
push edi
cmp dword [ecx + 0x58], esi
je 0x425d53
push esi
push dword [ebp + 8]
call fcn.00425eee
mov edi, eax
test edi, edi
je 0x425d4e
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp + 0xc]
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x425d4e
mov eax, dword [ebp - 8]
jmp 0x425d65
mov eax, dword [ebp + 0x10]
jmp 0x425d65
push dword [ecx + 0x6c]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
pop edi
pop esi
leave
ret 0xc

Function at 0x42c022
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
push edi
push dword [ebp + 0xc]
call fcn.0042c0cb
cmp dword [esi], 0
mov edi, eax
mov dword [esi + 0xc], 1
je 0x42c06a
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.0041caed
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.0040aee0
jmp 0x42c075
mov eax, dword [ebp + 0x10]
push dword [eax]
push edi
call fcn.0042f70e
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x42f70e
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
mov eax, dword [0x5fcfe4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x42f79c
test esi, esi
je 0x42f79c
push esi
call fcn.0057051f
mov ebx, eax
mov dword [esp], 0x200
lea eax, [ebp - 0x204]
push 0
push eax
call fcn.00560250
mov eax, 0x100
add esp, 0xc
cmp ebx, eax
ja 0x42f783
push eax
lea eax, [ebp - 0x204]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
cmp eax, ebx
jne 0x42f783
push esi
lea eax, [ebp - 0x204]
push eax
lfence
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x42f78b
push esi
push edi
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0055d0aa
leave
ret 8
call fcn.0041bd14
int3

Function at 0x4315e1
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
lea ebx, [edi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [ebp + 8]
test esi, esi
jle 0x43162a
cmp esi, dword [edi + 0xc]
jge 0x43162a
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x43162a
cmp dword [eax + 0xc], 0
je 0x43162a
cmp esi, dword [eax + 8]
jge 0x43162a
lfence
mov eax, dword [eax + 0xc]
push ebx
mov esi, dword [eax + esi*4]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, esi
jmp 0x431633
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x435b00
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
mov dword [ebp - 4], ebx
test byte [esi + 4], 1
mov edi, dword [esi + 0xc]
jne 0x435b56
push 5
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x435b2f
call fcn.004293ea
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x435b44
call fcn.004293ea
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x435b56
call fcn.004293ea
call fcn.0041c8e3
cmp dword [eax + 0x3c], 0
je 0x435b6b
push edi
mov ecx, ebx
call fcn.004351a1
mov edi, eax
push dword [ebp + 0xc]
push edi
call fcn.00435d62
mov ebx, eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x88]
test ecx, ecx
je 0x435b94
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 4]
and dword [eax + 0x88], 0
test ebx, ebx
je 0x435ba0
mov edi, ebx
mov dword [eax + 0x88], ebx
or dword [esi + 4], 1
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x43a087
Capabilities:
Get disk information

Disassembly:
push 0x26c
mov eax, 0x5880d0
call fcn.0055d7c5
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x264], eax
test eax, eax
je 0x43a272
test ebx, ebx
je 0x43a272
lea ecx, [ebp - 0x270]
mov esi, 0x104
push ecx
push eax
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test eax, eax
jne 0x43a0f7
push 0xffffffffffffffff
push ebx
push esi
push dword [ebp - 0x264]
call fcn.005706a3
push eax
call fcn.0040aa50
add esp, 0x14
push ebx
push edi
call fcn.0043a045
xor eax, eax
call fcn.0055d774
ret 0xc
cmp eax, esi
jb 0x43a11f
test edi, edi
je 0x43a0ed
lfence
mov dword [edi + 8], 3
push ebx
lfence
call fcn.0057051f
pop ecx
push eax
push ebx
lea ecx, [edi + 0x10]
call fcn.0040b2c0
jmp 0x43a0ed
lea ecx, [ebp - 0x268]
lfence
call fcn.0040b490
and dword [ebp - 4], 0
lea eax, [ebp - 0x268]
push eax
push dword [ebp - 0x264]
call fcn.00439968
mov esi, dword [ebp - 0x268]
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsUNCW]
test eax, eax
jne 0x43a237
xor ecx, ecx
lea eax, [ebp - 0x26c]
push ecx
push ecx
push eax
lea eax, [ebp - 0x278]
push eax
push ecx
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
jne 0x43a18f
push ebx
push edi
lfence
call fcn.0043a045
lea ecx, [esi - 0x10]
call fcn.0040b460
jmp 0x43a0ed
mov eax, dword [ebp - 0x26c]
test al, 2
jne 0x43a1ae
push dword [ebp - 0x264]
lfence
call dword [sym.imp.USER32.dll_CharUpperW]
mov eax, dword [ebp - 0x26c]
test al, 4
jne 0x43a237
lea eax, [ebp - 0x260]
push eax
push ebx
lfence
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
je 0x43a237
push eax
lfence
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x270]
test eax, eax
je 0x43a178
cmp eax, dword [ebp - 0x264]
jbe 0x43a178
lea eax, [ebp - 0x234]
push eax
call fcn.0057051f
pop ecx
mov ecx, dword [ebp - 0x270]
mov edx, ecx
sub edx, dword [ebp - 0x264]
sar edx, 1
mov dword [ebp - 0x274], ecx
add eax, edx
mov ecx, 0x104
cmp eax, ecx
jge 0x43a247
lea eax, [ebp - 0x234]
sub ecx, edx
push eax
push ecx
lfence
push dword [ebp - 0x274]
call fcn.0056685c
push eax
call fcn.0040aa50
add esp, 0x10
lea ecx, [esi - 0x10]
call fcn.0040b460
xor eax, eax
inc eax
jmp 0x43a0ef
test edi, edi
je 0x43a182
lfence
mov dword [edi + 8], 3
push ebx
lfence
call fcn.0057051f
pop ecx
push eax
push ebx
lea ecx, [edi + 0x10]
call fcn.0040b2c0
jmp 0x43a182
call fcn.0041bd14
int3
Function at 0x45af2c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
push edi
test esi, esi
jne 0x45af45
call fcn.0041c8e3
mov esi, dword [eax + 0xc]
push 0x5aa430
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x45af87
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x45af87
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x45af87
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 4]
push eax
push ebx
call fcn.0045af90
jmp 0x45af89
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x4885e5
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x5fcfe4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
je 0x4886ce
cmp dword [ebp + 0xc], 0
je 0x4886ce
xor ebx, ebx
call fcn.0041c8e3
push dword [ebp + 0xc]
push dword [ebp + 8]
mov esi, dword [eax + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x4886ce
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4886ce
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x4886e4
push edi
call fcn.00570540
inc eax
mov dword [ebp - 8], eax
add eax, eax
pop ecx
lea ecx, [eax + 8]
cmp eax, ecx
sbb eax, eax
and eax, ecx
je 0x4886e4
cmp eax, 0x400
ja 0x488681
call fcn.0055dce0
mov esi, esp
test esi, esi
je 0x4886e4
mov dword [esi], 0xcccc
jmp 0x488697
push eax
lfence
call fcn.005665a5
mov esi, eax
pop ecx
test esi, esi
je 0x4886e4
mov dword [esi], 0xdddd
add esi, 8
test esi, esi
je 0x4886e4
push dword [ebp - 8]
push edi
push esi
call fcn.0041b1e6
test eax, eax
je 0x4886b8
mov ecx, dword [ebp - 0xc]
push eax
call fcn.00489ecc
xor ebx, ebx
inc ebx
add esi, 0xfffffff8
cmp dword [esi], 0xdddd
jne 0x4886ca
push esi
call fcn.005665a0
pop ecx
mov eax, ebx
jmp 0x4886d0
xor eax, eax
lea esp, [ebp - 0x18]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0055d0aa
leave
ret 8
call fcn.0041bd14
int3
Function at 0x4bdc60
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push edi
mov edi, ecx
mov dword [ebp - 0xc], edi
mov ecx, dword [edi + 0xe4]
test ecx, ecx
je 0x4bddcc
push ebx
push esi
push 0x5b6090
call fcn.0042ef10
neg eax
sbb ebx, ebx
inc ebx
cmp dword [ebp + 8], 0
je 0x4bdd01
mov ebx, dword [edi + 0x168]
jmp 0x4bdced
mov esi, dword [ebx + 8]
mov ebx, dword [ebx]
push esi
mov dword [ebp - 0xc], esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4bdced
push esi
call fcn.0041ed80
push eax
push 0x5fc8b0
call fcn.0042ee67
mov dword [ebp - 0x10], eax
pop ecx
pop ecx
test eax, eax
je 0x4bdced
mov ecx, dword [eax]
mov esi, dword [ecx + 0x1a0]
mov ecx, esi
call dword [0x597998]
mov ecx, dword [ebp - 0x10]
call esi
test eax, eax
jle 0x4bdced
push 4
push dword [ebp - 0xc]
lfence
call dword [sym.imp.USER32.dll_ShowWindow]
test ebx, ebx
jne 0x4bdc99
lea ecx, [edi + 0x164]
call fcn.0042a499
jmp 0x4bddca
mov eax, dword [edi + 0xcc]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x4bddca
lea eax, [edi + 0xc8]
lea ecx, [ebp - 0x10]
push ecx
mov ecx, eax
call fcn.00419550
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
test eax, eax
jne 0x4bdd30
xor esi, esi
jmp 0x4bdd33
mov esi, dword [eax + 0x20]
push esi
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4bddba
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x4bddba
test ebx, ebx
je 0x4bdd8f
push dword [ebp - 0x14]
push 0x5fc8b0
call fcn.0042ee67
mov edi, eax
pop ecx
pop ecx
mov ecx, dword [edi]
mov esi, dword [ecx + 0x1a8]
mov ecx, esi
call dword [0x597998]
mov ecx, edi
call esi
push eax
push 0x5ab3d8
call fcn.0042ee67
mov edi, dword [ebp - 0xc]
pop ecx
pop ecx
test eax, eax
je 0x4bddba
mov esi, dword [ebp - 4]
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
lea eax, [ebp - 8]
lea esi, [edi + 0x164]
push eax
mov ecx, esi
call fcn.004bcd93
test eax, eax
jne 0x4bddba
lea eax, [ebp - 8]
mov ecx, esi
push eax
call fcn.004bae25
cmp dword [ebp - 0x10], 0
lea eax, [edi + 0xc8]
jne 0x4bdd18
pop esi
pop ebx
pop edi
leave
ret 4
Function at 0x4f9691
Capabilities:
Get file system object information

Disassembly:
push 0x4cc
mov eax, 0x59158b
call fcn.0055d7c5
mov ebx, ecx
mov eax, dword [ebx + 0x14]
sub eax, 0x10
push eax
call fcn.0040a8a0
pop ecx
lea esi, [eax + 0x10]
mov dword [ebp - 0x4d0], esi
and dword [ebp - 4], 0
lea ecx, [ebp - 0x4d0]
push 0
push 0x5dd32c
call fcn.00417d60
cmp eax, 0xffffffff
jne 0x4f976c
push 0
push 0x5aa3ec
lea ecx, [ebp - 0x4d0]
call fcn.00417d60
cmp eax, 0xffffffff
jne 0x4f976c
push 0
push 0x5a0adc
lea ecx, [ebp - 0x4d0]
call fcn.00417d60
cmp eax, 0xffffffff
jne 0x4f976c
mov eax, dword [ebx + 0x14]
sub eax, 0x10
push eax
call fcn.0040a8a0
add eax, 0x10
pop ecx
mov dword [ebp - 0x4d8], eax
xor edx, edx
mov byte [ebp - 4], 1
push edx
lea ecx, [ebp - 0x218]
push ecx
push 0x104
push edx
push eax
lea edi, [eax - 0x10]
push edx
mov dword [ebp - 0x4d4], edi
call dword [sym.imp.KERNEL32.dll_SearchPathW]
test eax, eax
jne 0x4f973b
mov eax, dword [ebx]
mov edi, dword [eax + 0x14]
mov ecx, edi
call dword [0x597998]
mov ecx, ebx
call edi
mov ecx, dword [ebp - 0x4d4]
mov edi, eax
call fcn.0040b460
jmp 0x4f97a5
lea eax, [ebp - 0x218]
push eax
call fcn.0057051f
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x4d0]
call fcn.0040b2c0
mov ecx, edi
mov byte [ebp - 4], 0
call fcn.0040b460
mov esi, dword [ebp - 0x4d0]
push 0x105
push 0x2b4
lea eax, [ebp - 0x4cc]
push eax
push 0
push esi
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x4f9792
mov edi, dword [ebp - 0x4cc]
jmp 0x4f97a5
mov eax, dword [ebx]
mov edi, dword [eax + 0x14]
mov ecx, edi
call dword [0x597998]
mov ecx, ebx
call edi
mov edi, eax
lea ecx, [esi - 0x10]
call fcn.0040b460
mov eax, edi
call fcn.0055d774
ret

Function at 0x50e12c
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1fbc
push ebx
push esi
push edi
push edi
jmp 0x50e13f
sub edi, 0x11b0a
call fcn.0050e154
add byte [edi], dh
cmp byte [esi + 0x4a], cl
dec eax
cmp bh, byte [edi]
xor cl, byte [edi - 0x7d]
add esp, 4
pop edi