joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406291
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4261d0]
jne 0x40629b
repz ret
jmp fcn.0040871c

Function at 0x40adfc
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4261d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004074b2
and dword [ebp - 0x14], 0
cmp dword [0x427a30], 0
mov dword [ebp - 0x18], eax
jne 0x40aeaf
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40af57
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x40af57
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x427a30], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x427a34], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x427a38], eax
call edi
push eax
call esi
mov dword [0x427a40], eax
test eax, eax
je 0x40aeaf
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x427a3c], eax
mov eax, dword [0x427a3c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40af08
cmp dword [0x427a40], ecx
je 0x40af08
push eax
call esi
push dword [0x427a40]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40af08
test ebx, ebx
je 0x40af08
call edi
test eax, eax
je 0x40aeff
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40aeff
test byte [ebp - 8], 1
jne 0x40af08
or dword [ebp + 0x10], 0x200000
jmp 0x40af3b
mov eax, dword [0x427a34]
cmp eax, dword [ebp - 0x18]
je 0x40af3b
push eax
call esi
test eax, eax
je 0x40af3b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40af3b
mov eax, dword [0x427a38]
cmp eax, dword [ebp - 0x18]
je 0x40af3b
push eax
call esi
test eax, eax
je 0x40af3b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x427a30]
call esi
test eax, eax
je 0x40af57
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40af59
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00406291
leave
ret

Function at 0x414ac0
Capabilities:
Encode data using xor

Disassembly:
test eax, 0xf91d0e4a
adc edi, dword [edx - 0x7c3d0366]
or ebp, dword [esi]
test ebx, ebp
mov cl, 0xa
sub edx, dword [ecx - 0x44c3fde2]
xchg ecx, eax
push ds
add bh, byte [ebx + edi*4]
xor ebx, dword [eax + 5]
adc eax, 0x1bc34524
popfd
cld
jns 0x414ad2
sub edi, dword [edx - 0x6314ac3d]
sub bl, 0x33
lodsb al, byte [esi]
cmp al, 0x14
and al, 0x14
cwde
adc al, 0x24
add edi, dword [ebx - 5]
mov ebx, 0xa03c3bd
jp 0x414b3a
adc al, 0x12
aas
ret
pop edi
mov bl, 0xfc
mov bl, 0xaa
fstp xword [ebp + 0x29]
ljmp 0xf837
Function at 0x401000
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
mov eax, dword [0x41c063]
shl eax, 2
mov dword [0x41c067], eax
push edi
push ecx
xor eax, eax
mov edi, 0x420b70
mov ecx, 0x42460c
cmp ecx, edi
jbe 0x401024
sub ecx, edi
cld
rep stosb byte es:[edi], al
pop ecx
pop edi
push 0
call fcn.00402b02
pop ecx
push 0x41c02c
push 0
call sub.Kernel32.dll_GetModuleHandleA
mov dword [0x41c06b], eax
push 0
jmp fcn.0040a6b8

Function at 0x401e16
Capabilities:
Encode data using xor
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
xor edx, edx
mov dword [ebx], edx
test eax, eax
je 0x401ee1
push 0xa
movzx eax, ax
push eax
push dword [0x41c06b]
call sub.Kernel32.dll_FindResourceA
mov esi, eax
test esi, esi
je 0x401ee1
push esi
push dword [0x41c06b]
call sub.Kernel32.dll_SizeofResource
mov edi, eax
push esi
push dword [0x41c06b]
call sub.Kernel32.dll_LoadResource
mov esi, eax
test esi, esi
je 0x401ee1
push esi
call sub.Kernel32.dll_LockResource
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x401ee1
push edi
push 2
call sub.Kernel32.dll_GlobalAlloc
mov dword [ebp - 8], eax
mov edx, dword [ebp - 8]
test edx, edx
je 0x401ee1
push dword [ebp - 8]
call sub.Kernel32.dll_GlobalLock
mov dword [ebp - 0xc], eax
push edi
push dword [ebp - 4]
push dword [ebp - 0xc]
call fcn.00403c6c
add esp, 0xc
push esi
call sub.Kernel32.dll_FreeResource
mov cl, byte [ebp + 0xc]
test cl, cl
je 0x401ed6
push 0x26071967
call fcn.004092b0
pop ecx
xor esi, esi
cmp edi, esi
jbe 0x401ed6
call fcn.004092cc
mov edx, dword [ebp - 0xc]
xor byte [edx + esi], al
inc esi
cmp edi, esi
ja 0x401ec6
push ebx
push 1
push dword [ebp - 8]
call sub.Ole32.dll_CreateStreamOnHGlobal
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x403a34
Capabilities:
Get memory capacity

Disassembly:
add esp, 0xffffffe0
mov dword [esp], 0x20
push esp
call sub.Kernel32.dll_GlobalMemoryStatus
mov eax, dword [esp + 0xc]
add esp, 0x20
ret
Function at 0x4086e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
call fcn.00408110
test byte [ebp + 0xd], 0xc0
jne 0x408704
mov eax, dword [0x41d9c8]
mov edx, dword [eax]
and edx, 0xc000
or dword [ebp + 0xc], edx
test byte [ebp + 0xd], 0x80
jne 0x408711
or dword [ebp + 0xc], 0x4000
mov ecx, dword [ebp + 0xc]
and ecx, 0x700
cmp ecx, 0x500
jg 0x40873e
je 0x408750
sub ecx, 0x100
je 0x40875e
sub ecx, 0x100
je 0x408765
sub ecx, 0x100
je 0x408757
jmp 0x40876c
sub ecx, 0x600
je 0x408765
sub ecx, 0x100
je 0x408750
jmp 0x40876c
mov edi, 1
jmp 0x408771
mov edi, 2
jmp 0x408771
mov edi, 4
jmp 0x408771
mov edi, 5
jmp 0x408771
mov edi, 3
test byte [ebp + 0xd], 1
je 0x408798
lea eax, [ebp + 0x10]
add eax, 4
mov eax, dword [eax - 4]
and eax, dword [0x41daa0]
test al, 0x80
je 0x408791
mov ebx, 0x80
jmp 0x4087aa
mov ebx, 1
jmp 0x4087aa
mov eax, dword [ebp + 8]
push eax
call sub.Kernel32.dll_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x4087aa
xor ebx, ebx
mov eax, dword [ebp + 0xc]
and eax, 3
sub eax, 1
jb 0x4087bc
je 0x4087c5
dec eax
je 0x4087ce
jmp 0x4087d7
mov dword [ebp - 4], 0x80000000
jmp 0x4087e6
mov dword [ebp - 4], 0x40000000
jmp 0x4087e6
mov dword [ebp - 4], 0xc0000000
jmp 0x4087e6
push 1
call fcn.004084d0
pop ecx
mov ebx, eax
jmp 0x4088d2
mov eax, dword [ebp + 0xc]
and eax, 0x70
sub eax, 0x10
je 0x408802
sub eax, 0x10
je 0x408809
sub eax, 0x10
je 0x408812
sub eax, 0x10
je 0x40881b
jmp 0x40881b
xor edx, edx
mov dword [ebp - 8], edx
jmp 0x408822
mov dword [ebp - 8], 1
jmp 0x408822
mov dword [ebp - 8], 2
jmp 0x408822
mov dword [ebp - 8], 3
mov dword [ebp - 0x14], 0xc
xor ecx, ecx
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x14]
mov eax, dword [ebp + 0xc]
and eax, 0x80
cmp eax, 1
sbb edx, edx
neg edx
mov dword [ebp - 0xc], edx
push 0
push ebx
push edi
push ecx
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp + 8]
push ecx
call sub.Kernel32.dll_CreateFileA
mov esi, eax
cmp eax, 0xffffffff
jne 0x40888b
call sub.Kernel32.dll_GetLastError
mov ebx, eax
and ebx, 0xffff
cmp ebx, 0x6e
jne 0x408880
test byte [ebp + 0xd], 1
mov ebx, 0x50
jne 0x408880
add ebx, 0xffffffb2
push ebx
call fcn.004084d0
pop ecx
mov ebx, eax
jmp 0x4088d2
mov edi, esi
push edi
call fcn.00408644
pop ecx
test eax, eax
je 0x40889f
or dword [ebp + 0xc], 0x2000
test bl, 1
jne 0x4088ab
or dword [ebp + 0xc], 0x100
and dword [ebp + 0xc], 0xfffff8ff
mov eax, dword [ebp + 0xc]
push eax
push edi
call fcn.00408210
add esp, 8
mov ebx, eax
inc eax
jne 0x4088d2
push 4
call fcn.004084d0
pop ecx
push esi
call sub.Kernel32.dll_CloseHandle
call fcn.00408144
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4099e8
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
cmp dword [0x41e028], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x409aa0
cmp byte [0x41c062], 0
je 0x409a5a
push 0x50
lea eax, [ebp - 0x54]
push eax
push 0
call sub.Kernel32.dll_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x54]
push edx
call fcn.00409524
add esp, 8
mov ebx, eax
test eax, eax
jne 0x409a43
push 0x3a
lea edx, [ebp - 0x54]
push edx
call fcn.00409524
add esp, 8
mov ebx, eax
test eax, eax
jne 0x409a43
lea ebx, [ebp - 0x54]
jmp 0x409a44
inc ebx
call fcn.004099a0
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.User32.dll_MessageBoxA
jmp 0x409ac1
push 0xfffffffffffffff4
call sub.Kernel32.dll_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x41e02c
push ebx
call sub.Kernel32.dll_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.00403e74
pop ecx
push eax
push esi
push ebx
call sub.Kernel32.dll_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x41e02f
push ebx
call sub.Kernel32.dll_WriteFile
jmp 0x409ac1
cmp dword [0x41e028], 0xffffffff
je 0x409ac1
mov eax, dword [0x41e028]
test eax, eax
je 0x409ac1
cmp byte [eax], 0
je 0x409ac1
push esi
push eax
call fcn.00409b50
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40a0ac
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x424058], 0
jne 0x40a12d
cmp dword [0x424074], 0
jne 0x40a0dc
call sub.Kernel32.dll_GetEnvironmentStrings
mov dword [0x424074], eax
test eax, eax
jne 0x40a0dc
push 0x41e14c
call fcn.00409ad8
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x424074]
jmp 0x40a0f0
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.00403e74
pop ecx
mov edi, eax
test eax, eax
jne 0x40a0e8
lea edi, [ebp + 1]
push edi
call fcn.0040305c
pop ecx
mov ebx, eax
mov dword [0x42405c], ebx
test ebx, ebx
jne 0x40a11a
xor eax, eax
jmp 0x40a1f0
push edi
mov edx, dword [0x424074]
push edx
push ebx
call fcn.00403c6c
add esp, 0xc
jmp 0x40a14d
xor esi, esi
mov ebx, dword [0x424058]
jmp 0x40a147
push eax
call fcn.00403e74
pop ecx
test eax, eax
jne 0x40a143
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x40a137
lea ebx, [esi + 4]
push 4
mov dword [0x424060], ebx
inc ebx
push ebx
call fcn.0040957c
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x40a170
xor eax, eax
jmp 0x40a1f0
cmp dword [0x424058], 0
jne 0x40a1a1
xor esi, esi
mov ebx, dword [0x42405c]
mov eax, dword [esp]
mov ebp, eax
jmp 0x40a192
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.00403e74
pop ecx
mov edi, eax
test eax, eax
jne 0x40a188
jmp 0x40a1d2
xor esi, esi
mov ebx, dword [0x424058]
mov eax, dword [esp]
mov edi, eax
jmp 0x40a1cc
push eax
call fcn.00403e74
pop ecx
test eax, eax
je 0x40a1c1
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x40a1c5
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x40a1b0
mov eax, dword [0x424058]
test eax, eax
je 0x40a1e2
push eax
call fcn.0040306c
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x424058], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x40b9ac
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0x1c]
mov esi, dword [ebp + 0xc]
cmp esi, 0x10
jge 0x40b9d2
test esi, esi
je 0x40b9d2
call fcn.00409974
mov dword [eax], 0x13
or eax, 0xffffffff
jmp 0x40ba3e
call fcn.0040b788
mov ebx, eax
test eax, eax
jne 0x40b9ed
call fcn.00409974
mov dword [eax], 8
or eax, 0xffffffff
jmp 0x40ba3e
mov edx, dword [ebp + 0x10]
lea eax, [ebp - 4]
mov dword [ebx + 4], edx
mov ecx, dword [ebp + 8]
mov dword [ebx + 0x14], ecx
push eax
mov edx, dword [ebp + 0x18]
push edx
push ebx
push 0x40b91c
push esi
mov ecx, dword [ebp + 0x14]
push ecx
call sub.Kernel32.dll_CreateThread
test eax, eax
jne 0x40ba32
call sub.Kernel32.dll_GetLastError
cmp eax, 0x718
jne 0x40ba2b
push 0x59
call fcn.004084d0
pop ecx
jmp 0x40ba3e
call fcn.0040853c
jmp 0x40ba3e
mov dword [ebx + 8], eax
test edi, edi
je 0x40ba3e
mov edx, dword [ebp - 4]
mov dword [edi], edx
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x40febf
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
xor eax, eax
xor edx, edx
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov dword [ebx], eax
mov eax, esi
and eax, 3
mov dword [ebx + 4], edx
test eax, eax
je 0x40fee9
mov edx, 4
sub edx, eax
add esi, edx
mov dword [ebx + 0x10], esi
push 0x40
push 0x1000
push esi
push 0
call sub.Kernel32.dll_VirtualAlloc
mov edi, eax
mov dword [ebx], edi
test edi, edi
je 0x40ff43
push 0x1c
lea eax, [ebp - 0x1c]
push eax
push edi
call sub.Kernel32.dll_VirtualQuery
mov ecx, dword [ebp - 0x10]
xor edx, edx
mov eax, ecx
mov dword [ebx + 8], ecx
div esi
mov edi, eax
mov esi, edi
mov dword [ebx + 0x14], edi
shr esi, 3
inc esi
mov dword [ebx + 0xc], esi
push esi
call fcn.00409610
pop ecx
mov edi, eax
mov dword [ebx + 4], edi
push dword [ebx + 0xc]
push 0
push edi
call fcn.00403cdc
add esp, 0xc
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x412b8e
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
cmp word [ebx + 0xc], 0xffff
je 0x412bfa
mov eax, dword [ebx + 0xc]
shr eax, 0x10
test ax, ax
je 0x412bb3
push dword [ebx + 0xc]
call fcn.004095b8
pop ecx
push dword [ebx + 8]
call sub.User32.dll_GetWindowTextLengthA
mov esi, eax
test esi, esi
jge 0x412bd5
push 0
push 0x41f064
call fcn.0041a268
add esp, 8
mov dword [ebx + 0xc], eax
jmp 0x412bfa
lea eax, [esi + 1]
push eax
call fcn.00409610
mov edi, eax
pop ecx
mov dword [ebx + 0xc], edi
lea edx, [esi + 1]
mov byte [edi], 0
mov byte [edi + esi], 0
push edx
mov eax, edi
push eax
push dword [ebx + 8]
call sub.User32.dll_GetWindowTextA
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x415841
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
mov eax, 0x41fbc0
push ebx
call fcn.00406454
mov word [ebp - 0x14], 8
push 0x41fc08
push 1
push 1
push dword [ebp + 8]
call fcn.00418b0c
inc dword [ebp - 8]
mov edx, dword [ebp + 8]
mov dword [edx], 0x41fdc0
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 8]
add ebx, 0x10
push eax
push 0x41fc1f
push ebx
call fcn.00418ff9
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 8]
add ebx, 0x14
push eax
push 0x41fc2c
push ebx
call fcn.00418ff9
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 8]
add ebx, 0x18
push eax
push 0x41fc39
push ebx
call fcn.00418ff9
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 8]
add ebx, 0x1c
push eax
push 0x41fc46
push ebx
call fcn.00418ff9
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 8]
add ebx, 0x20
push eax
push 0x41fc58
push ebx
call fcn.00418ff9
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 8]
add ebx, 0x24
push eax
push 0x41fc65
push ebx
call fcn.00418ff9
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 8]
add ebx, 0x28
push eax
push 0x41fc74
push ebx
call fcn.00418ff9
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 8]
add ebx, 0x2c
push eax
push 0x41fc87
push ebx
call fcn.00418ff9
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 8]
add ebx, 0x30
push eax
push 0x41fc99
push ebx
call fcn.00418ff9
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 8]
add ebx, 0x34
push eax
push 0x41fcad
push ebx
call fcn.00418ff9
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 8]
add ebx, 0x38
push eax
push 0x41fcbc
push ebx
call fcn.00418ff9
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 8]
add ebx, 0x3c
push eax
push 0x41fccb
push ebx
call fcn.00418ff9
mov eax, dword [ebp - 0x24]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x415984
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
mov eax, 0x41fbe4
push ebx
call fcn.00406454
mov word [ebp - 0x14], 8
push 0x41fc13
push 1
push 1
push dword [ebp + 8]
call fcn.00418b0c
inc dword [ebp - 8]
mov edx, dword [ebp + 8]
mov dword [edx], 0x41fdac
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 8]
add ebx, 0x10
push eax
push 0x41fcda
push ebx
call fcn.00418ff9
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 8]
add ebx, 0x14
push eax
push 0x41fce8
push ebx
call fcn.00418ff9
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 8]
add ebx, 0x18
push eax
push 0x41fcf8
push ebx
call fcn.00418ff9
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 8]
add ebx, 0x1c
push eax
push 0x41fd0a
push ebx
call fcn.00418ff9
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 8]
add ebx, 0x20
push eax
push 0x41fd1a
push ebx
call fcn.00418ff9
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 8]
add ebx, 0x24
push eax
push 0x41fd2b
push ebx
call fcn.00418ff9
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 8]
add ebx, 0x28
push eax
push 0x41fd3e
push ebx
call fcn.00418ff9
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 8]
add ebx, 0x2c
push eax
push 0x41fd4a
push ebx
call fcn.00418ff9
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 8]
add ebx, 0x30
push eax
push 0x41fd57
push ebx
call fcn.00418ff9
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 8]
add ebx, 0x34
push eax
push 0x41fd68
push ebx
call fcn.00418ff9
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 8]
add ebx, 0x38
push eax
push 0x41fd79
push ebx
call fcn.00418ff9
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 8]
add ebx, 0x3c
push eax
push 0x41fd8c
push ebx
call fcn.00418ff9
mov eax, dword [ebp - 0x24]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x418d7b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov eax, dword [ebp + 0x14]
mov esi, dword [ebp + 8]
shr eax, 4
inc eax
mov dword [ebp - 8], eax
mov edx, dword [ebp - 8]
mov dword [ebp - 0xc], edx
push 6
push dword [ebp - 0xc]
push dword [esi + 8]
call sub.Kernel32.dll_FindResourceA
mov edi, eax
test edi, edi
je 0x418e23
mov dword [ebp - 0x10], edi
push dword [ebp - 0x10]
push dword [esi + 8]
call sub.Kernel32.dll_LoadResource
mov dword [ebp - 4], eax
test eax, eax
je 0x418e23
push dword [ebp - 4]
call sub.Kernel32.dll_LockResource
mov edi, eax
test eax, eax
je 0x418e13
mov eax, dword [ebp + 0x14]
and eax, 0xf
jmp 0x418ddb
add ebx, ebx
add edi, ebx
mov bx, word [edi]
add edi, 2
movzx ebx, bx
mov edx, eax
add eax, 0xffffffff
test edx, edx
jne 0x418dd7
test ebx, ebx
je 0x418e13
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 0x10]
push ebx
push edi
push 0
push 0
call sub.Kernel32.dll_WideCharToMultiByte
mov ebx, eax
test ebx, ebx
jbe 0x418e13
mov eax, dword [ebp + 0x10]
mov byte [eax + ebx], 0
push dword [ebp - 4]
call sub.Kernel32.dll_FreeResource
test ebx, ebx
je 0x418e23
mov eax, ebx
jmp 0x418e4c
mov eax, dword [0x420694]
cmp esi, eax
je 0x418e3d
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
call fcn.00418d7b
jmp 0x418e4c
mov edx, dword [ebp + 0xc]
test edx, edx
je 0x418e4a
mov ecx, dword [ebp + 0x10]
mov byte [ecx], 0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x418e55
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
xor ebx, ebx
lea eax, [ebp - 0x10]
push eax
call fcn.0040acd0
pop ecx
mov edx, dword [ebp + 0xc]
shr edx, 4
inc edx
mov dword [ebp - 0x14], edx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], ecx
push 6
push dword [ebp - 0x18]
push dword [esi + 8]
call sub.Kernel32.dll_FindResourceA
mov dword [ebp - 4], eax
test eax, eax
je 0x418fa9
mov edx, dword [ebp - 4]
mov dword [ebp - 0x1c], edx
push dword [ebp - 0x1c]
push dword [esi + 8]
call sub.Kernel32.dll_LoadResource
mov dword [ebp - 8], eax
test eax, eax
je 0x418fa9
push dword [ebp - 8]
call sub.Kernel32.dll_LockResource
mov dword [ebp - 0xc], eax
test eax, eax
je 0x418f7c
mov eax, dword [ebp + 0xc]
and eax, 0xf
jmp 0x418ed4
add ebx, ebx
add dword [ebp - 0xc], ebx
mov edx, dword [ebp - 0xc]
add dword [ebp - 0xc], 2
movzx ebx, word [edx]
mov edx, eax
add eax, 0xffffffff
test edx, edx
jne 0x418ecf
test ebx, ebx
je 0x418f7c
push 0
push 0
push 0
push 0
push ebx
push dword [ebp - 0xc]
push 0
push 0
call sub.Kernel32.dll_WideCharToMultiByte
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
inc eax
push eax
call fcn.00409610
pop ecx
mov dword [ebp - 0x24], eax
push 0
push 0
mov ecx, dword [ebp - 0x20]
inc ecx
push ecx
push dword [ebp - 0x24]
push ebx
push dword [ebp - 0xc]
push 0
push 0
call sub.Kernel32.dll_WideCharToMultiByte
mov ebx, eax
push ebx
lea eax, [ebp - 0x10]
push eax
call fcn.0040b074
add esp, 8
xor edx, edx
mov dword [ebp - 0x28], edx
mov ecx, dword [ebp - 0x28]
cmp ebx, ecx
jbe 0x418f73
mov eax, dword [ebp - 0x28]
lea edx, [ebp - 0x10]
mov dword [ebp - 0x2c], eax
push dword [ebp - 0x2c]
push edx
call fcn.0040aff8
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
add esp, 8
mov cl, byte [ecx + edx]
mov byte [eax], cl
inc dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
cmp ebx, eax
ja 0x418f49
push dword [ebp - 0x24]
call fcn.004095b8
pop ecx
push dword [ebp - 8]
call sub.Kernel32.dll_FreeResource
test ebx, ebx
je 0x418fa9
lea eax, [ebp - 0x10]
push eax
push edi
call fcn.0040ad3c
add esp, 8
mov eax, edi
push eax
push 2
lea edx, [ebp - 0x10]
push edx
call fcn.0040b0c4
add esp, 8
pop eax
jmp 0x418ff0
mov ebx, dword [0x420694]
cmp esi, ebx
je 0x418fd1
push edi
push dword [ebp + 0xc]
push ebx
call fcn.00418e55
mov eax, edi
lea edx, [ebp - 0x10]
push eax
push 2
push edx
call fcn.0040b0c4
add esp, 8
pop eax
jmp 0x418ff0
lea edx, [ebp - 0x10]
push edx
push edi
call fcn.0040ad3c
add esp, 8
mov eax, edi
push eax
push 2
lea edx, [ebp - 0x10]
push edx
call fcn.0040b0c4
add esp, 8
pop eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x41a868
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
push dword [ebp + 0xc]
push ebx
call fcn.00419b92
mov dword [ebx], 0x420944
xor eax, eax
mov dword [ebx + 0x18], eax
xor edx, edx
mov dword [ebx + 0x1c], edx
xor ecx, ecx
mov dword [ebx + 0x20], ecx
lea edi, [ebx + 0x24]
call fcn.0041a793
test eax, eax
je 0x41a8da
mov esi, edi
test edi, edi
je 0x41a8da
mov dword [esi], 0x41ecf0
mov dword [esi], 0x420934
xor eax, eax
mov dword [esi + 8], eax
push 0
push 0
push 0
call sub.Kernel32.dll_CreateMutexA
mov dword [esi + 4], eax
mov edx, dword [esi + 4]
test edx, edx
je 0x41a8da
call sub.Kernel32.dll_GetLastError
cmp eax, 0xb7
jne 0x41a8da
mov dword [esi + 8], 1
xor ecx, ecx
mov eax, ebx
mov dword [ebx + 0x54], ecx
pop edi
pop esi
pop ebx
pop ebp
ret 8