joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002279d
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x14
mov eax, 0x1002dfd9
call fcn.1002b2c2
mov edi, dword [ebp + 0x10]
lea eax, [ebp - 0x14]
xor ebx, ebx
push eax
push ebx
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], ebx
push eax
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 0x14], ebx
push dword [ebp + 8]
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], ebx
mov dword [edi], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100228e2
cmp dword [ebp - 0x18], 1
jne 0x100228e2
mov eax, dword [ebp - 0x14]
xor ecx, ecx
shr eax, 1
inc eax
mov dword [ebp - 4], ebx
push 2
pop edx
mov dword [ebp - 0x14], eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1001cd9a
mov esi, eax
mov dword [ebp - 0x1c], esi
pop ecx
test esi, esi
je 0x100228e2
push dword [ebp - 0x14]
push ebx
push esi
call fcn.1001cd9a
mov eax, dword [ebp - 0x14]
add esp, 0xc
lea eax, [eax*2 - 2]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push esi
lea eax, [ebp - 0x18]
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100228d7
cmp dword [ebp - 0x18], 1
jne 0x100228d7
mov eax, dword [ebp - 0x14]
xor ecx, ecx
shr eax, 1
mov dword [ebp - 0x14], eax
inc eax
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1001cd9a
mov dword [edi], eax
pop ecx
test eax, eax
je 0x100228d7
mov ecx, dword [ebp - 0x14]
inc ecx
push ecx
push ebx
push eax
call fcn.1001cd9a
lea eax, [ebp - 0x20]
push eax
push 0x10033448
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcstok_s]
mov ebx, eax
add esp, 0x18
test ebx, ebx
je 0x100228bb
push ebx
call fcn.1001cd9a
pop ecx
test al, al
je 0x100228bb
mov eax, dword [ebp - 0x14]
push ebx
inc eax
push eax
push dword [edi]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
jmp 0x100228d7
push dword [edi]
call fcn.1002b561
and dword [edi], 0
pop ecx
jmp 0x100228d7
test esi, esi
je 0x100228e2
push esi
call fcn.1002b561
pop ecx
call fcn.1002b220
ret

Function at 0x10023089
Capabilities:
Print debug messages

Disassembly:
push esi
push 0x100331a4
xor esi, esi
call fcn.1001cd9a
pop ecx
test eax, eax
jne 0x100230aa
push 0x100331bc
call fcn.1001cd9a
pop ecx
test eax, eax
je 0x100230ad
xor esi, esi
inc esi
cmp byte [0x1003ce0b], 0
jne 0x100230bf
cmp byte [0x1003ce0a], 0
je 0x100230f5
push edi
push esi
push str._BrowserIntegrationWin__IsLoadedInProcByAcrobat__d
mov edi, 0x1003d650
push edi
call fcn.1001cd9a
add esp, 0xc
cmp byte [0x1003ce0a], 0
je 0x100230e4
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003ce0b], 0
je 0x100230f4
push edi
call fcn.10005ee0
pop ecx
pop edi
mov eax, esi
pop esi
ret
Function at 0x1002549d
Capabilities:
Print debug messages

Disassembly:
push esi
push str.sftldr.dll
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
test eax, eax
jne 0x1002551b
push str.sftldr_wow64.dll
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
test eax, eax
jne 0x1002551b
push ebx
push str.AppVEntSubsystems32.dll
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
test eax, eax
setne bl
cmp byte [0x1003ce0b], 0
jne 0x100254df
cmp byte [0x1003ce0a], 0
je 0x10025516
movzx eax, bl
mov esi, 0x1003e1b8
push eax
push str._ACTWinBrowser__IsRunningInAppV_isAppV5___d
push esi
call fcn.1001cd9a
add esp, 0xc
cmp byte [0x1003ce0a], 0
je 0x10025506
push esi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003ce0b], 0
je 0x10025516
push esi
call fcn.10005ee0
pop ecx
mov al, bl
pop ebx
pop esi
ret
cmp byte [0x1003ce0b], 0
jne 0x1002552d
cmp byte [0x1003ce0a], 0
je 0x1002555f
push str._ACTWinBrowser__IsRunningInAppV_isAppV4OrEarlier
mov esi, 0x1003e1b8
push esi
call fcn.1001cd9a
cmp byte [0x1003ce0a], 0
pop ecx
pop ecx
je 0x1002554f
push esi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003ce0b], 0
je 0x1002555f
push esi
call fcn.10005ee0
pop ecx
mov al, 1
pop esi
ret
Function at 0x10028ddc
Capabilities:
Print debug messages

Disassembly:
push esi
push 8
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov esi, eax
pop ecx
test esi, esi
je 0x10028df9
push 8
push 0
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
cmp byte [0x1003ce0b], 0
jne 0x10028e0f
cmp byte [0x1003ce0a], 0
je 0x10028f4e
push edi
push 0x64
push str.sizeof__t_ASMBlock____d
mov edi, 0x1003e608
push edi
call fcn.1001cd9a
add esp, 0xc
cmp byte [0x1003ce0a], 0
je 0x10028e35
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003ce0b], 0
je 0x10028e4e
push edi
call fcn.10005ee0
cmp byte [0x1003ce0b], 0
pop ecx
jne 0x10028e57
cmp byte [0x1003ce0a], 0
je 0x10028e77
push 4
push str.sizeof_Uns32____d
push edi
call fcn.1001cd9a
add esp, 0xc
cmp byte [0x1003ce0a], 0
je 0x10028e77
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003ce0b], 0
je 0x10028e90
push edi
call fcn.10005ee0
cmp byte [0x1003ce0b], 0
pop ecx
jne 0x10028e99
cmp byte [0x1003ce0a], 0
je 0x10028eb9
push 4
push str.sizeof_HANDLE____d
push edi
call fcn.1001cd9a
add esp, 0xc
cmp byte [0x1003ce0a], 0
je 0x10028eb9
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003ce0b], 0
je 0x10028ed2
push edi
call fcn.10005ee0
cmp byte [0x1003ce0b], 0
pop ecx
jne 0x10028edb
cmp byte [0x1003ce0a], 0
je 0x10028efb
push 4
push str.sizeof_Handle32____d
push edi
call fcn.1001cd9a
add esp, 0xc
cmp byte [0x1003ce0a], 0
je 0x10028efb
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003ce0b], 0
je 0x10028f14
push edi
call fcn.10005ee0
cmp byte [0x1003ce0b], 0
pop ecx
jne 0x10028f1d
cmp byte [0x1003ce0a], 0
je 0x10028f3d
push 4
push str.sizeof_void____d
push edi
call fcn.1001cd9a
add esp, 0xc
cmp byte [0x1003ce0a], 0
je 0x10028f3d
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003ce0b], 0
je 0x10028f4d
push edi
call fcn.10005ee0
pop ecx
pop edi
mov eax, esi
pop esi
ret

Function at 0x10028f6b
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x10028fda
cmp byte [0x1003ce0b], 0
jne 0x10028f88
cmp byte [0x1003ce0a], 0
je 0x10028fc1
push edi
lea eax, [esi + 4]
mov edi, 0x1003e608
push eax
push str.ASM_LocalFree__s
push edi
call fcn.1001cd9a
add esp, 0xc
cmp byte [0x1003ce0a], 0
je 0x10028fb0
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003ce0b], 0
je 0x10028fc0
push edi
call fcn.10005ee0
pop ecx
pop edi
push esi
call fcn.10028fdd
push esi
push dword [esi + 0x50]
call fcn.1001cd9a
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 0x10
pop esi
pop ebp
ret
Function at 0x10028fdd
Capabilities:
Print debug messages

Disassembly:
push 0x1c
mov eax, 0x1002e2c3
call fcn.1002b28b
cmp byte [0x1003ce0b], 0
mov ebx, 0x1003e608
mov edi, dword [ebp + 8]
jne 0x10029008
mov al, byte [0x1003ce0a]
test al, al
jne 0x10029008
lea esi, [edi + 4]
jmp 0x1002901f
lea esi, [edi + 4]
push esi
push str.ASM_Release__s
push ebx
call fcn.1001cd9a
mov al, byte [0x1003ce0a]
add esp, 0xc
test al, al
je 0x1002902a
push ebx
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003ce0b], 0
je 0x1002903a
push ebx
call fcn.10005ee0
pop ecx
push esi
lea ecx, [ebp - 0x28]
call fcn.1001cd9a
push dword [edi + 0x48]
and dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
call fcn.100028bc
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x1002906d
mov ecx, dword [ebx]
push 1
mov esi, dword [ecx]
mov ecx, esi
call dword [0x1002f5c8]
mov ecx, ebx
call esi
lea ecx, [ebp - 0x28]
call fcn.10003172
and dword [edi + 0x4c], 0
and dword [edi + 0x44], 0
call fcn.1002b235
ret
Function at 0x10029083
Capabilities:
Print debug messages

Disassembly:
push 0x24
mov eax, 0x1002e2f7
call fcn.1002b28b
cmp byte [0x1003ce0b], 0
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], esi
jne 0x100290b0
cmp byte [0x1003ce0a], 0
je 0x100290ff
call fcn.1001cd9a
test al, al
mov edx, 0x1002fbdc
mov ecx, str._in_AppContaner
cmove ecx, edx
push ecx
push str.ASM_Retrieve_retrieving_shared_memory_in_Plug_in_s
push 0x1003e608
call fcn.1001cd9a
add esp, 0xc
cmp byte [0x1003ce0a], 0
je 0x100290eb
push 0x1003e608
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003ce0b], 0
je 0x100290ff
push 0x1003e608
call fcn.10005ee0
pop ecx
and dword [esi], 0
lea eax, [edi + 4]
and dword [ebx], 0
lea ecx, [ebp - 0x28]
push eax
call fcn.1001cd9a
push dword [edi + 0x48]
and dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
call fcn.100028bc
or dword [ebp - 4], 0xffffffff
mov ebx, eax
pop ecx
pop ecx
lea ecx, [ebp - 0x28]
call fcn.10003172
test ebx, ebx
jne 0x1002917d
cmp byte [0x1003ce0b], bl
jne 0x10029149
cmp byte [0x1003ce0a], bl
je 0x100291f1
push str.ASM_Retrieve_ERROR__finding_memory_mapped_file_
mov ebx, 0x1003e608
push ebx
call fcn.1001cd9a
cmp byte [0x1003ce0a], 0
pop ecx
pop ecx
je 0x1002916b
push ebx
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003ce0b], 0
je 0x100291f1
push ebx
call fcn.10005ee0
pop ecx
jmp 0x100291f1
mov eax, dword [ebx]
mov esi, dword [eax + 0x20]
mov ecx, esi
call dword [0x1002f5c8]
mov ecx, ebx
call esi
mov dword [edi + 0x44], eax
test eax, eax
jne 0x100291ac
cmp byte [0x1003ce0b], al
jne 0x100291a5
cmp byte [0x1003ce0a], al
je 0x100291f1
push str.ASM_Retrieve_ERROR__getting_memory_mapped_file_handle_
jmp 0x1002914e
mov eax, dword [ebx]
push dword [edi + 0x48]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x1002f5c8]
mov ecx, ebx
call esi
mov dword [edi + 0x4c], eax
test eax, eax
jne 0x100291e1
cmp byte [0x1003ce0b], al
jne 0x100291d7
cmp byte [0x1003ce0a], al
je 0x100291f1
push str.ASM_Retrieve_ERROR__mapping_for_writing_
jmp 0x1002914e
mov ecx, dword [ebp - 0x2c]
mov eax, dword [edi + 0x48]
mov dword [ecx], eax
mov ecx, dword [ebp - 0x30]
mov eax, dword [edi + 0x4c]
mov dword [ecx], eax
call fcn.1002b235
ret
Function at 0x401a0c
Capabilities:
Create process on windows
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
xor edx, edx
push ebp
push 0x401ac2
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x4525c8
call sub.KERNEL32.DLL_WinExec
cmp byte [0x452049], 0
je 0x401a3a
push 0x4525c8
call sub.KERNEL32.DLL_WriteFile
mov eax, 0x4525e8
call fcn.004013d0
mov eax, 0x4525f8
call fcn.004013d0
mov eax, 0x452624
call fcn.004013d0
push 0xff8
push 0
call sub.KERNEL32.DLL_SizeofResource
mov dword [0x452620], eax
cmp dword [0x452620], 0
je 0x401aa1
mov eax, 3
mov edx, dword [0x452620]
xor ecx, ecx
mov dword [edx + eax*4 - 0xc], ecx
inc eax
cmp eax, 0x401
jne 0x401a77
mov eax, 0x452608
mov dword [eax + 4], eax
mov dword [eax], eax
mov dword [0x452614], eax
mov byte [0x4525c0], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x401ac9
cmp byte [0x452049], 0
je 0x401ac1
push 0x4525c8
call sub.KERNEL32.DLL_lstrcpyA
ret

Function at 0x401ad0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
cmp byte [0x4525c0], 0
je 0x401bad
xor edx, edx
push ebp
push 0x401ba6
push dword fs:[edx]
mov dword fs:[edx], esp
cmp byte [0x452049], 0
je 0x401b02
push 0x4525c8
call sub.KERNEL32.DLL_WriteFile
mov byte [0x4525c0], 0
mov eax, dword [0x452620]
push eax
call sub.KERNEL32.DLL_VirtualAlloc
xor eax, eax
mov dword [0x452620], eax
mov ebx, dword [0x4525e8]
jmp 0x401b35
push 0x8000
push 0
mov eax, dword [ebx + 8]
push eax
call sub.KERNEL32.DLL_WaitForSingleObject
mov ebx, dword [ebx]
cmp ebx, 0x4525e8
jne 0x401b23
mov eax, 0x4525e8
call fcn.004013d0
mov eax, 0x4525f8
call fcn.004013d0
mov eax, 0x452624
call fcn.004013d0
mov eax, dword [0x4525e0]
test eax, eax
je 0x401b7b
mov edx, dword [eax]
mov dword [0x4525e0], edx
push eax
call sub.KERNEL32.DLL_VirtualAlloc
mov eax, dword [0x4525e0]
test eax, eax
jne 0x401b64
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x401bad
cmp byte [0x452049], 0
je 0x401b9b
push 0x4525c8
call sub.KERNEL32.DLL_lstrcpyA
push 0x4525c8
call sub.KERNEL32.DLL_Sleep
ret
pop ebx
pop ebp
ret
Function at 0x4020f8
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, eax
cmp byte [0x4525c0], 0
jne 0x402115
call fcn.00401a0c
test al, al
je 0x40211d
cmp ebx, 0x7ffffff8
jle 0x402127
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x40227b
xor ecx, ecx
push ebp
push 0x402274
push dword fs:[ecx]
mov dword fs:[ecx], esp
cmp byte [0x452049], 0
je 0x402148
push 0x4525c8
call sub.KERNEL32.DLL_WriteFile
add ebx, 7
and ebx, 0xfffffffc
cmp ebx, 0xc
jge 0x402158
mov ebx, 0xc
cmp ebx, 0x1000
jg 0x4021f7
mov eax, ebx
test eax, eax
jns 0x40216d
add eax, 3
sar eax, 2
mov edx, dword [0x452620]
mov edx, dword [edx + eax*4 - 0xc]
test edx, edx
je 0x4021f7
mov esi, edx
mov eax, esi
add eax, ebx
and dword [eax], 0xfffffffe
mov eax, dword [edx + 4]
cmp edx, eax
jne 0x4021a8
mov eax, ebx
test eax, eax
jns 0x402197
add eax, 3
sar eax, 2
mov ecx, dword [0x452620]
xor edi, edi
mov dword [ecx + eax*4 - 0xc], edi
jmp 0x4021ce
mov ecx, ebx
test ecx, ecx
jns 0x4021b1
add ecx, 3
sar ecx, 2
mov edi, dword [0x452620]
mov dword [edi + ecx*4 - 0xc], eax
mov ecx, dword [edx]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
mov dword [ecx + 4], eax
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
mov eax, esi
mov edx, dword [edx + 8]
or edx, 2
mov dword [eax], edx
add eax, 4
mov dword [ebp - 4], eax
inc dword [0x4525b0]
sub ebx, 4
add dword [0x4525b4], ebx
call fcn.0040394c
jmp 0x40227b
cmp ebx, dword [0x452618]
jg 0x402249
sub dword [0x452618], ebx
cmp dword [0x452618], 0xc
jge 0x40221b
add ebx, dword [0x452618]
xor eax, eax
mov dword [0x452618], eax
mov eax, dword [0x45261c]
add dword [0x45261c], ebx
mov edx, ebx
or edx, 2
mov dword [eax], edx
add eax, 4
mov dword [ebp - 4], eax
inc dword [0x4525b0]
sub ebx, 4
add dword [0x4525b4], ebx
call fcn.0040394c
jmp 0x40227b
mov eax, ebx
call fcn.00402004
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40227b
cmp byte [0x452049], 0
je 0x402273
push 0x4525c8
call sub.KERNEL32.DLL_lstrcpyA
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x402288
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
mov dword [0x4525c4], eax
cmp byte [0x4525c0], 0
jne 0x4022c0
call fcn.00401a0c
test al, al
jne 0x4022c0
mov dword [0x4525c4], 8
mov dword [ebp - 4], 8
jmp 0x402421
xor ecx, ecx
push ebp
push 0x40241a
push dword fs:[ecx]
mov dword fs:[ecx], esp
cmp byte [0x452049], 0
je 0x4022e1
push 0x4525c8
call sub.KERNEL32.DLL_WriteFile
mov esi, ebx
sub esi, 4
mov ebx, dword [esi]
test bl, 2
jne 0x4022fc
mov dword [0x4525c4], 9
jmp 0x4023f1
dec dword [0x4525b0]
mov eax, ebx
and eax, 0x7ffffffc
sub eax, 4
sub dword [0x4525b4], eax
test bl, 1
je 0x40235c
mov eax, esi
sub eax, 0xc
mov edx, dword [eax + 8]
cmp edx, 0xc
jl 0x40232c
test edx, 0x80000003
je 0x40233b
mov dword [0x4525c4], 0xa
jmp 0x4023f1
mov eax, esi
sub eax, edx
cmp edx, dword [eax + 8]
je 0x402353
mov dword [0x4525c4], 0xa
jmp 0x4023f1
add ebx, edx
mov esi, eax
call fcn.00401bb0
and ebx, 0x7ffffffc
mov eax, esi
add eax, ebx
mov edi, eax
cmp edi, dword [0x45261c]
jne 0x40239c
sub dword [0x45261c], ebx
add dword [0x452618], ebx
cmp dword [0x452618], 0x3c00
jle 0x40238d
call fcn.00401ea0
xor eax, eax
mov dword [ebp - 4], eax
call fcn.0040394c
jmp 0x402421
mov edx, dword [eax]
test dl, 2
je 0x4023bf
and edx, 0x7ffffffc
cmp edx, 4
jge 0x4023ba
mov dword [0x4525c4], 0xb
jmp 0x4023f1
or dword [eax], 1
jmp 0x4023e8
mov eax, edi
cmp dword [eax + 4], 0
je 0x4023d2
cmp dword [eax], 0
je 0x4023d2
cmp dword [eax + 8], 0xc
jge 0x4023de
mov dword [0x4525c4], 0xb
jmp 0x4023f1
mov edx, dword [eax + 8]
add ebx, edx
call fcn.00401bb0
mov edx, ebx
mov eax, esi
call fcn.00401e18
mov eax, dword [0x4525c4]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402421
cmp byte [0x452049], 0
je 0x402419
push 0x4525c8
call sub.KERNEL32.DLL_lstrcpyA
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x402b4c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x450008], 0x8088405
inc edx
mov dword [ebx + 0x450008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x40451c
Capabilities:
Hide graphical window

Disassembly:
test eax, eax
je 0x404530
push eax
push 0
call sub.user32.dll_ShowWindow
test eax, eax
je 0x404514
ret

Function at 0x404e58
Capabilities:
Read file on windows

Disassembly:
add esp, 0xffffffe4
push 0x1c
lea edx, [esp + 4]
push edx
push eax
call sub.KERNEL32.DLL_ReadFile
cmp dword [esp + 0x10], 0x1000
jne 0x404e78
mov eax, dword [esp + 4]
jmp 0x404e7a
xor eax, eax
add esp, 0x1c
ret
Function at 0x404f0c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdb0
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
push 0x4050a0
call sub.KERNEL32.DLL_GlobalHandle
mov esi, eax
test esi, esi
je 0x404f74
push 0x4050b0
push esi
call sub.KERNEL32.DLL_GlobalReAlloc
mov ebx, eax
test ebx, ebx
je 0x404f74
push 0x105
lea eax, [ebp - 0x24f]
push eax
mov eax, dword [ebp - 4]
push eax
call ebx
test eax, eax
je 0x404f74
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0x24f]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_LoadLibraryA
jmp 0x405096
mov eax, dword [ebp - 4]
cmp byte [eax], 0x5c
jne 0x404fb4
mov eax, dword [ebp - 4]
cmp byte [eax + 1], 0x5c
jne 0x405096
mov eax, dword [ebp - 4]
add eax, 2
call fcn.00404ef8
mov esi, eax
cmp byte [esi], 0
je 0x405096
lea eax, [esi + 1]
call fcn.00404ef8
mov esi, eax
cmp byte [esi], 0
je 0x405096
jmp 0x404fba
mov esi, dword [ebp - 4]
add esi, 2
mov ebx, esi
sub ebx, dword [ebp - 4]
lea eax, [ebx + 1]
push eax
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x24f]
push eax
call sub.KERNEL32.DLL_LoadLibraryA
jmp 0x405079
lea eax, [esi + 1]
call fcn.00404ef8
mov edi, eax
mov eax, edi
sub eax, esi
mov edx, eax
add edx, ebx
inc edx
cmp edx, 0x105
jg 0x405096
inc eax
push eax
push esi
lea eax, [ebp - 0x24f]
add eax, ebx
push eax
call sub.KERNEL32.DLL_LoadLibraryA
lea eax, [ebp - 0x14a]
push eax
lea eax, [ebp - 0x24f]
push eax
call sub.KERNEL32.DLL_GlobalAlloc
mov esi, eax
cmp esi, 0xffffffff
je 0x405096
push esi
call sub.KERNEL32.DLL_GlobalAddAtomA
lea eax, [ebp - 0x11e]
push eax
call sub.KERNEL32.DLL_LoadResource
lea edx, [ebx + 1]
add eax, edx
inc eax
cmp eax, 0x105
jg 0x405096
mov byte [ebp + ebx - 0x24f], 0x5c
mov eax, 0x105
sub eax, ebx
dec eax
push eax
lea eax, [ebp - 0x11e]
push eax
lea eax, [ebp - 0x24f]
add eax, ebx
inc eax
push eax
call sub.KERNEL32.DLL_LoadLibraryA
lea eax, [ebp - 0x11e]
push eax
call sub.KERNEL32.DLL_LoadResource
inc eax
add ebx, eax
mov esi, edi
cmp byte [esi], 0
jne 0x404fd8
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0x24f]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_LoadLibraryA
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4050c4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.KERNEL32.DLL_GlobalLock
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4052f4
push 0x80000001
call sub.user32.dll_UnhookWindowsHookEx
test eax, eax
je 0x405147
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4052f4
push 0x80000002
call sub.user32.dll_UnhookWindowsHookEx
test eax, eax
je 0x405147
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405310
push 0x80000001
call sub.user32.dll_UnhookWindowsHookEx
test eax, eax
jne 0x4051d0
xor eax, eax
push ebp
push 0x4051c9
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00404f0c
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_UnregisterClassA
test eax, eax
je 0x4051ae
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x405330
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_UnregisterClassA
test eax, eax
je 0x4051ae
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4051d0
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_TranslateMessage
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.KERNEL32.DLL_InitializeCriticalSection
push eax
call sub.KERNEL32.DLL_GlobalFree
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x4052ea
cmp byte [ebp - 0xd], 0
jne 0x405217
cmp byte [ebp - 0x12], 0
je 0x4052ea
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadResource
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x405230
dec ebx
cmp byte [ebx], 0x2e
je 0x40523f
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x40522f
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x4052ea
inc ebx
cmp byte [ebp - 0x12], 0
je 0x40527c
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.KERNEL32.DLL_LoadLibraryA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LeaveCriticalSection
mov esi, eax
test esi, esi
jne 0x4052ea
cmp byte [ebp - 0xd], 0
je 0x4052ea
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_LoadLibraryA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LeaveCriticalSection
mov esi, eax
test esi, esi
jne 0x4052ea
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_LoadLibraryA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LeaveCriticalSection
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret