joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10003aa0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1003d050]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x10003b5a
cmp byte [esi + 0x3d], 0
je 0x10003b5a
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x10003b48
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
mov edx, dword [ecx]
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x10003b10
sub eax, 1
je 0x10003b14
sub eax, 2
jne 0x10003b48
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000b7ac
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x10003b31
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.10011c2d
add esp, 0x10
cmp edi, eax
jne 0x10003b48
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000b7ac
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000b7ac
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.1000b7ac
mov esp, ebp
pop ebp
ret

Function at 0x10003e60
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002b3e0
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x1003d050]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
push 8
mov dword [eax], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.1000b7ba
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.1000ae71
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001c27a
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1001c0f0

Function at 0x100225bc
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10022239
Function at 0x402030
Capabilities:
Create thread
Set console window title

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4046d5
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x407040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push str.pandora_lite___v2023.3.12
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
call fcn.00402a60
call fcn.004032d0
push 1
call fcn.004036dc
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], 0
push ecx
push 0
push eax
push 0x402140
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x1c
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x4020f9
mov dword [ebp - 4], 1
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x4020f1
push ecx
push eax
call dword [sym.imp.MSVCP140.dll__Thrd_detach]
add esp, 8
test eax, eax
jne 0x4020f1
xorps xmm0, xmm0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
movlpd qword [ebp - 0x1c], xmm0
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::basic_istream_char__struct_std::char_traits_char__::get_void_]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004036ce
mov esp, ebp
pop ebp
ret
push 1
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
push 6
mov dword [ebp - 0x18], 0
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
Function at 0x402490
Capabilities:
Enumerate process modules
Enumerate processes
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x368
mov eax, dword [0x407040]
xor eax, esp
mov dword [esp + 0x364], eax
push esi
mov eax, ecx
push edi
mov dword [esp + 8], eax
push 0x38
mov dword [esp + 0x14], eax
mov dword [esp + 0xc], eax
call fcn.004036dc
push 0x38
mov esi, eax
push 0
push esi
mov dword [esp + 0x1c], esi
call sub.VCRUNTIME140.dll_memset
lea eax, [esi + 0x14]
mov dword [esi + 4], 0
add esp, 0x10
mov dword [esi + 8], 0
xorps xmm0, xmm0
mov dword [esi + 0xc], 0
movups xmmword [eax], xmm0
mov dword [esi + 0x10], 0
movups xmmword [eax + 0x10], xmm0
push eax
mov dword [eax + 0x20], 0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push 0
push 2
mov dword [esp + 0x20], 0x128
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
lea eax, [esp + 0x18]
push eax
push edi
mov dword [esp + 0x10], edi
call dword [sym.imp.KERNEL32.dll_Process32First]
cmp eax, 1
jne 0x40262a
lea eax, [esp + 0x18]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32Next]
cmp eax, 1
jne 0x40262a
mov edi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
lea eax, [esp + 0x3c]
push str.RobloxPlayerBeta.exe
push eax
call edi
add esp, 8
test eax, eax
jne 0x40260e
cmp dword [esp + 0x2c], 0x14
jbe 0x40260e
mov eax, dword [esp + 0x20]
push eax
push 0
push 0x1fffff
mov dword [esi + 8], eax
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push dword [esp + 0x20]
mov dword [esi + 4], eax
push 8
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
mov dword [esp + 0x140], 0x224
lea eax, [esp + 0x140]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32First]
nop word [eax + eax]
lea eax, [esp + 0x160]
push str.RobloxPlayerBeta.exe
push eax
call edi
add esp, 8
test eax, eax
je 0x4025eb
lea eax, [esp + 0x140]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
jne 0x4025c0
jmp 0x402603
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x154]
mov dword [ecx + 0xc], eax
mov eax, dword [esp + 0x158]
mov dword [ecx + 0x10], eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x18]
push eax
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_Process32Next]
cmp eax, 1
je 0x402553
mov edi, dword [esp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x36c]
pop edi
mov dword [eax], esi
pop esi
xor ecx, esp
call fcn.004036ce
mov esp, ebp
pop ebp
ret
Function at 0x402db0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40481d
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x407040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 0
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cmp ebx, edi
jne 0x402e10
push eax
sub esp, 0xc
lea eax, [ebp + 8]
mov ecx, esp
push eax
call fcn.00402f20
push 0x402a20
lea eax, [ebp - 0x30]
jmp 0x402e4e
sub edi, 8
cmp ebx, edi
je 0x402e32
mov edx, dword [ebx]
mov esi, dword [ebx + 4]
mov eax, dword [edi]
mov ecx, dword [edi + 4]
mov dword [ebx], eax
mov dword [ebx + 4], ecx
add ebx, 8
mov dword [edi], edx
mov dword [edi + 4], esi
cmp ebx, edi
jne 0x402e10
push dword [ebp - 0x18]
lea eax, [ebp + 8]
sub esp, 0xc
mov ecx, esp
push eax
call fcn.00402f20
mov esi, dword [ebp - 0x14]
lea eax, [ebp - 0x3c]
push 0x402a40
push eax
mov ecx, esi
call fcn.00402fe0
push 0
push 0
push 0
movq xmm0, qword [eax]
movq qword [ebp - 0x24], xmm0
mov ebx, dword [ebp - 0x24]
push ebx
push 0
push 0
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov edi, eax
test edi, edi
jne 0x402e80
xor esi, esi
jmp 0x402eb8
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0
push 4
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x20]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push 0x8000
push 0
push ebx
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
test edx, edx
je 0x402ef1
mov ecx, dword [ebp + 0x10]
mov eax, edx
sub ecx, edx
and ecx, 0xfffffff8
cmp ecx, 0x1000
jb 0x402ee7
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x402ee7
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00403711
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004036ce
mov esp, ebp
pop ebp
ret 0x10
Function at 0x402fe0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x404865
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x407040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x28], eax
lea edi, [eax + 2]
mov dword [ebp - 4], 0
xor ebx, ebx
mov eax, edi
cmp byte [eax - 2], 0x90
jne 0x403039
cmp byte [eax - 1], 0x90
jne 0x403039
cmp byte [eax], 0x90
je 0x403045
inc ebx
inc eax
cmp ebx, 0x3e8
jl 0x403028
xor ebx, ebx
mov esi, dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
push 0x40
push 0x2000
push ebx
push 0
push dword [ecx + 4]
call esi
mov eax, dword [ebp - 0x24]
push 0x40
push 0x1000
push ebx
push 0
push dword [eax + 4]
call esi
push dword [ebp + 0x1c]
mov ecx, dword [ebp - 0x24]
mov ebx, eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x18], 0
push eax
push ebx
push dword [ebp - 0x28]
lea eax, [ebp - 0x20]
xorps xmm0, xmm0
push eax
movq qword [ebp - 0x20], xmm0
call fcn.004014c0
mov byte [ebp - 4], 1
xor esi, esi
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
sub eax, ecx
je 0x4030d7
cmp eax, esi
jbe 0x4031a3
mov al, byte [ecx + esi]
push 0
mov byte [ebp - 0x14], al
lea eax, [ebp - 0x14]
push 1
push eax
lea eax, [esi + ebx]
push eax
mov eax, dword [ebp - 0x24]
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0x1c]
inc esi
mov ecx, dword [ebp - 0x20]
sub eax, ecx
cmp eax, esi
ja 0x4030ac
mov esi, dword [ebp - 0x2c]
xor eax, eax
mov dword [esi], ebx
nop
cmp byte [edi - 2], 0x90
jne 0x4030f1
cmp byte [edi - 1], 0x90
jne 0x4030f1
cmp byte [edi], 0x90
je 0x4030fc
inc eax
inc edi
cmp eax, 0x3e8
jl 0x4030e0
xor eax, eax
inc eax
add eax, ebx
mov dword [esi + 4], eax
mov eax, dword [ebp - 0x28]
mov dword [esi + 8], eax
test ecx, ecx
je 0x40314a
mov edx, dword [ebp - 0x18]
mov eax, ecx
sub edx, ecx
cmp edx, 0x1000
jb 0x40312b
mov ecx, dword [eax - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x403173
push edx
push ecx
call fcn.00403711
add esp, 8
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x403183
mov ecx, dword [ebp + 0x18]
mov eax, edx
sub ecx, edx
and ecx, 0xfffffff8
cmp ecx, 0x1000
jb 0x403179
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x403179
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00403711
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004036ce
mov esp, ebp
pop ebp
ret 0x18
call fcn.00401c60
int3
Function at 0x40403c
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40407b
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40407b
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40407b
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40407b
cmp dword [ecx + 0x74], 0xe
jbe 0x40407b
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x402f20
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55d840
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x5b0514]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
call fcn.00402ee0
mov ecx, dword [ebp + 0xc]
mov esi, eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], esi
mov word [esi + 0xc], 0
push dword [ecx]
lea ecx, [esi + 0x10]
call fcn.004061d0
mov dword [esi + 0x28], 0
mov eax, esi
mov dword [esi + 0x30], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x409170
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
mov esi, ecx
push dword [ebp + 8]
mov byte [esi + 0x68], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
call fcn.004092b0
mov eax, esi
pop esi
pop ebp
ret 8

Function at 0x409ed0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x5b0514]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x38], 0
je 0x409f71
cmp byte [esi + 0x3d], 0
je 0x409f71
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x409f27
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
mov edx, dword [ecx]
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x409f39
sub eax, 1
je 0x409f3d
sub eax, 2
je 0x409f71
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00497cb0
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x409f5a
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.0052aa71
add esp, 0x10
cmp edi, eax
jne 0x409f27
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00497cb0
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.00497cb0
mov esp, ebp
pop ebp
ret
Function at 0x40d750
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55e468
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x5b0514]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
mov eax, dword [edi]
mov dword [ebp - 0x18], 0
mov eax, dword [eax + 4]
mov dword [edi + eax], vtable.std::basic_istream_wchar_t__struct_std::char_traits_wchar_t__.0
mov eax, dword [edi]
mov edx, dword [eax + 4]
lea eax, [edx - 0x18]
mov dword [edx + edi - 4], eax
mov eax, dword [edi]
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov esi, dword [eax + 4]
add esi, edi
mov ecx, esi
call fcn.0040f5d0
mov eax, dword [ebp + 8]
mov dword [esi + 0x38], eax
mov eax, dword [esi + 0x30]
mov dword [esi + 0x3c], 0
mov dword [ebp - 4], 1
mov ecx, dword [eax + 4]
mov dword [ebp - 0x1c], ecx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x20]
mov dword [ebp - 4], 2
push eax
call fcn.0040e640
add esp, 4
mov ecx, eax
mov edx, dword [eax]
push 0x20
call dword [edx + 0x30]
movzx ebx, ax
mov dword [ebp - 4], 3
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x40d818
mov eax, dword [ecx]
call dword [eax + 8]
test eax, eax
je 0x40d818
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
mov byte [ebp - 4], 0
cmp dword [esi + 0x38], 0
mov word [esi + 0x40], bx
jne 0x40d836
mov eax, dword [esi + 0xc]
mov ecx, esi
push 0
or eax, 4
push eax
call fcn.00406b40
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4119f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55e82e
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5b0514]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 8]
mov edx, eax
shr edx, 0x10
test edx, edx
je 0x411ad0
cmp word [eax], 0x3c
je 0x411ad0
mov ecx, dword fs:[0x2c]
mov edx, dword [ecx]
mov ecx, dword [0x5bab14]
cmp ecx, dword [edx + 4]
jle 0x411ab7
push 0x5bab14
call fcn.0049822a
add esp, 4
cmp dword [0x5bab14], 0xffffffff
jne 0x411ab4
push 0x1f8
mov dword [ebp - 4], 0
call fcn.00481041
mov edi, eax
add esp, 4
mov dword [ebp - 0x10], edi
mov byte [ebp - 4], 1
test edi, edi
je 0x411a99
push 0x1f8
push 0
push edi
call fcn.005219d0
add esp, 0xc
mov ecx, edi
call fcn.004be840
jmp 0x411a9b
xor eax, eax
push 0x5bab14
mov dword [0x5bab18], eax
mov dword [ebp - 4], 0xffffffff
call fcn.004981e0
add esp, 4
mov eax, dword [ebp + 8]
mov ecx, dword [0x5bab18]
push eax
call fcn.004bea60
mov ecx, eax
mov eax, dword [ebp + 8]
test ecx, ecx
cmovne eax, ecx
mov dword [ebp + 8], eax
mov ecx, eax
shr ecx, 0x10
test ecx, ecx
je 0x411b2b
cmp word [eax], 0x3c
mov ecx, esi
jne 0x411b05
push eax
call fcn.004bcea0
test al, al
jne 0x411b95
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
push 0
push eax
call fcn.004bcf10
test al, al
jne 0x411b95
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov edi, dword [esi + 0x148]
test edi, edi
jne 0x411b3f
call fcn.004ab020
mov edi, eax
mov eax, dword [ebp + 8]
push dword [ebp + 0xc]
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x411aef
push ebx
push edi
call dword [sym.imp.KERNEL32.DLL_LoadResource]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x411aef
mov eax, dword [ebp + 0x10]
push 0
push ebx
push edi
mov dword [esi + 0x140], eax
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.DLL_LockResource]
push eax
mov ecx, esi
call fcn.004bd5c0
test al, al
je 0x411aef
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x144], eax
push dword [ebp + 0x18]
mov ecx, esi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.00411bc0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x413450
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x438
mov eax, dword [0x5b0514]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x208
lea eax, [ebp - 0x210]
mov edi, edx
push 0
push eax
mov esi, ecx
call fcn.005219d0
push 0x208
lea eax, [ebp - 0x418]
push 0
push eax
call fcn.005219d0
add esp, 0x18
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
js 0x4135b6
lea eax, [ebp - 0x41c]
push eax
push esi
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
js 0x4135aa
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x41c]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x413598
push 0x104
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.DLL_GetShortPathNameW]
lea edx, [ebp - 0x210]
lea ecx, [edx + 2]
nop dword [eax]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x413500
sub edx, ecx
mov dword [ebp - 0x428], 0
xor eax, eax
sar edx, 1
mov word [ebp - 0x438], ax
lea ecx, [ebp - 0x210]
lea eax, [ebp - 0x210]
mov dword [ebp - 0x424], 7
lea eax, [eax + edx*2]
cmp ecx, eax
je 0x41354e
mov eax, ecx
lea ecx, [ebp - 0x438]
push edx
push eax
call fcn.00410900
lea eax, [ebp - 0x438]
mov ecx, edi
push eax
call fcn.0040be40
mov edx, dword [ebp - 0x424]
cmp edx, 8
jb 0x413598
mov ecx, dword [ebp - 0x438]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41358e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4135c6
push edx
push ecx
call fcn.00497cc1
add esp, 8
mov eax, dword [ebp - 0x420]
push dword [ebp - 0x41c]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov eax, dword [ebp - 0x420]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00497cb0
mov esp, ebp
pop ebp
ret
call fcn.00524999
int3
Function at 0x414590
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55ea7d
mov eax, dword fs:[0]
push eax
mov eax, 0x29b4
call fcn.00498a00
mov eax, dword [0x5b0514]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x299c], edi
mov dword [ebp - 0x29a4], edi
mov dword [ebp - 0x29a0], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
lea eax, [ebp - 0x2994]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x2990]
mov dword [ebp - 0x29a0], 1
push eax
mov dword [ebp - 0x2994], 0x2880
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
test eax, eax
jne 0x414740
lea esi, [ebp - 0x2990]
mov dword [ebp - 0x2998], esi
nop
movzx eax, byte [esi + 0x199]
push eax
movzx eax, byte [esi + 0x198]
push eax
movzx eax, byte [esi + 0x197]
push eax
movzx eax, byte [esi + 0x196]
push eax
movzx eax, byte [esi + 0x195]
push eax
movzx eax, byte [esi + 0x194]
push eax
push str._02x_02x_02x_02x_02x_02x
lea eax, [ebp - 0x110]
push 0x100
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfA]
add esp, 0x24
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x29bc]
push 0x58c2cc
push eax
call fcn.004135d0
add esp, 0xc
mov dword [ebp - 4], 1
mov edx, eax
cmp dword [eax + 0x14], 0x10
jb 0x4146a6
mov edx, dword [eax]
mov ebx, dword [eax + 0x10]
mov eax, dword [edi + 0x14]
mov ecx, dword [edi + 0x10]
sub eax, ecx
cmp ebx, eax
ja 0x4146df
cmp dword [edi + 0x14], 0x10
lea eax, [ecx + ebx]
mov dword [edi + 0x10], eax
mov eax, edi
jb 0x4146c5
mov eax, dword [edi]
push ebx
lea esi, [eax + ecx]
push edx
push esi
call fcn.00521450
mov byte [esi + ebx], 0
add esp, 0xc
mov esi, dword [ebp - 0x2998]
jmp 0x4146f6
push ebx
push edx
mov byte [ebp - 0x299c], 0
mov ecx, edi
push dword [ebp - 0x299c]
push ebx
call fcn.00406000
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x29a8]
cmp edx, 0x10
jb 0x414730
mov ecx, dword [ebp - 0x29bc]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x414726
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41475e
push edx
push ecx
call fcn.00497cc1
add esp, 8
mov esi, dword [esi]
mov dword [ebp - 0x2998], esi
test esi, esi
jne 0x414630
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00497cb0
mov esp, ebp
pop ebp
ret
call fcn.00524999
int3