joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401000
Capabilities:
Copy file
Get common file path
Set file attributes

Disassembly:
sub esp, 0x318
mov eax, dword [esp + 0x31c]
push esi
push edi
mov edi, dword [sym.imp.MSVCRT.dll_strncpy]
push 0x104
lea ecx, [esp + 0x114]
push eax
push ecx
mov byte [esp + 0x224], 0
call edi
add esp, 0xc
call fcn.00401520
lea edx, [esp + 0x218]
push 0x105
push edx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x401057
pop edi
pop esi
add esp, 0x318
ret
lea eax, [esp + 0x218]
push 0x104
lea ecx, [esp + 0xc]
push eax
push ecx
call edi
add esp, 0xc
cmp esi, 1
jne 0x4010bd
mov edi, str.KeyCrypt.vxd
or ecx, 0xffffffff
xor eax, eax
mov esi, dword [sym.imp.MSVCRT.dll_strncat]
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edx, 0x104
sub edx, ecx
lea eax, [esp + 0x110]
push edx
push str.KeyCrypt.vxd
push eax
call esi
mov edi, str.KeyCrypt.vxd
or ecx, 0xffffffff
xor eax, eax
mov edx, 0x104
repne scasb al, byte es:[edi]
not ecx
dec ecx
sub edx, ecx
push edx
push str.KeyCrypt.vxd
jmp 0x40111a
cmp esi, 2
je 0x4010d2
cmp esi, 4
je 0x4010d2
pop edi
xor eax, eax
pop esi
add esp, 0x318
ret
mov edi, str.KeyCrypt.sys
or ecx, 0xffffffff
xor eax, eax
mov esi, dword [sym.imp.MSVCRT.dll_strncat]
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edx, 0x104
sub edx, ecx
lea eax, [esp + 0x110]
push edx
push str.KeyCrypt.sys
push eax
call esi
mov edi, str.KeyCrypt.sys
or ecx, 0xffffffff
xor eax, eax
mov edx, 0x104
repne scasb al, byte es:[edi]
not ecx
dec ecx
sub edx, ecx
push edx
push str.KeyCrypt.sys
lea eax, [esp + 0x1c]
push eax
call esi
add esp, 0x18
lea ecx, [esp + 8]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea edx, [esp + 8]
push 0
lea eax, [esp + 0x114]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x40115e
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
xor eax, eax
pop esi
add esp, 0x318
ret
pop edi
mov eax, 1
pop esi
add esp, 0x318
ret
Function at 0x401170
Capabilities:
Get common file path

Disassembly:
sub esp, 0x210
push edi
lea eax, [esp + 0x10c]
push 0x105
push eax
mov byte [esp + 0x114], 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x40119e
pop edi
add esp, 0x210
ret
mov eax, dword [esp + 0x21c]
cmp eax, 1
jne 0x40121b
push esi
mov esi, dword [sym.imp.MSVCRT.dll_strncpy]
push 0x104
lea ecx, [esp + 0xc]
push str.KeyCrypt.vxd
push ecx
call esi
lea edx, [esp + 0x11c]
push 0x104
lea eax, [esp + 0x18]
push edx
push eax
call esi
mov edi, str.KeyCrypt.vxd
or ecx, 0xffffffff
xor eax, eax
mov edx, 0x104
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + 0x20]
sub edx, ecx
push edx
push str.KeyCrypt.vxd
push eax
call dword [sym.imp.MSVCRT.dll_strncat]
mov ecx, dword [esp + 0x240]
lea edx, [esp + 0x2c]
push ecx
push edx
call fcn.00401360
add esp, 0x2c
pop esi
pop edi
add esp, 0x210
ret
cmp eax, 2
je 0x40122f
cmp eax, 4
je 0x40122f
xor eax, eax
pop edi
add esp, 0x210
ret
lea eax, [esp + 0x10c]
push 0x104
lea ecx, [esp + 8]
push eax
push ecx
call dword [sym.imp.MSVCRT.dll_strncpy]
mov edi, str.KeyCrypt.sys
or ecx, 0xffffffff
xor eax, eax
mov edx, 0x104
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + 0x10]
sub edx, ecx
push edx
push str.KeyCrypt.sys
push eax
call dword [sym.imp.MSVCRT.dll_strncat]
mov ecx, dword [esp + 0x230]
lea edx, [esp + 0x1c]
push edx
mov dword [ecx], 0
call fcn.00401290
add esp, 0x1c
pop edi
add esp, 0x210
ret

Function at 0x4013f0
Capabilities:
Delete service

Disassembly:
call fcn.00401520
cmp eax, 1
jne 0x401408
mov eax, dword [esp + 4]
push eax
call fcn.00401430
add esp, 4
ret
cmp eax, 2
je 0x401415
cmp eax, 4
je 0x401415
xor eax, eax
ret
jmp 0x401420
call fcn.00401450
jmp 0x4014c0
push ebx
push esi
push edi
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebx, eax
push 0x10000
push str.QKeyService
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, eax
test edi, edi
jne 0x4014ff
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor esi, esi
call edi
push ebx
call edi
mov eax, esi
pop edi
pop esi
pop ebx
ret
push edi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
mov esi, eax
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
neg esi
sbb esi, esi
neg esi
call edi
push ebx
call edi
mov eax, esi
pop edi
pop esi
pop ebx
ret

Function at 0x401450
Capabilities:
Stop service

Disassembly:
sub esp, 0x1c
push esi
push edi
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
je 0x401488
push 0xf01ff
push str.QKeyService
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
jne 0x401490
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
xor eax, eax
pop esi
add esp, 0x1c
ret
lea eax, [esp + 8]
push ebx
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ebx, eax
call esi
push edi
call esi
mov eax, ebx
pop ebx
pop edi
pop esi
add esp, 0x1c
ret
Function at 0x401aa0
Capabilities:
Set registry value

Disassembly:
push ecx
lea eax, [esp]
push eax
push str.SOFTWARETENCENTQKeyCrypt
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x401abe
xor eax, eax
pop ecx
ret
mov edx, dword [esp]
lea ecx, [esp + 8]
push 4
push ecx
push 4
push 0
push str.ReferenceCount
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x401aec
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop ecx
ret
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop ecx
ret

Function at 0x401b00
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
lea eax, [esp]
push eax
push str.SOFTWARETENCENTQKeyCrypt
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x401b22
xor eax, eax
add esp, 0x10
ret
lea ecx, [esp + 4]
lea edx, [esp + 8]
push ecx
mov ecx, dword [esp + 4]
lea eax, [esp + 0x10]
push edx
push eax
push 0
push str.ReferenceCount
push ecx
mov dword [esp + 0x1c], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x401b60
mov edx, dword [esp]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
add esp, 0x10
ret
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 8]
mov eax, 1
mov dword [ecx], edx
add esp, 0x10
ret

Function at 0x401b80
Capabilities:
Set registry value

Disassembly:
push ecx
lea eax, [esp]
push eax
push str.SOFTWARETENCENTQKeyCrypt
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x401b9e
xor eax, eax
pop ecx
ret
mov edx, dword [esp]
lea ecx, [esp + 8]
push 4
push ecx
push 4
push 0
push str.Version
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x401bcc
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop ecx
ret
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop ecx
ret

Function at 0x401be0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
lea eax, [esp]
push eax
push str.SOFTWARETENCENTQKeyCrypt
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x401c02
xor eax, eax
add esp, 0x10
ret
lea ecx, [esp + 4]
lea edx, [esp + 8]
push ecx
mov ecx, dword [esp + 4]
lea eax, [esp + 0x10]
push edx
push eax
push 0
push str.Version
push ecx
mov dword [esp + 0x1c], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x401c40
mov edx, dword [esp]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
add esp, 0x10
ret
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 8]
mov eax, 1
mov dword [ecx], edx
add esp, 0x10
ret
Function at 0x401c60
Capabilities:
Set registry value

Disassembly:
push ecx
lea eax, [esp]
push eax
push str.SOFTWARETENCENTQKeyCrypt
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x401c7e
xor eax, eax
pop ecx
ret
mov ecx, dword [esp + 8]
mov edx, dword [esp]
push 0
push 0
push 0
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x401ca9
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop ecx
ret
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop ecx
ret

Function at 0x401cc0
Capabilities:
Delete registry value

Disassembly:
push ecx
lea eax, [esp]
push eax
push str.SOFTWARETENCENTQKeyCrypt
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x401cde
xor eax, eax
pop ecx
ret
mov ecx, dword [esp + 8]
mov edx, dword [esp]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
je 0x401d01
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop ecx
ret
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop ecx
ret

Function at 0x401d20
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xdc
push ebx
lea eax, [esp + 0xc]
push esi
push eax
xor esi, esi
mov ebx, 0x64
push str.SOFTWARETENCENTQKeyCrypt
push 0x80000002
mov dword [esp + 0x14], esi
mov dword [esp + 0x20], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x24], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x401d63
pop esi
xor eax, eax
pop ebx
add esp, 0xdc
ret
lea ecx, [esp + 0xc]
push ebp
lea edx, [esp + 0x84]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
push ecx
lea eax, [esp + 0x20]
push edx
push eax
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x24]
push esi
lea edx, [esp + 0x30]
push ecx
push edx
push esi
push eax
call ebp
test eax, eax
jne 0x401dfa
push edi
mov edi, dword [sym.imp.MSVCRT.dll_strncmp]
push ebx
lea ecx, [esp + 0x28]
push str.ReferenceCount
push ecx
inc esi
mov dword [esp + 0x28], ebx
mov dword [esp + 0x20], ebx
call edi
add esp, 0xc
test eax, eax
je 0x401dcf
push ebx
lea edx, [esp + 0x28]
push str.Version
push edx
call edi
add esp, 0xc
test eax, eax
je 0x401dcf
inc dword [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x88]
push eax
lea edx, [esp + 0x24]
push ecx
push edx
mov edx, dword [esp + 0x24]
lea eax, [esp + 0x28]
push 0
lea ecx, [esp + 0x34]
push eax
push ecx
push esi
push edx
call ebp
test eax, eax
je 0x401d9a
pop edi
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0xc]
pop ebp
pop esi
pop ebx
add esp, 0xdc
ret
Function at 0x401e20
Capabilities:
Delete registry key

Disassembly:
push ecx
lea eax, [esp]
push eax
push str.SOFTWARETENCENT
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x401e3e
xor eax, eax
pop ecx
ret
mov ecx, dword [esp]
push str.QKeyCrypt
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
je 0x401e61
mov edx, dword [esp]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop ecx
ret
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop ecx
ret

Function at 0x401e80
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
lea eax, [esp]
push eax
push str.SOFTWARETENCENTQKeyCrypt
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x401ea2
xor eax, eax
add esp, 0x10
ret
lea ecx, [esp + 4]
lea edx, [esp + 8]
push ecx
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x10]
push edx
mov edx, dword [esp + 8]
push eax
push 0
push ecx
push edx
mov dword [esp + 0x1c], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x401ee0
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
add esp, 0x10
ret
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
add esp, 0x10
ret

Function at 0x401f40
Capabilities:
Delete file
Get common file path

Disassembly:
sub esp, 0x210
push edi
lea eax, [esp + 0x10c]
push 0x105
push eax
mov byte [esp + 0x114], 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x401f6e
pop edi
add esp, 0x210
ret
lea ecx, [esp + 0x10c]
push 0x104
lea edx, [esp + 8]
push ecx
push edx
call dword [sym.imp.MSVCRT.dll__mbsnbcpy]
add esp, 0xc
call fcn.00401520
cmp eax, 1
jne 0x401fb6
mov edi, str.KeyCrypt.vxd
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov eax, 0x104
sub eax, ecx
lea ecx, [esp + 4]
push eax
push str.KeyCrypt.vxd
push ecx
jmp 0x401feb
cmp eax, 2
je 0x401fca
cmp eax, 4
je 0x401fca
xor eax, eax
pop edi
add esp, 0x210
ret
mov edi, str.KeyCrypt.sys
or ecx, 0xffffffff
xor eax, eax
mov edx, 0x104
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + 4]
sub edx, ecx
push edx
push str.KeyCrypt.sys
push eax
call dword [sym.imp.MSVCRT.dll__mbsnbcat]
add esp, 0xc
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, 1
pop edi
add esp, 0x210
ret
Function at 0x533eca
Capabilities:
Encode data using xor

Disassembly:
int1
retf 0xe211
dec ebx
invalid
add eax, 0x46cf3536
jp 0x533ea2
cmp dword [eax], esp
aam 0x18
mov ch, byte [ebp + 0x15]
adc edi, dword [ebx - 0x35]
mov eax, dword [0x49e0e31]
push eax
cmp al, 0x2f
pop esp
cmp ebx, dword [edi + 0x554939ea]
dec ecx
push ebp
imul ebx, dword [edx - 0x697ca6ae], 0x50fa03ce
xchg esi, eax
into
add edi, edx
push eax
sbb edi, 0x84112332
push 0xab134441
or esi, esi
add al, 0x73
xor eax, 0xb05ead26
push eax
or al, 0xc4
inc edi
jg 0x533ef0
push eax
das
leave
xchg edx, eax
jb 0x533ef1
jecxz 0x533e98
mov ebx, 0xdc235e35
in al, dx
jns 0x533ee9
pop esi
invalid
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
je 0x42e072
nop
nop
nop
nop
nop
mov ebx, 0x407ef8
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x6c197773
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
loop 0x42e060
nop
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x42e0d2
nop
nop
mov ebx, 0x42cd70
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x55c608fb
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x42e0c0
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x401220
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
push str.PYTHONSCRIPT
push 1
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
mov al, byte [0x405100]
test al, al
jne 0x401248
push edi
call fcn.00401180
add esp, 4
test esi, esi
jne 0x401253
push str.Could_not_locate_script_resource:
jmp 0x401280
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x401266
push str.Could_not_load_script_resource:
jmp 0x401280
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
mov dword [0x405204], eax
mov dword [0x40532c], eax
jne 0x401294
push str.Could_not_lock_script_resource:
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call section..text
add esp, 8
pop edi
xor eax, eax
pop esi
ret
mov ecx, dword [eax + 0xc]
mov dword [0x405324], ecx
lea ecx, [eax + 0x10]
mov dword [0x405204], ecx
cmp dword [eax], 0x78563412
je 0x4012c2
push str.Bug:_Invalid_script_resource
push 0
call section..text
add esp, 8
pop edi
xor eax, eax
pop esi
ret
mov eax, ecx
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4012c7
sub eax, esi
lea edx, [ecx + eax + 1]
mov dword [0x405204], edx
cmp byte [ecx], 0
je 0x401305
push ecx
push 0x405100
push 0x404104
push 0x304
push 0x404ac0
call dword [sym.imp.MSVCR71.dll__snprintf]
add esp, 0x14
pop edi
mov eax, 1
pop esi
ret
push 0x304
push 0x404ac0
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
pop edi
mov eax, 1
pop esi
ret

Function at 0x401320
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ecx
push esi
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x401347
xor eax, eax
pop esi
pop ecx
ret
push ebx
push edi
lea ecx, [esp + 0xc]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0
push 0
push 0
push 2
push 0
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, eax
call esi
cmp edi, 0xffffffff
jne 0x40137f
pop edi
pop ebx
xor eax, eax
pop esi
pop ecx
ret
push ebp
push 0
push 0
push 0
push 4
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
push edi
mov ebp, eax
call esi
mov eax, dword [esp + 0x18]
test eax, eax
je 0x40139e
mov dword [eax], ebx
mov eax, ebp
pop ebp
pop edi
pop ebx
pop esi
pop ecx
ret
Function at 0x4013b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov al, byte [0x405100]
sub esp, 0x308
test al, al
push esi
mov esi, dword [esp + 0x310]
jne 0x4013d0
push esi
call fcn.00401180
add esp, 4
push 0x40410c
push 1
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x401425
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
push 0x40411c
call fcn.00401d30
add esp, 8
test eax, eax
jne 0x4014d0
push str.Could_not_load_python_dll
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call section..text
add esp, 8
xor eax, eax
pop esi
add esp, 0x308
ret
lea eax, [esp + 4]
push eax
mov eax, 0x404ac0
call fcn.00401320
mov esi, eax
add esp, 4
test esi, esi
je 0x401474
push edi
push 0xb
push 0x404148
push esi
xor edi, edi
call dword [sym.imp.MSVCR71.dll_strncmp]
add esp, 0xc
test eax, eax
jne 0x401468
lea ecx, [esi + 0xf]
push ecx
push 0x404154
call fcn.00401d30
add esp, 8
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
test edi, edi
pop edi
jne 0x4014d0
push str.PYTHON25.DLL
push 0x405100
push 0x404174
lea edx, [esp + 0x14]
push 0x304
push edx
call dword [sym.imp.MSVCR71.dll__snprintf]
lea eax, [esp + 0x1c]
push 0
push eax
call fcn.00401d30
add esp, 0x1c
test eax, eax
jne 0x4014d0
push str.LoadLibrary_pythondll__failed
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call section..text
lea ecx, [esp + 0x10]
push ecx
push 0
call section..text
add esp, 0x10
xor eax, eax
pop esi
add esp, 0x308
ret
mov eax, 1
pop esi
add esp, 0x308
ret

Function at 0x401510
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 0x304
push esi
mov esi, dword [esp + 0x30c]
push str.ZLIB.PYD
push 1
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x40157d
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40161b
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
push 0x40419c
call fcn.00402520
add esp, 8
test eax, eax
je 0x40161b
push 0x4041a8
push eax
call fcn.00402230
add esp, 8
test eax, eax
je 0x40161b
call eax
pop esi
add esp, 0x304
ret
push str.zlib.pyd
push 0x405100
push 0x4041cc
lea eax, [esp + 0x10]
push 0x304
push eax
call dword [sym.imp.MSVCR71.dll__snprintf]
add esp, 0x14
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x4015be
push str.initzlib
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x401573
push edi
push 0
mov eax, 0x404ac0
call fcn.00401320
mov esi, eax
add esp, 4
test esi, esi
mov edi, esi
je 0x40161a
push ebx
mov ebx, dword [sym.imp.MSVCR71.dll_strncmp]
push 0xb
push str._pythondll_
push esi
call ebx
add esp, 0xc
test eax, eax
jne 0x4015f5
mov edx, dword [esi + 0xb]
lea edi, [esi + edx + 0xf]
push 0xa
push str._zlib.pyd_
push edi
call ebx
add esp, 0xc
test eax, eax
pop ebx
jne 0x401613
add edi, 0xe
push edi
call fcn.004014e0
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
pop edi
pop esi
add esp, 0x304
ret
Function at 0x4018b0
Capabilities:
Compiled with py2exe
Query environment variable

Disassembly:
push edi
mov edi, dword [esp + 8]
push edi
call fcn.00401220
add esp, 4
test eax, eax
je 0x4018cf
push edi
call fcn.004013b0
add esp, 4
test eax, eax
jne 0x4018d6
mov eax, 0xff
pop edi
ret
mov eax, dword [0x40532c]
mov ecx, dword [eax + 8]
test ecx, ecx
push esi
je 0x401912
mov ecx, dword [sym.imp.MSVCR71.dll__iob]
mov esi, dword [sym.imp.MSVCR71.dll_setbuf]
push 0
push ecx
call esi
mov edx, dword [sym.imp.MSVCR71.dll__iob]
add edx, 0x20
push 0
push edx
call esi
mov eax, dword [sym.imp.MSVCR71.dll__iob]
add eax, 0x40
push 0
push eax
call esi
add esp, 0x18
mov esi, dword [sym.imp.MSVCR71.dll_getenv]
push 0x404248
call esi
add esp, 4
test eax, eax
je 0x401941
push str.PY2EXE_VERBOSE
call esi
push eax
call dword [sym.imp.MSVCR71.dll_atoi]
mov ecx, dword [0x40483c]
add esp, 8
mov dword [ecx], eax
jmp 0x40194d
mov edx, dword [0x40483c]
mov dword [edx], 0
mov eax, dword [0x404854]
mov dword [eax], 1
mov ecx, dword [0x404844]
mov dword [ecx], 1
mov edx, dword [0x40532c]
mov eax, dword [edx + 4]
mov ecx, dword [0x40484c]
push 0x404de0
mov dword [ecx], eax
call dword [0x4046e4]
add esp, 4
call fcn.00401630
call dword [0x404754]
test eax, eax
jne 0x4019a3
call fcn.004016c0
test eax, eax
jne 0x401a09
call dword [0x4046bc]
jmp 0x4019ac
call fcn.004017a0
test eax, eax
jne 0x401a09
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x4019d9
push 1
call dword [0x404834]
push eax
push 0x404268
call dword [0x4047d4]
add esp, 0xc
push edi
call fcn.00401510
add esp, 4
pop esi
xor eax, eax
pop edi
ret
push eax
call dword [0x4047e4]
mov esi, eax
add esp, 4
test esi, esi
je 0x4019fe
push esi
push 0x404270
call dword [0x4047d4]
push esi
call fcn.00401c10
add esp, 0xc
push edi
call fcn.00401510
add esp, 4
xor eax, eax
pop esi
pop edi
ret

Function at 0x401b60
Capabilities:
Query environment variable

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
push esi
push eax
push ecx
call dword [0x4047fc]
push 1
call dword [0x404864]
mov esi, eax
add esp, 0xc
test esi, esi
je 0x401bbf
call dword [0x4046d4]
push eax
call dword [0x4047e4]
add esp, 4
test eax, eax
je 0x401bb6
push eax
push 0
push esi
call dword [0x40486c]
add esp, 0xc
test eax, eax
jne 0x401bb6
push esi
push 0x404298
call dword [0x4047d4]
add esp, 8
push esi
call fcn.00401c10
add esp, 4
call fcn.00401a70
push 0x404278
mov esi, eax
call dword [sym.imp.MSVCR71.dll_getenv]
add esp, 4
test eax, eax
je 0x401c05
mov edx, dword [sym.imp.MSVCR71.dll__iob]
push 0x404288
push edx
call dword [0x4047ec]
add esp, 8
test eax, eax
je 0x401c05
mov eax, dword [sym.imp.MSVCR71.dll__iob]
push 0x404290
push eax
call dword [0x4047f4]
add esp, 8
call dword [0x4046cc]
mov eax, esi
pop esi
ret