joyce8/EMBER2024-capa huggingface dataset:
Function at 0x467820
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e6d60
push 0x4d96e4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, 0x1084
call fcn.004d9670
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov ecx, 0xf
xor eax, eax
lea edi, [ebp - 0x54]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x54], 0x3c
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x44], ebx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x40], eax
lea ecx, [eax + eax]
xor eax, eax
mov edi, ebx
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
push str.file:__
mov esi, dword [ebp + 8]
push esi
mov edi, dword [sym.imp.SHLWAPI.dll_StrStrW]
call edi
cmp eax, esi
jne 0x4678c8
push str.file:__
push 0x4f6170
mov eax, dword [ebp + 0x10]
dec eax
push eax
push ebx
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x10
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.res:__
push esi
call edi
cmp eax, esi
jne 0x467903
push str.res:__
push 0x4f6170
mov ecx, dword [ebp + 0x10]
dec ecx
push ecx
push ebx
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x10
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor edi, edi
mov dword [ebp - 4], edi
lea edx, [ebp - 0x54]
push edx
push 0x10000000
push esi
call dword [sym.imp.MSVCRT.dll_wcslen]
add esp, 4
push eax
push esi
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
jne 0x4679de
mov word [ebp - 0x109c], di
mov ecx, 0x411
lea edi, [ebp - 0x109a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push esi
push 0x4f8184
push 0x823
lea eax, [ebp - 0x109c]
push eax
mov esi, dword [sym.imp.MSVCRT.dll__snwprintf]
call esi
add esp, 0x10
lea ecx, [ebp - 0x54]
push ecx
push 0x10000000
lea edx, [ebp - 0x109c]
push edx
call dword [sym.imp.MSVCRT.dll_wcslen]
add esp, 4
push eax
lea eax, [ebp - 0x109c]
push eax
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
jne 0x4679de
lea ecx, [ebp - 0x109c]
push ecx
push 0x4f6170
mov edx, dword [ebp + 0x10]
dec edx
push edx
push ebx
call esi
add esp, 0x10
mov dword [ebp - 4], 0xffffffff
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xffffffff
test ebx, ebx
je 0x4679a7
cmp word [ebx], 0
je 0x4679a7
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x468020
Capabilities:
Check if file exists

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [sym.imp.WININET.dll_GetUrlCacheEntryInfoW]
push ebp
mov ebp, dword [esp + 0x14]
push esi
lea eax, [esp + 0xc]
push edi
push eax
mov edi, 1
push 0
push ebp
mov dword [esp + 0x20], edi
mov dword [esp + 0x1c], 0
call ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x468119
mov ecx, dword [esp + 0x10]
push ecx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov esi, eax
add esp, 4
test esi, esi
je 0x468119
mov ecx, dword [esp + 0x10]
xor eax, eax
mov edx, ecx
mov edi, esi
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea eax, [esp + 0x10]
push eax
push esi
push ebp
call ebx
test eax, eax
je 0x46810c
mov eax, dword [esi + 8]
test eax, eax
je 0x46810c
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x46810c
mov eax, dword [0x5eb708]
test eax, eax
jne 0x4680ea
push str.wininet.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x4680ce
push str.wininet.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x4680e1
push str.IsUrlCacheEntryExpiredW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x5eb708], eax
jmp 0x4680e6
mov eax, dword [0x5eb708]
test eax, eax
je 0x46810c
lea ecx, [esi + 0x28]
push ecx
push 0
push ebp
call eax
test eax, eax
jne 0x46810c
push esi
xor edi, edi
call fcn.004d9644
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov edi, dword [esp + 0x14]
push esi
call fcn.004d9644
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret

Function at 0x468b90
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x10
push esi
push 0
lea eax, [esp + 8]
push 0
push eax
push 0xcf0000
push 0x514ff0
push str.360se_Major
mov esi, ecx
push 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0x64
mov dword [esp + 0x2c], 0x1e
call fcn.004d7c50
mov eax, dword [esi + 4]
test eax, eax
je 0x468bfc
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x468bfc
mov ecx, dword [esi + 4]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [esi + 4]
mov dword [0x5edfa0], edx
mov eax, dword [esi + 4]
pop esi
add esp, 0x10
ret
Function at 0x468c30
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x210
push ebx
mov ebx, ecx
push ebp
push esi
mov eax, dword [ebx + 0x464]
push edi
test eax, eax
je 0x468df6
mov ecx, dword [ebx + 0x468]
sub ecx, eax
mov eax, 0x7d8c42b3
imul ecx
sar edx, 9
mov eax, edx
shr eax, 0x1f
add edx, eax
je 0x468df6
mov ecx, dword [ebx + 0x40]
mov ebp, dword [sym.imp.USER32.dll_IsWindow]
push ecx
call ebp
test eax, eax
je 0x468def
mov esi, dword [ebx + 0x464]
lea edi, [ebx + 0x4c]
mov ecx, 0x105
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebx + 0x464]
mov edx, dword [ebx + 0x468]
add eax, 0x414
cmp eax, edx
je 0x468cc8
lea ebp, [eax - 0x414]
mov esi, eax
mov edi, ebp
add eax, 0x414
mov ecx, 0x105
add ebp, 0x414
cmp eax, edx
rep movsd dword es:[edi], dword [esi]
jne 0x468ca8
mov ebp, dword [sym.imp.USER32.dll_IsWindow]
mov eax, dword [ebx + 0x468]
add eax, 0xfffffbec
mov dword [ebx + 0x468], eax
mov edx, dword [ebx + 0x40]
push edx
mov dword [esp + 0x14], eax
call ebp
test eax, eax
je 0x468df6
mov eax, dword [ebx + 0x44]
mov esi, dword [sym.imp.MSVCRT.dll__snwprintf]
test eax, eax
jne 0x468d3c
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0x16]
mov word [esp + 0x14], 0
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebx + 0x48], eax
push eax
push str.360SE_SCREEN_PIC__d
lea eax, [esp + 0x1c]
push 0x103
push eax
call esi
lea ecx, [esp + 0x24]
push 0x414
push ecx
call fcn.004327f0
add esp, 0x18
mov dword [ebx + 0x44], eax
mov eax, dword [ebx + 0x44]
test eax, eax
je 0x468df6
lea edx, [ebx + 0x254]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x468d75
push 0
push 0
push 6
call fcn.00438e60
mov ecx, eax
call fcn.0043a070
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x210
ret
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0x16]
mov word [esp + 0x14], 0
rep stosd dword es:[edi], eax
push eax
push str.cachesnap
mov ecx, 0x514ff8
call fcn.00407d70
push eax
push 0x4f812c
lea eax, [esp + 0x1c]
push 0x104
push eax
call esi
lea ecx, [esp + 0x24]
push ecx
call fcn.00433230
mov edx, dword [ebx + 0x44]
push 0
lea eax, [ebx + 0x4c]
push 0x414
push eax
push edx
call fcn.00432830
mov eax, dword [ebx + 0x48]
mov ecx, dword [ebx + 0x40]
add esp, 0x24
push 0
push eax
push 0x464
push ecx
call dword [sym.imp.USER32.dll_PostMessageW]
test eax, eax
jne 0x468df6
mov edx, dword [ebx + 0x40]
push edx
call ebp
test eax, eax
jne 0x468df6
mov ecx, ebx
call fcn.00468e10
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x210
ret
Function at 0x468e10
Capabilities:
Check if file exists
Create process on windows

Disassembly:
sub esp, 0x46c
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x40]
test eax, eax
je 0x468e30
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x468f43
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0x5e]
mov word [esp + 0x5c], 0
rep stosd dword es:[edi], eax
mov ecx, 0x82
lea edi, [esp + 0x26a]
mov word [esp + 0x268], ax
push 0x104
rep stosd dword es:[edi], eax
lea eax, [esp + 0x60]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [esp + 0x5c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0x104
lea edx, [esp + 0x60]
push str.ExtensionsExtPagesScreenHelper.exe
push edx
call dword [sym.imp.MSVCRT.dll_wcsncat]
add esp, 0xc
lea eax, [esp + 0x5c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x468f43
lea ecx, [esp + 0x5c]
push ecx
call fcn.0048eed0
add esp, 4
test eax, eax
je 0x468f43
mov edx, dword [esi + 4]
lea eax, [esp + 0x5c]
push edx
push eax
push str._s__x
lea ecx, [esp + 0x274]
push 0x104
push ecx
call dword [sym.imp.MSVCRT.dll__snwprintf]
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x30]
xor edx, edx
add esp, 0x14
mov dword [esp + 8], eax
rep stosd dword es:[edi], eax
mov dword [esp + 0xc], edx
lea eax, [esp + 8]
lea ecx, [esp + 0x18]
mov dword [esp + 0x10], edx
push eax
push ecx
push edx
push edx
push edx
push 1
push edx
mov dword [esp + 0x30], edx
push edx
lea edx, [esp + 0x288]
push edx
push 0
mov dword [esp + 0x40], 0x44
mov dword [esp + 0x6c], 0x80
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x468f43
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov ecx, dword [esp + 8]
push ecx
call esi
pop edi
pop esi
add esp, 0x46c
ret
Function at 0x46a700
Capabilities:
Hide graphical window

Disassembly:
cmp word [esp + 4], 0x1974
push esi
mov esi, ecx
jne 0x46a7a5
mov eax, dword [esp + 0xc]
sub eax, 0x201
je 0x46a72d
sub eax, 4
jne 0x46a7a5
call fcn.0046a7b0
pop esi
ret 8
call fcn.00438e60
mov eax, dword [eax + 0xddc]
cmp eax, 1
mov dword [esp + 0xc], eax
jbe 0x46a74c
mov ecx, esi
call fcn.0046a7b0
pop esi
ret 8
jne 0x46a7a5
lea eax, [esp + 0xc]
lea ecx, [esp + 8]
push eax
push ecx
call fcn.00438e60
mov ecx, eax
call fcn.0043a5d0
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x46a798
mov eax, dword [esp + 8]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push eax
call esi
mov ecx, dword [esp + 8]
push 6
push ecx
call esi
mov edx, dword [esp + 8]
push 0
push edx
call esi
pop esi
ret 8
mov eax, dword [esp + 8]
push eax
call fcn.0046a6c0
add esp, 4
pop esi
ret 8
Function at 0x46ab80
Capabilities:
Get common file path

Disassembly:
sub esp, 0xa28
push ebx
push edi
xor ebx, ebx
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x212]
mov word [esp + 0x210], bx
mov word [esp + 0x828], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x82a]
mov word [esp + 0x620], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x622]
mov word [esp + 0x418], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x41a]
lea edx, [esp + 0x620]
rep stosd dword es:[edi], eax
mov ecx, dword [0x4f75f4]
push edx
stosw word es:[edi], ax
mov eax, dword [0x4f75f0]
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], eax
push ebx
mov ecx, 0x80
xor eax, eax
lea edi, [esp + 0x18]
push ebx
push 0x10
push ebx
rep stosd dword es:[edi], eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x46ac37
pop edi
mov eax, 1
pop ebx
add esp, 0xa28
ret
mov ecx, dword [0x5f18c4]
lea eax, [esp + 0x210]
push 0x103
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x46ac63
pop edi
mov eax, 1
pop ebx
add esp, 0xa28
ret
lea edx, [esp + 0x210]
push esi
mov esi, dword [sym.imp.MSVCRT.dll__snwprintf]
push edx
push 0x4f6170
lea eax, [esp + 0x424]
push 0x103
push eax
call esi
push 0x88
call fcn.004843d0
add esp, 0x14
lea ecx, [esp + 0x624]
lea edx, [esp + 0x82c]
push eax
push ecx
push 0x4f8944
push 0x103
push edx
call esi
lea eax, [esp + 0x20]
lea ecx, [esp + 0x430]
push eax
lea edx, [esp + 0x844]
push ecx
push edx
call fcn.00442fb0
mov esi, eax
add esp, 0x20
cmp esi, ebx
jne 0x46acee
push ebx
push 0x51567c
push 0x89
call fcn.004843d0
add esp, 4
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, esi
pop esi
pop edi
pop ebx
add esp, 0xa28
ret
Function at 0x46b3e0
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0xc
push ebp
push esi
mov esi, ecx
mov dword [esp + 0xc], esi
cmp word [esi + 0x28], 0
je 0x46b512
call fcn.00421f10
mov ecx, eax
call fcn.00428e70
test eax, eax
jne 0x46b512
call fcn.00438e60
mov eax, dword [eax + 0xddc]
test eax, eax
mov dword [esp + 8], eax
je 0x46b512
shl eax, 2
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ebp, eax
add esp, 4
test ebp, ebp
mov dword [esp + 0x10], ebp
je 0x46b512
mov ecx, dword [esp + 8]
push ebx
push edi
xor eax, eax
mov edi, ebp
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x10]
push ecx
push ebp
call fcn.00438e60
mov ecx, eax
call fcn.0043a5d0
mov eax, dword [esi + 0x2c]
test eax, eax
jne 0x46b4a8
mov eax, dword [esp + 0x10]
xor ebx, ebx
test eax, eax
jbe 0x46b4cf
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
mov esi, ebp
mov ebp, dword [sym.imp.USER32.dll_IsWindowVisible]
mov edx, dword [esi]
push edx
call ebp
test eax, eax
je 0x46b496
mov eax, dword [esi]
push 0
push eax
call edi
mov ecx, dword [esi]
push 6
push ecx
call edi
mov edx, dword [esi]
push 0
push edx
call edi
mov eax, dword [esp + 0x10]
inc ebx
add esi, 4
cmp ebx, eax
jb 0x46b478
mov ebp, dword [esp + 0x18]
jmp 0x46b4cb
mov eax, dword [esp + 0x10]
xor edi, edi
test eax, eax
jbe 0x46b4cf
mov esi, ebp
mov eax, dword [esi]
push eax
call fcn.0046a6c0
mov eax, dword [esp + 0x14]
add esp, 4
inc edi
add esi, 4
cmp edi, eax
jb 0x46b4b4
mov esi, dword [esp + 0x14]
mov edx, dword [esi + 0x2c]
xor eax, eax
test edx, edx
sete al
mov dword [esi + 0x2c], eax
mov ecx, dword [0x602c18]
pop edi
pop ebx
test ecx, ecx
je 0x46b509
test eax, eax
push 0
mov ecx, esi
je 0x46b504
call fcn.00469970
push ebp
call fcn.004d9644
add esp, 4
pop esi
pop ebp
add esp, 0xc
ret
call fcn.004698d0
push ebp
call fcn.004d9644
add esp, 4
pop esi
pop ebp
add esp, 0xc
ret

Function at 0x46b750
Capabilities:
Hash data with md5

Disassembly:
push esi
xor eax, eax
lea esi, [ecx + 0x5c]
push 0x40
push eax
push esi
mov dword [ecx + 0x18], eax
mov dword [ecx + 0x14], eax
mov dword [ecx + 4], 0x67452301
mov dword [ecx + 8], 0xefcdab89
mov dword [ecx + 0xc], 0x98badcfe
mov dword [ecx + 0x10], 0x10325476
call fcn.0046c2d0
mov byte [esi], 0x80
pop esi
ret

Function at 0x46c310
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret
Function at 0x46d050
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
push esi
push str.MEDIASAVER_PROC
push eax
mov dword [esi + 0x1060], eax
call dword [sym.imp.USER32.dll_SetPropW]
mov eax, dword [esi + 4]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x46d087
push eax
mov eax, dword [esi + 0x1060]
push 0xb6
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
mov ecx, dword [esi + 0x1060]
push 0x434
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
mov edx, dword [0x5edfa0]
mov esi, eax
mov eax, dword [0x51502c]
push 0x280000
push 0xffffffffffffffff
push eax
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x46d0c6
push 5
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
ret 4
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
ret 4
Function at 0x46d4a0
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0xc
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
push ebp
push esi
push edi
mov ebp, ecx
push 0x11
call ebx
movsx edi, ax
push 0x12
shr edi, 0x10
call ebx
movsx esi, ax
push 0x10
shr esi, 0x10
call ebx
movsx eax, ax
shr eax, 0x10
test edi, edi
je 0x46d4e1
test esi, esi
je 0x46d4e1
test eax, eax
mov dword [esp + 0x10], 1
jne 0x46d4e9
mov dword [esp + 0x10], 0
xor ebx, ebx
test edi, edi
je 0x46d547
test esi, esi
je 0x46d501
mov eax, dword [0x5f6660]
test eax, eax
je 0x46d501
mov ebx, 1
test ebx, ebx
jne 0x46d511
mov eax, dword [esp + 0x20]
test eax, eax
je 0x46d5f2
call dword [sym.imp.USER32.dll_GetMessagePos]
mov esi, dword [esp + 0x24]
movsx ecx, ax
shr eax, 0x10
movsx edx, ax
lea eax, [esp + 0x14]
mov dword [esp + 0x14], ecx
push eax
push esi
mov dword [esp + 0x20], edx
call dword [sym.imp.USER32.dll_ScreenToClient]
test ebx, ebx
je 0x46d55b
test edi, edi
je 0x46d55b
mov eax, 1
jmp 0x46d55d
test esi, esi
je 0x46d505
mov eax, dword [0x5f6664]
test eax, eax
je 0x46d505
mov ebx, 1
jmp 0x46d511
xor eax, eax
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x10]
push edi
push ecx
push eax
mov eax, dword [esp + 0x38]
lea edx, [esp + 0x20]
mov ecx, ebp
push edx
push eax
call fcn.0046d600
test eax, eax
jne 0x46d5bd
mov ecx, dword [ebp + 4]
mov eax, dword [ecx - 8]
test eax, eax
je 0x46d5e3
mov eax, dword [esp + 0x30]
mov dword [ebp + 0xc], esi
test eax, eax
je 0x46d595
mov dword [ebp + 0x14], eax
mov edx, dword [0x5f18c0]
push ebp
push 0x46cf20
push edi
push 0x7ff
push edx
call dword [sym.imp.USER32.dll_DialogBoxParamW]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xc
ret 0x14
cmp eax, 1
jne 0x46d5e3
mov eax, dword [ebp + 8]
push eax
push 0x18
call fcn.004843d0
add esp, 4
add ebp, 0x18
push eax
push 0x823
push ebp
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x10
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xc
ret 0x14
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret 0x14
Function at 0x46ee40
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x410
cmp word [0x5f6668], 0
je 0x46eef6
mov ax, word [0x514ff0]
push esi
mov edx, dword [0x5f18c4]
push edi
mov word [esp + 8], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xa]
rep stosd dword es:[edi], eax
push 0
lea ecx, [esp + 0x214]
push 0x104
push ecx
push edx
stosw word es:[edi], ax
call fcn.00432980
add esp, 0x10
lea eax, [esp + 8]
push 0x104
push eax
push 0x5f6668
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov esi, dword [esp + 0x41c]
lea ecx, [esp + 8]
lea edx, [esp + 0x210]
push ecx
push edx
push esi
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push 1
push esi
call fcn.00432fa0
mov eax, dword [esp + 0x42c]
add esp, 8
test eax, eax
je 0x46eee8
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x46eee8
push esi
call fcn.00433230
add esp, 4
pop edi
mov eax, 1
pop esi
add esp, 0x410
ret
xor eax, eax
add esp, 0x410
ret

Function at 0x46f160
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
push esi
test eax, eax
push edi
mov esi, ecx
je 0x46f1c1
mov edi, dword [esp + 0xc]
test edi, edi
je 0x46f1c1
mov ecx, dword [esp + 0x14]
and ecx, 0xffff
push ecx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
mov dword [esi + 8], eax
je 0x46f1c1
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, dword [esi + 8]
mov dword [esi + 0xc], eax
push edx
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [esi + 0x10], eax
je 0x46f1c1
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [esi + 0x14], eax
pop edi
neg eax
sbb eax, eax
pop esi
neg eax
dec eax
ret 0xc
pop edi
or eax, 0xffffffff
pop esi
ret 0xc
Function at 0x46f820
Capabilities:
Get storage device properties

Disassembly:
mov eax, 0x2d10
call fcn.004d9670
mov eax, dword [esp + 0x2d14]
push ebp
xor ebp, ebp
push esi
cmp eax, ebp
je 0x46f9b3
mov esi, dword [esp + 0x2d20]
cmp esi, ebp
je 0x46f9b3
push ebx
push edi
xor edi, edi
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], edi
push edi
push str..PhysicalDrive_d
lea eax, [esp + 0x30]
push 0x200
push eax
call fcn.004706c0
add esp, 0x10
lea ecx, [esp + 0x28]
push ebp
push ebp
push 3
push ebp
push 3
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x46f996
xor edx, edx
mov ecx, 0x9c4
xor eax, eax
lea edi, [esp + 0x610]
mov dword [esp + 0x18], edx
push ebp
rep stosd dword es:[edi], eax
lea eax, [esp + 0x28]
mov dword [esp + 0x20], edx
push eax
lea ecx, [esp + 0x618]
mov dword [esp + 0x28], edx
push 0x2710
push ecx
lea edx, [esp + 0x28]
push 0xc
push edx
push 0x2d1400
push ebx
mov dword [esp + 0x44], ebp
mov dword [esp + 0x38], ebp
mov dword [esp + 0x3c], ebp
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x46f985
mov ecx, 0xfa
xor eax, eax
lea edi, [esp + 0x228]
lea edx, [esp + 0x610]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x628]
lea eax, [esp + 0x228]
push eax
push 1
push ecx
push edx
call fcn.004187b0
add esp, 0x10
xor eax, eax
cmp esi, 0x7fffffff
jbe 0x46f927
mov eax, 0x80070057
cmp eax, ebp
jl 0x46f985
mov edx, dword [esp + 0x2d28]
mov eax, dword [esp + 0x2d24]
mov edi, SysReAllocString
mov ecx, eax
sub edi, edx
lea edx, [esp + 0x228]
sub edx, ecx
lea ecx, [edi + esi]
test ecx, ecx
je 0x46f961
mov cl, byte [edx + eax]
test cl, cl
je 0x46f961
mov byte [eax], cl
inc eax
dec esi
jne 0x46f94b
jmp 0x46f965
test esi, esi
jne 0x46f96b
dec eax
mov ebp, 0x8007007a
mov esi, dword [esp + 0x2d28]
mov byte [eax], 0
mov eax, ebp
xor ebp, ebp
cmp eax, ebp
jne 0x46f985
mov dword [esp + 0x10], 1
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x10], ebp
jne 0x46f9a4
mov edi, dword [esp + 0x14]
inc edi
cmp edi, 0x10
mov dword [esp + 0x14], edi
jl 0x46f858
mov eax, dword [esp + 0x10]
pop edi
pop ebx
pop esi
pop ebp
add esp, 0x2d10
ret
pop esi
xor eax, eax
pop ebp
add esp, 0x2d10
ret
Function at 0x46fb80
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x4f0
test eax, eax
push ebx
push esi
push edi
je 0x46fd84
mov esi, dword [esp + 0x504]
test esi, esi
je 0x46fd84
mov ecx, 0x19
xor eax, eax
lea edi, [esp + 0x24]
rep stosd dword es:[edi], eax
lea eax, [esp + 0xc]
push eax
push 8
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionNetworkCards
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x46fd14
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
push 0
push 0
push 0
lea ecx, [esp + 0x28]
push 0
lea edx, [esp + 0xfc]
push ecx
mov ecx, dword [esp + 0x20]
push edx
push eax
push ecx
mov dword [esp + 0x3c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x46fd02
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x14]
push edx
push 1
push eax
lea eax, [esp + 0xf8]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x46fcf9
lea edx, [esp + 0x18]
lea eax, [esp + 0x2f4]
push edx
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x24]
push eax
push ecx
push 0
push str.ServiceName
push edx
mov dword [esp + 0x38], 1
mov dword [esp + 0x30], 0x208
call ebx
test eax, eax
jne 0x46fcee
mov ecx, 0x19
lea edi, [esp + 0x88]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x88]
push 0x64
lea ecx, [esp + 0x2f8]
push eax
push ecx
call fcn.0046fd90
add esp, 0xc
test eax, eax
je 0x46fcee
mov al, byte [esp + 0x24]
test al, al
je 0x46fcb7
lea edx, [esp + 0x24]
lea eax, [esp + 0x88]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jge 0x46fcee
lea edx, [esp + 0x88]
lea ecx, [esp + 0x24]
mov esi, 0x64
lea eax, [esp + 0x24]
sub edx, ecx
lea ecx, [esi + 0x7fffff9a]
test ecx, ecx
je 0x46fce6
mov cl, byte [edx + eax]
test cl, cl
je 0x46fce6
mov byte [eax], cl
inc eax
dec esi
jne 0x46fccd
jmp 0x46fcea
test esi, esi
jne 0x46fceb
dec eax
mov byte [eax], 0
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc dword [esp + 0x10]
jmp 0x46fbdc
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [esp + 0x504]
mov al, byte [esp + 0x24]
test al, al
je 0x46fd84
xor eax, eax
cmp esi, 0x7fffffff
jbe 0x46fd2b
mov eax, 0x80070057
test eax, eax
jl 0x46fd71
mov edx, dword [esp + 0x504]
mov eax, dword [esp + 0x500]
mov edi, SysReAllocString
xor ebx, ebx
sub edi, edx
lea edx, [esp + 0x24]
sub edx, eax
lea ecx, [edi + esi]
test ecx, ecx
je 0x46fd62
mov cl, byte [edx + eax]
test cl, cl
je 0x46fd62
mov byte [eax], cl
inc eax
dec esi
jne 0x46fd4c
jmp 0x46fd66
test esi, esi
jne 0x46fd6c
dec eax
mov ebx, 0x8007007a
mov byte [eax], 0
mov eax, ebx
xor edx, edx
pop edi
test eax, eax
setge dl
pop esi
mov eax, edx
pop ebx
add esp, 0x4f0
ret
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x4f0
ret