joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404de0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x416856
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x420090]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
xor edi, edi
mov dword [ebp - 0x41c], ecx
mov dword [ebp - 0x430], edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x428], edx
mov dword [ebp - 0x42c], edi
mov dword [ebp - 0x418], edi
push 2
push edi
push eax
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
mov dword [ebp - 0x424], esi
cmp esi, edi
jne 0x404e60
call fcn.00403290
mov edi, eax
jmp 0x404f79
mov eax, dword [ebp - 0x41c]
push eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
cmp ebx, edi
jne 0x404e7f
call fcn.00403290
jmp 0x404f70
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x420], eax
cmp eax, edi
jne 0x404e9b
call fcn.00403290
jmp 0x404f70
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
lea eax, [ebx + 1]
mov dword [ebp - 0x41c], ebx
cmp eax, ebx
jae 0x404ebc
mov edi, 0x8007000e
jmp 0x404f72
xor ecx, ecx
shld ecx, eax, 1
add eax, eax
mov byte [ebp - 4], 2
cmp ecx, edi
ja 0x404ed1
cmp eax, 0xffffffff
jbe 0x404edb
push 0x80070216
call fcn.00402000
cmp eax, 0x400
jbe 0x404f0d
lea ecx, [ebp - 0x418]
push ecx
call fcn.00403970
jmp 0x404f19
lea edx, [ebp - 0x414]
mov dword [ebp - 0x418], edx
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0x418]
cmp eax, edi
jne 0x404f31
mov edi, 0x8007000e
jmp 0x404f72
push ebx
push eax
mov eax, dword [ebp - 0x420]
push ebx
push eax
push edi
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, edi
jne 0x404f4f
call fcn.00403290
jmp 0x404f70
mov edx, dword [ebp - 0x418]
xor ecx, ecx
mov word [edx + eax*2], cx
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp - 0x418]
push eax
lea ecx, [ebp - 0x42c]
call fcn.00404c40
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [ebp - 0x414]
cmp dword [ebp - 0x418], ecx
je 0x404f92
lea eax, [ebp - 0x418]
call fcn.00403270
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0040d34e
mov esp, ebp
pop ebp
ret 0xc
Function at 0x406290
Capabilities:
Create process on windows
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4167b0
mov eax, dword fs:[0]
push eax
sub esp, 0x80
mov eax, dword [0x420090]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0x74]
xor ebx, ebx
sub eax, ebx
je 0x406473
dec eax
je 0x40641a
dec eax
jne 0x40647a
mov eax, dword [esi + 0x15c]
xor ecx, ecx
mov word [ebp - 0x30], cx
mov ecx, eax
mov dword [ebp - 0x1c], 7
mov dword [ebp - 0x20], ebx
lea edi, [ecx + 2]
mov dx, word [ecx]
add ecx, 2
cmp dx, bx
jne 0x4062f6
sub ecx, edi
sar ecx, 1
push ecx
lea ecx, [ebp - 0x30]
call fcn.00409ec0
mov dword [ebp - 4], ebx
mov edi, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x30]
mov ecx, ebx
cmp edi, 8
jae 0x406321
lea ecx, [ebp - 0x30]
mov eax, dword [ebp - 0x20]
add eax, eax
cmp word [eax + ecx - 2], 0x2f
lea ecx, [eax + ecx - 2]
je 0x406356
mov ecx, ebx
cmp edi, 8
jae 0x40633c
lea ecx, [ebp - 0x30]
cmp word [eax + ecx - 2], 0x5c
lea eax, [eax + ecx - 2]
je 0x406356
lea eax, [ebp - 0x30]
call fcn.00407fb0
mov edi, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x30]
push 0x40
lea edx, [ebp - 0x88]
push 0
push edx
call fcn.0040e4c0
mov eax, dword [0x421060]
add esp, 0xc
mov dword [ebp - 0x8c], 0x44
mov dword [ebp - 0x34], eax
mov byte [ebp - 4], 1
mov eax, ebx
cmp edi, 8
jae 0x406389
lea eax, [ebp - 0x30]
push eax
push 0x41c5dc
lea edx, [ebp - 0x34]
call fcn.00409950
mov edi, dword [ebp - 0x34]
add esp, 8
lea ecx, [ebp - 0x44]
push ecx
lea edx, [ebp - 0x8c]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push edi
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4063d3
mov eax, dword [ebp - 0x44]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call ebx
mov ecx, dword [ebp - 0x40]
push ecx
call ebx
mov edx, dword [esi + 4]
push edx
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
lea eax, [edi - 0xc]
cmp eax, 0x421050
je 0x406406
lea esi, [edi - 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x406406
push esi
call fcn.0040d423
add esp, 4
cmp dword [ebp - 0x1c], 8
jb 0x40647a
mov ecx, dword [ebp - 0x30]
push ecx
call fcn.0040d343
add esp, 4
jmp 0x40647a
mov edx, dword [esi + 4]
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x3f2
push edx
call edi
push ebx
mov ebx, dword [sym.imp.USER32.dll_EnableWindow]
push eax
call ebx
mov eax, dword [esi + 4]
push 0x3f0
push eax
call edi
push 0
push eax
call ebx
mov ecx, dword [esi + 4]
push 0x3f1
push ecx
call edi
push 0
push eax
call ebx
push 0
push 0
push esi
push 0x406d80
push 0
push 0
call fcn.0040e232
add esp, 0x18
mov dword [esi + 0x154], eax
jmp 0x40647a
push 1
call fcn.00406880
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0040d34e
mov esp, ebp
pop ebp
ret 4
Function at 0x407ad0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [esi + 4]
sub esp, 0x10
push ebx
xor ebx, ebx
push edi
cmp eax, ebx
je 0x407b07
or ecx, 0xffffffff
push eax
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x20], ecx
mov dword [esi + 0x24], ecx
mov word [esi + 0x1c], bx
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [0x42136c]
push 0x41c5d0
push 0x67
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
cmp edi, ebx
je 0x407b3c
mov ecx, dword [0x42136c]
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp eax, ebx
jne 0x407b44
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
xor al, al
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edx, dword [0x42136c]
push edi
push edx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
push ebx
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, dword [ebp - 8]
push ebx
push ecx
push eax
call fcn.0040e540
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea edx, [ebp - 4]
push edx
push 1
push edi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jne 0x407ba3
mov eax, dword [ebp - 4]
push eax
push esi
call fcn.004093b0
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x407bc0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 0xc], 0
je 0x407c64
mov eax, dword [0x42136c]
push esi
push 0x41c5f4
push 0x69
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x407bf1
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [0x42136c]
push ebx
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
jne 0x407c17
push eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop ebx
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 8
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edx, dword [0x42136c]
push esi
push edx
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
push esi
call fcn.0040d635
mov edi, eax
mov eax, dword [ebp - 4]
push esi
push eax
push edi
call fcn.0040e540
add esp, 0x10
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov dword [ecx], edi
pop edi
pop ebx
mov dword [edx], esi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret 8
xor al, al
mov esp, ebp
pop ebp
ret 8
Function at 0x407c70
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x416538
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x420090]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov edi, edx
push 0x41c7b4
mov ebx, 1
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x38], ecx
call fcn.00408250
push 0x41c7b8
mov esi, eax
call fcn.00408250
cmp esi, eax
jg 0x407cc7
mov esi, eax
cmp esi, 0xffffffff
je 0x407dbe
mov edx, dword [edi + 0x14]
cmp edx, 8
jb 0x407cdc
mov eax, dword [edi]
jmp 0x407cde
mov eax, edi
lea ecx, [eax + esi*2]
cmp edx, 8
jb 0x407cea
mov eax, dword [edi]
jmp 0x407cec
mov eax, edi
xor esi, esi
xor edx, edx
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], esi
mov word [ebp - 0x2c], dx
cmp eax, ecx
je 0x407d0f
sub ecx, eax
sar ecx, 1
push ecx
lea ecx, [ebp - 0x2c]
call fcn.00409ec0
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], esi
mov ecx, dword [ebp - 0x30]
push eax
call fcn.00407e00
test al, al
sete bl
cmp dword [ebp - 0x18], 8
jb 0x407d35
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.0040d343
add esp, 4
test bl, bl
jne 0x407dbe
mov ebx, dword [ebp + 0x10]
push ebx
call fcn.0040d635
mov esi, eax
add esp, 4
test esi, esi
je 0x407dbe
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x38]
push edx
push eax
lea ecx, [ebp - 0x30]
push ecx
push esi
mov dword [ebp - 0x30], ebx
call fcn.0040a750
test eax, eax
jne 0x407db5
cmp dword [ebp - 0x30], ebx
jne 0x407db5
cmp dword [edi + 0x14], 8
jb 0x407d75
mov edi, dword [edi]
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
test edi, edi
je 0x407db5
push 0
lea edx, [ebp - 0x34]
push edx
push ebx
push esi
push edi
mov dword [ebp - 0x34], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
test eax, eax
jne 0x407dc2
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call fcn.0040d6c9
add esp, 4
xor al, al
jmp 0x407dd9
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call fcn.0040d6c9
xor eax, eax
add esp, 4
cmp dword [ebp - 0x34], ebx
sete al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040d34e
mov esp, ebp
pop ebp
ret 0xc
Function at 0x407e00
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x416503
mov eax, dword fs:[0]
push eax
sub esp, 0x488
mov eax, dword [0x420090]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xor ebx, ebx
mov eax, 0x5c
mov dword [ebp - 0x494], ecx
mov word [ebp - 0x38], ax
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 4], ebx
cmp dword [edi + 0x14], 8
jb 0x407e55
mov eax, dword [edi]
jmp 0x407e57
mov eax, edi
lea esi, [ebp - 0x490]
call fcn.00408970
test eax, eax
je 0x407e99
mov eax, dword [ebp - 0x34]
mov esi, dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [ebp - 0x30], ebx
cmp eax, ebx
je 0x407e83
cmp eax, 0xffffffff
je 0x407e83
push eax
call esi
xor eax, eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], ebx
cmp eax, ebx
je 0x407e92
cmp eax, 0xffffffff
je 0x407e92
push eax
call esi
mov al, 1
jmp 0x407f84
push 0x41c7b4
mov ebx, 1
call fcn.00408250
push 0x41c7b8
mov esi, eax
call fcn.00408250
cmp esi, eax
jg 0x407eba
mov esi, eax
cmp esi, 0xffffffff
je 0x407f68
mov edx, dword [edi + 0x14]
cmp edx, 8
jb 0x407ecf
mov eax, dword [edi]
jmp 0x407ed1
mov eax, edi
lea ecx, [eax + esi*2]
cmp edx, 8
jb 0x407edd
mov eax, dword [edi]
jmp 0x407edf
mov eax, edi
xor edx, edx
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x2c], dx
cmp eax, ecx
je 0x407f04
sub ecx, eax
sar ecx, 1
push ecx
lea ecx, [ebp - 0x2c]
call fcn.00409ec0
mov ecx, dword [ebp - 0x494]
lea eax, [ebp - 0x2c]
push eax
mov byte [ebp - 4], bl
call fcn.00407e00
test al, al
mov esi, 8
sete bl
cmp dword [ebp - 0x18], esi
jb 0x407f31
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.0040d343
add esp, 4
test bl, bl
je 0x407f53
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x30], 0
test eax, eax
je 0x407f4f
cmp eax, 0xffffffff
je 0x407f4f
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
xor al, al
jmp 0x407f84
cmp dword [edi + 0x14], esi
jb 0x407f5a
mov edi, dword [edi]
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
setne bl
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x30], 0
test eax, eax
je 0x407f82
cmp eax, 0xffffffff
je 0x407f82
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040d34e
mov esp, ebp
pop ebp
ret 4
Function at 0x40561d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push es
xchg dword [eax + 0xbe9], edx
add byte [0x69cc8995], bh
mov byte [0xfd760d21], al
and byte [eax - 0x17], bl
or byte [eax], al
add byte [eax], al
xor eax, 0x9f35d3e6
cmp bl, byte [eax - 2]

Function at 0x405640
Capabilities:
Resolve function by parsing pe exports

Disassembly:
nop
jmp 0x4053d2
movzx ecx, word [edx + 0x26]
nop
jmp 0x4053e5
xor edi, edi
mov esi, dword [edx + 0x28]
jmp 0x4053f5
nop
xor eax, eax
lodsb al, byte [esi]
nop
jmp 0x40540b
cmp al, 0x61
jmp 0x40541d
jl 0x405449
nop
jmp 0x40542a
nop
jmp 0x40543a
sub al, 0x20
nop
jmp 0x405449
nop
jmp 0x405454
ror edi, 0xd
nop
add edi, eax
dec ecx
nop
jne 0x4053f5
nop
nop
push edx
nop
push edi
mov edx, dword [edx + 0x10]
jmp 0x405476
mov eax, dword [edx + 0x3c]
nop
jmp 0x405488
add eax, edx
nop
jmp 0x40549c
mov eax, dword [eax + 0x78]
nop
jmp 0x4054af
test eax, eax
je 0x40563e
nop
jmp 0x4054c5
nop
add eax, edx
nop
push eax
mov ebx, dword [eax + 0x20]
nop
jmp 0x4054df
mov ecx, dword [eax + 0x18]
jmp 0x4054f3
add ebx, edx
test ecx, ecx
jmp 0x405502
je 0x40561f
nop
jmp 0x405514
nop
dec ecx
nop
xor edi, edi
nop
jmp 0x405527
mov esi, dword [ebx + ecx*4]
nop
add esi, edx
nop
xor eax, eax
jmp 0x40553a
lodsb al, byte [esi]
nop
ror edi, 0xd
jmp 0x405549
add edi, eax
nop
cmp al, ah
nop
jne 0x40552e
nop
jmp 0x405563
add edi, dword [ebp - 8]
nop
jmp 0x405576
cmp edi, dword [ebp + 0x24]
nop
jne 0x4054f5
nop
jmp 0x405591
pop eax
nop
mov ebx, dword [eax + 0x24]
jmp 0x4055a0
add ebx, edx
jmp 0x4055ad
mov cx, word [ebx + ecx*2]
jmp 0x4055c5
mov ebx, dword [eax + 0x1c]
add ebx, edx
nop
mov eax, dword [ebx + ecx*4]
add eax, edx
nop
jmp 0x405630
pop eax
jmp 0x40563e
nop
pop edi
jmp 0x40564e
pop edx
jmp 0x405662
mov edx, dword [edx]
nop
jmp 0x405676
jmp 0x4053c2

Function at 0x405890
Capabilities:
Resolve function by parsing pe exports

Disassembly:
movzx ecx, word [edx + 0x26]
xor edi, edi
mov esi, dword [edx + 0x28]
xor eax, eax
lodsb al, byte [esi]
cmp al, 0x61
jl 0x405878
sub al, 0x20
ror edi, 0xd
add edi, eax
dec ecx
jne 0x40586f
push edx
mov edx, dword [edx + 0x10]
mov eax, dword [edx + 0x3c]
add eax, edx
push edi
mov eax, dword [eax + 0x78]
test eax, eax
je 0x4058dd
dec esp
dec esp
add eax, edx
mov ebx, dword [eax + 0x20]
add ebx, edx
mov ecx, dword [eax + 0x18]
push eax
test ecx, ecx
je 0x4058dc
dec ecx
mov esi, dword [ebx + ecx*4]
xor edi, edi
add esi, edx
xor eax, eax
lodsb al, byte [esi]
ror edi, 0xd
add edi, eax
cmp al, ah
jne 0x4058a8
add edi, dword [ebp - 8]
cmp edi, dword [ebp + 0x24]
jne 0x40589c
pop eax
mov ebx, dword [eax + 0x24]
add ebx, edx
mov cx, word [ebx + ecx*2]
mov ecx, dword [ebx + ecx*2]
pop eax
pop edi
pop edx
mov edx, dword [edx]
jmp 0x405866
Function at 0x408bd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 8]
lea eax, [ebp - 4]
mov ah, 0x68
jle 0x408c44
add al, 0x80
push ecx
mov dword [ebp - 4], 0xd10000
jmp [edx - 0x4c]
mov esp, dword [edx + 0x4030d8]
xor byte [eax], al
sbb cl, byte [edx - 0x2f]
sal byte [ebp - 0x73], 0x5e
add byte [edi - 0x2989aaa3], 5
cmp ah, 0xbe
add byte [edi - 0x3c153704], al
xor eax, eax
mov esp, ebp
or al, bl
nop
jae 0x408c47
nop
mov esp, 0x90909090

Function at 0x401a00
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x54
push ebx
push ebp
mov ebx, dword [0x407048]
push esi
push edi
mov ecx, 0xa
xor eax, eax
lea edi, [esp + 0x3c]
rep stosd dword es:[edi], eax
mov dword [esp + 0x3c], eax
mov eax, dword [0x407154]
push 0
mov dword [esp + 0x44], eax
call ebx
lea ecx, [esp + 0x3c]
mov dword [esp + 0x4c], eax
push ecx
mov dword [esp + 0x64], str.Warcraft_III_Root
call dword [0x407174]
mov ebp, dword [0x407178]
lea edx, [esp + 0x10]
push edx
call ebp
push eax
call dword [0x40717c]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
add eax, ecx
push 0
cdq
sub eax, edx
mov edx, dword [esp + 0x18]
mov esi, eax
mov eax, dword [esp + 0x20]
add eax, edx
push 0
cdq
sub eax, edx
mov edi, eax
sar esi, 1
sar edi, 1
sub esi, 0x10
sub edi, 0x10
call ebx
push eax
push 0
call ebp
push eax
push 0x10
push 0x10
push edi
push esi
push 0x80000000
push str.Launching_Warcraft_III
push str.Warcraft_III_Root
push 0
call dword [0x407180]
push 1
push eax
mov dword [0x40aad0], eax
call dword [0x407184]
mov ecx, dword [0x40aad0]
push ecx
call dword [0x40716c]
mov edx, dword [0x40aad0]
mov esi, dword [0x407168]
push 0
push 0
push 0
lea eax, [esp + 0x2c]
push edx
push eax
call esi
test eax, eax
je 0x401b2a
mov edi, dword [0x407164]
mov ebx, dword [0x407160]
mov ebp, dword [0x40715c]
mov ecx, dword [0x40aad0]
push 0
push 0
lea edx, [esp + 0x28]
push ecx
push edx
call edi
lea eax, [esp + 0x20]
push eax
call ebx
lea ecx, [esp + 0x20]
push ecx
call ebp
mov edx, dword [0x40aad0]
push 0
push 0
push 0
lea eax, [esp + 0x2c]
push edx
push eax
call esi
test eax, eax
jne 0x401af2
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x54
ret

Function at 0x401b40
Capabilities:
Create thread

Disassembly:
push esi
call fcn.00401a00
mov esi, dword [0x407050]
push 0
push 0
push 1
push 0
mov dword [0x40aadc], 1
call esi
push 0
push 0
push 1
push 0
mov dword [0x40aad4], eax
call esi
push 0
push 0x2000
push 0x401850
mov dword [0x40aad8], eax
call fcn.00401ffb
mov eax, dword [0x40aad0]
add esp, 0xc
push eax
call dword [0x407170]
mov eax, dword [0x40aad0]
pop esi
ret
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
jmp 0x43e28d
push 0x14
push 0x470a38
call fcn.0043e620
push 1
call fcn.0043de42
pop ecx
test al, al
je 0x43e277
xor bl, bl
mov byte [ebp - 0x19], bl
and dword [ebp - 4], 0
call fcn.0043de10
mov byte [ebp - 0x24], al
mov eax, dword [0x476794]
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x43e277
test eax, eax
jne 0x43e19b
mov dword [0x476794], ecx
push 0x45e310
push 0x45e2f0
call fcn.00449399
pop ecx
pop ecx
test eax, eax
je 0x43e17e
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x43e267
push 0x45e2ec
push 0x45e278
call fcn.0044933d
pop ecx
pop ecx
mov dword [0x476794], 2
jmp 0x43e1a0
mov bl, cl
mov byte [ebp - 0x19], bl
push dword [ebp - 0x24]
call fcn.0043dfb4
pop ecx
call fcn.0043ebe7
mov esi, eax
xor edi, edi
cmp dword [esi], edi
je 0x43e1d1
push esi
call fcn.0043df20
pop ecx
test al, al
je 0x43e1d1
mov esi, dword [esi]
push edi
push 2
push edi
mov ecx, esi
call dword [0x45e274]
call esi
call fcn.0043ebed
mov esi, eax
cmp dword [esi], edi
je 0x43e1ef
push esi
call fcn.0043df20
pop ecx
test al, al
je 0x43e1ef
push dword [esi]
call fcn.004487fc
pop ecx
call fcn.0043ea1f
movzx eax, ax
push eax
call fcn.004492ea
push eax
push edi
push 0x400000
call main
mov esi, eax
call fcn.0043ea55
test al, al
je 0x43e27e
test bl, bl
jne 0x43e21d
call fcn.004487d7
push edi
push 1
call fcn.0043dfd1
pop ecx
pop ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x43e267
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
push 7
call fcn.0043e905
push esi
call fcn.00448834
push dword [ebp - 0x20]
call fcn.004487e6
int3
call fcn.0043eb3a
jmp 0x43e111
Function at 0x403170
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 4], ecx
mov eax, 1
test eax, eax
je 0x4032df
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x38], 0
je 0x4031a8
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 4]
call fcn.004051d0
jmp 0x4032f3
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x20]
cmp dword [edx], 0
je 0x4031cc
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x30]
mov edx, dword [ecx]
mov dword [ebp - 8], edx
jmp 0x4031d3
mov dword [ebp - 8], 0
mov eax, dword [ebp - 8]
cdq
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
cmp dword [ebp + 0x10], 0
jl 0x40328d
jg 0x4031f3
cmp dword [ebp + 0xc], 0
jbe 0x40328d
cmp dword [ebp - 0x14], 0
jl 0x40328d
jg 0x403209
cmp dword [ebp - 0x18], 0
jbe 0x40328d
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp - 0x14]
jg 0x403227
jl 0x40321b
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [ebp - 0x18]
jae 0x403227
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x20]
mov eax, dword [edx]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x10]
push eax
call fcn.0043fee0
add esp, 0xc
mov ecx, dword [ebp - 0x18]
add ecx, dword [ebp + 8]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
sub edx, dword [ebp - 0x18]
mov eax, dword [ebp + 0x10]
sbb eax, dword [ebp - 0x14]
mov dword [ebp + 0xc], edx
mov dword [ebp + 0x10], eax
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x30]
mov ecx, dword [eax]
sub ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x30]
mov dword [eax], ecx
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x20]
mov eax, dword [edx]
add eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x20]
mov dword [edx], eax
cmp dword [ebp + 0x10], 0
jl 0x4032cf
jg 0x40329b
cmp dword [ebp + 0xc], 0
jbe 0x4032cf
mov eax, dword [ebp - 4]
cmp dword [eax + 0x4c], 0
je 0x4032cf
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x4c]
push edx
mov eax, dword [ebp + 0xc]
push eax
push 1
mov ecx, dword [ebp + 8]
push ecx
call fcn.00447816
add esp, 0x10
xor edx, edx
mov ecx, dword [ebp + 0xc]
sub ecx, eax
mov eax, dword [ebp + 0x10]
sbb eax, edx
mov dword [ebp + 0xc], ecx
mov dword [ebp + 0x10], eax
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0x1c]
sbb edx, dword [ebp + 0x10]
jmp 0x4032f3
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
call fcn.004051d0
mov esp, ebp
pop ebp
ret 0xc