joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4055b0
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x42e178
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push esi
push edi
mov eax, dword [esp + 0x34]
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocStringLen
push eax
mov dword [esp + 0x44], 0
mov dword [esp + 0x34], 1
call esi
mov ecx, dword [esp + 0x30]
push 0
push 0x80
push 3
push 0
push 1
mov edi, eax
push SysReAllocStringLen
push ecx
mov dword [esp + 0x2c], edi
call esi
test edi, edi
mov dword [esp + 0x14], eax
je 0x405718
test eax, eax
je 0x405718
push ebx
push ebp
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
push esi
push 0x42
call edi
push esi
push 0x42
mov ebx, eax
call edi
mov edi, dword [sym.imp.KERNEL32.dll_GlobalLock]
push ebx
mov dword [esp + 0x14], eax
call edi
mov edx, dword [esp + 0x10]
mov ebp, eax
push edx
call edi
test ebx, ebx
mov dword [esp + 0x14], eax
je 0x4056d0
test ebp, ebp
je 0x4056db
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x4056d0
test eax, eax
je 0x4056d0
mov ecx, dword [esp + 0x18]
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
lea eax, [esp + 0x24]
push 0
push eax
push esi
push ebp
push ecx
call edi
test eax, eax
je 0x4056d0
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x24]
push 0
push edx
push esi
push eax
push ecx
call edi
test eax, eax
je 0x4056d0
xor edi, edi
test esi, esi
jbe 0x4056d0
mov ecx, dword [esp + 0x14]
mov eax, ebp
sub ecx, ebp
mov dl, byte [eax]
cmp dl, byte [ecx + eax]
jne 0x4056c8
inc edi
inc eax
cmp edi, esi
jb 0x4056b9
jmp 0x4056d0
mov dword [esp + 0x20], 0
test ebp, ebp
je 0x4056db
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov esi, dword [sym.imp.KERNEL32.dll_GlobalFree]
test ebx, ebx
je 0x4056e8
push ebx
call esi
mov eax, dword [esp + 0x14]
mov edi, dword [esp + 0x10]
pop ebp
pop ebx
test eax, eax
je 0x4056fd
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
test edi, edi
je 0x405704
push edi
call esi
mov eax, dword [esp + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov ecx, dword [esp + 0x14]
push ecx
call esi
lea ecx, [esp + 0x30]
call fcn.004255c2
lea ecx, [esp + 0x34]
mov dword [esp + 0x28], 0xffffffff
call fcn.004255c2
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x24
ret 8
Function at 0x405850
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0xffffffffffffffff
push 0x42e1a0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebp
push esi
push edi
mov dword [esp + 0x24], 0
xor ebp, ebp
call fcn.0042acfa
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
mov eax, dword [eax + 8]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x405906
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x405906
lea ecx, [esp + 0xc]
call fcn.00426a7f
mov eax, dword [esp + 0x2c]
push ebp
push 0x1001
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x30], 1
call fcn.00426b91
test eax, eax
je 0x4058f8
call fcn.0042acfa
mov eax, dword [eax + 0xc]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
push edi
lea ecx, [esp + 0x14]
call fcn.00426ce8
lea ecx, [esp + 0xc]
call fcn.00426dac
mov ebp, 1
lea ecx, [esp + 0xc]
mov byte [esp + 0x24], 0
call fcn.00426ad4
lea ecx, [esp + 0x2c]
mov dword [esp + 0x24], 0xffffffff
call fcn.004255c2
mov ecx, dword [esp + 0x1c]
pop edi
mov eax, ebp
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x1c
ret 0xc

Function at 0x405d20
Capabilities:
Get file system object information

Disassembly:
sub esp, 0x170
push ebx
push esi
push edi
push 0x4001
lea eax, [esp + 0x20]
push 0x160
push eax
push 0
mov esi, ecx
push 0x43c820
mov dword [esp + 0x20], 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, eax
test ebx, ebx
je 0x405d7a
mov ecx, dword [esi + 0xb4]
push ebx
push 0
push 0x1109
push ecx
call edi
mov edx, dword [esi + 0x78]
push ebx
push 1
push 0x1003
push edx
call edi
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.SHELL32.dll_SHGetDesktopFolder]
test eax, eax
jl 0x405dbf
mov ecx, dword [esi + 0xb4]
push 0xffff0000
push 0
push 0x1101
push ecx
call edi
mov edx, dword [esp + 0xc]
push 0xffff0000
push 0
push edx
lea ecx, [esi + 0x98]
call fcn.004012a0
mov eax, dword [esp + 0xc]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esi + 0xb4]
lea edx, [esp + 0x10]
push edx
push 0
push 0x1115
push eax
mov dword [esp + 0x20], 0xffff0000
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0x401500
call edi
mov ecx, dword [esp + 0x180]
mov dword [esi + 0xd4], 0x406390
push ecx
lea ecx, [esi + 0x98]
mov dword [esi + 0xd8], 0x405e90
call fcn.00401060
pop edi
pop esi
pop ebx
add esp, 0x170
ret 4
Function at 0x406a40
Capabilities:
Get file system object information

Disassembly:
sub esp, 0x170
push esi
push edi
push 0x4001
lea eax, [esp + 0x1c]
push 0x160
push eax
push 0
mov esi, ecx
push 0x43c820
mov dword [esp + 0x1c], 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
test eax, eax
je 0x406a86
mov ecx, dword [esi + 0x78]
push eax
push 0
push 0x1109
push ecx
call edi
lea edx, [esp + 8]
push edx
call dword [sym.imp.SHELL32.dll_SHGetDesktopFolder]
test eax, eax
jl 0x406ac5
mov eax, dword [esi + 0x78]
push 0xffff0000
push 0
push 0x1101
push eax
call edi
mov ecx, dword [esp + 8]
push 0xffff0000
push 0
push ecx
lea ecx, [esi + 0x5c]
call fcn.004012a0
mov eax, dword [esp + 8]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov ecx, dword [esi + 0x78]
lea eax, [esp + 0xc]
push eax
push 0
push 0x1115
push ecx
mov dword [esp + 0x1c], 0xffff0000
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0x401500
call edi
mov edx, dword [esp + 0x17c]
lea ecx, [esi + 0x5c]
push edx
mov dword [esi + 0x98], 0x406b20
call fcn.00401060
pop edi
pop esi
add esp, 0x170
ret 4

Function at 0x4079c0
Capabilities:
Get file system object information

Disassembly:
sub esp, 0x170
push ebx
push esi
push edi
push 0x4001
lea eax, [esp + 0x20]
push 0x160
push eax
push 0
mov esi, ecx
push 0x43c820
mov dword [esp + 0x20], 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, eax
test ebx, ebx
je 0x407a1a
mov ecx, dword [esi + 0xb4]
push ebx
push 0
push 0x1109
push ecx
call edi
mov edx, dword [esi + 0x78]
push ebx
push 1
push 0x1003
push edx
call edi
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.SHELL32.dll_SHGetDesktopFolder]
test eax, eax
jl 0x407a5f
mov ecx, dword [esi + 0xb4]
push 0xffff0000
push 0
push 0x1101
push ecx
call edi
mov edx, dword [esp + 0xc]
push 0xffff0000
push 0
push edx
lea ecx, [esi + 0x98]
call fcn.004012a0
mov eax, dword [esp + 0xc]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esi + 0xb4]
lea edx, [esp + 0x10]
push edx
push 0
push 0x1115
push eax
mov dword [esp + 0x20], 0xffff0000
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0x401500
call edi
mov ecx, dword [esp + 0x180]
mov dword [esi + 0xd4], 0x407ec0
push ecx
lea ecx, [esi + 0x98]
mov dword [esi + 0xd8], 0x407f20
call fcn.00401060
pop edi
pop esi
pop ebx
add esp, 0x170
ret 4
Function at 0x408450
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x42e518
push eax
mov dword fs:[0], esp
sub esp, 0x20
push esi
mov esi, dword [esp + 0x38]
test esi, esi
jne 0x408485
xor al, al
pop esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
add esp, 0x2c
ret 8
lea ecx, [esp + 0x14]
call fcn.00426a7f
mov eax, dword [esp + 0x34]
push 0
push 0x1001
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x38], 0
call fcn.00426b91
test eax, eax
jne 0x4084d4
lea ecx, [esp + 0x14]
mov dword [esp + 0x2c], 0xffffffff
call fcn.00426ad4
xor al, al
pop esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
add esp, 0x2c
ret 8
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GlobalSize]
push esi
mov word [esp + 0xc], 0x4d42
call edi
mov ecx, dword [esi]
lea edx, [esp + 8]
add ecx, 0xe
add eax, 0xe
mov dword [esp + 0x12], ecx
push 0xe
push edx
lea ecx, [esp + 0x20]
mov dword [esp + 0x12], eax
mov word [esp + 0x16], 0
mov word [esp + 0x18], 0
call fcn.00426ce8
push esi
call edi
push eax
push esi
lea ecx, [esp + 0x20]
call fcn.00426ce8
lea ecx, [esp + 0x18]
mov dword [esp + 0x30], 0xffffffff
call fcn.00426ad4
mov ecx, dword [esp + 0x28]
pop edi
mov al, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret 8
Function at 0x409cf0
Capabilities:
Get file system object information

Disassembly:
mov eax, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x160
lea ecx, [esp]
push eax
push 0x160
push ecx
push 0
push edx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
mov eax, dword [esp + 4]
add esp, 0x160
ret

Function at 0x40a690
Capabilities:
Create thread

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
push 0x43e9d0
mov eax, dword [ebx]
mov esi, ecx
push eax
call fcn.00413016
add esp, 8
test eax, eax
je 0x40a726
mov eax, dword [esi + 0x1c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push 0x43e9d0
push 0
push 0x180
push eax
call edi
mov ecx, dword [esi + 0x1c]
push ebx
push eax
push 0x19a
push ecx
call edi
lea edi, [esi + 0x94]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edx, dword [esi + 0x6c]
lea ecx, [esi + 0x64]
push ebx
push edx
call fcn.004219a4
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [esi + 0x90]
pop edi
test eax, eax
jne 0x40a726
lea eax, [esp + 0xc]
mov dword [esi + 0x8c], 0
push eax
push 0
push 0
push 0x40a8c0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x90], eax
pop esi
pop ebx
ret 4

Function at 0x40b110
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, dword [esi + 0x6c]
call fcn.0042acfa
mov eax, dword [eax + 8]
push 0x43c9a4
push edi
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40b167
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x40b167
push eax
mov eax, dword [eax + 8]
add eax, 2
shl eax, 4
push eax
push 0
call dword [sym.imp.GDI32.dll_ExtCreateRegion]
mov ecx, dword [esi + 0x1c]
push 1
push eax
push ecx
mov dword [esi + 0x70], eax
call dword [sym.imp.USER32.dll_SetWindowRgn]
mov ecx, esi
call fcn.00426918
push 0
push 0x10000
push 0
mov ecx, esi
call fcn.00424ba0
pop edi
mov eax, 1
pop esi
ret
Function at 0x4196bd
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x43dfe8
cmp edx, dword [eax]
je 0x4196df
add eax, 8
inc ecx
cmp eax, 0x43e078
jl 0x4196d0
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x43dfe8]
jne 0x41980d
mov eax, dword [0x440f34]
cmp eax, 1
je 0x4197e7
test eax, eax
jne 0x419710
cmp dword [0x43d858], 1
je 0x4197e7
cmp edx, 0xfc
je 0x41980d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x419747
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004189d0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0041a3d0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x41978a
lea eax, [ebp - 0x1a4]
push eax
call fcn.0041a3d0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x43413c
push edi
call fcn.0041bda0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004189d0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004189e0
lea eax, [ebp - 0xa0]
push 0x43411c
push eax
call fcn.004189e0
push dword [esi + 0x43dfec]
lea eax, [ebp - 0xa0]
push eax
call fcn.004189e0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0041bd12
add esp, 0x2c
pop edi
jmp 0x41980d
lea eax, [ebp + 8]
lea esi, [esi + 0x43dfec]
push 0
push eax
push dword [esi]
call fcn.0041a3d0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x420420
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
push 0xf00021
mov edx, dword [esi + 4]
mov ecx, dword [esi]
mov eax, dword [esi + 0xc]
sub eax, edx
push eax
mov eax, dword [esi + 8]
sub eax, ecx
push eax
push edx
push ecx
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.GDI32.dll_PatBlt]
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov ebx, eax
lea eax, [eax + 5]
add eax, 3
and eax, 0xfffffffc
call fcn.00415620
mov dword [ebp - 4], esp
cmp dword [ebp - 4], 0
je 0x4204eb
add ebx, 2
mov eax, dword [ebp - 4]
push ebx
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
je 0x4204eb
mov bx, 0x140
mov edi, dword [ebp + 0x14]
mov eax, edi
and al, 0xf
cmp al, 0xc
je 0x42049e
mov ebx, edi
and bx, 0xf
or bx, 0x150
test edi, 0x80
je 0x4204a9
or bh, 8
and edi, 0x8000000
je 0x4204c4
mov eax, dword [0x4426dc]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
movzx eax, bx
push eax
push esi
push 0xffffffffffffffff
push ecx
push edx
call dword [sym.imp.USER32.dll_DrawTextA]
test edi, edi
je 0x4204eb
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4208c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
sub esp, 4
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
push ebp
push 2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x4208eb
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
jne 0x42090f
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push ebx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
test ebp, ebp
jne 0x42092a
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
mov edi, ebp
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x20]
xor ecx, ecx
mov cl, ah
mov edx, eax
mov dword [esp + 0x10], 0
shl ecx, 8
shr edx, 0x10
mov byte [esp + 0x10], dl
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x28]
or ecx, edx
mov edx, eax
shr edx, 0x10
mov dword [ebp + 0x28], ecx
mov dword [esp + 0x10], 0
xor ecx, ecx
mov byte [esp + 0x10], dl
mov cl, ah
xor edx, edx
shl ecx, 8
mov dl, al
shl edx, 0x10
or ecx, dword [esp + 0x10]
or ecx, edx
mov eax, dword [esp + 0x24]
mov edx, eax
mov dword [ebp + 0x44], ecx
shr edx, 0x10
xor ecx, ecx
mov dword [esp + 0x10], 0
mov cl, ah
mov byte [esp + 0x10], dl
shl ecx, 8
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x2c]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x48], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x30]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x64], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x34]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x54], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
push 0
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
or ecx, edx
mov dword [ebp + 0x50], ecx
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
push 0
push ebp
lea ecx, [ebp + 0x68]
push ecx
push 4
push ebp
push edi
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
mov esi, eax
push edi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
Function at 0x424350
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x424392
call fcn.0042acfa
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x424392
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x424389
xor eax, eax
jmp 0x42439a
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004243a0
pop edi
pop esi
pop ebx
ret 4

Function at 0x426307
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov eax, ebx
push edi
mov edi, ecx
shr eax, 0x10
test ax, ax
mov dword [edi + 0x40], ebx
jne 0x426329
cmp dword [edi + 0x3c], 0
jne 0x426329
movzx eax, bx
mov dword [edi + 0x3c], eax
call fcn.0042acfa
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
mov ecx, edi
push dword [esp + 0x18]
push eax
call fcn.00426356
pop edi
pop esi
pop ebx
ret 8

Function at 0x42b29c
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x42b2ca
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x42b2e8
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0042b202
jmp 0x42b2e8
mov eax, dword [esi + 0x14]
test eax, eax
je 0x42b2e8
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0042b202
test edi, edi
mov eax, edi
jne 0x42b2d2
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x528620
Capabilities:
Terminate process

Disassembly:
push 0x40e724
push 0x40e720
call fcn.0052c5c8
push method.COleControlSite.virtual_116
push 0x40e720
call fcn.0052c5c8
push 0x40e6d4
call fcn.0052c5c8
push 0x40e694
call fcn.0052c5c8
push 0x40e64c
call fcn.0052c5c8
push 0x40e618
call fcn.0052c5c8
push 0x40e5e4
call fcn.0052c5c8
push 0x40e59c
call fcn.0052c5c8
push 0x40e56c
call fcn.0052c5c8
add esp, 0x2c
push 1
call fcn.0052c457
nop
nop

Function at 0x528690
Capabilities:
Terminate process

Disassembly:
push 0x8000
call fcn.0052c5f9
add esp, 4
mov dword [0x4185c4], eax
test eax, eax
jne 0x5286bf
push 0x40e750
push 0x40ebc8
call fcn.0052c33f
add esp, 8
push 0xa
call fcn.0052c457
ret

Function at 0x528990
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x20]
push ebx
push ebp
push esi
push edi
push 0x8000
push eax
call fcn.00531968
mov ebx, eax
push 0xc0000
mov dword [esp + 0x34], ebx
call fcn.0052c5f9
mov edi, eax
push 0xc0436
mov dword [esp + 0x28], edi
call fcn.0052c5f9
mov esi, eax
push 0xc0436
push esi
push ebx
mov dword [esp + 0x40], esi
call fcn.0052fc34
mov eax, dword [esi + 0x2e]
add esp, 0x1c
test eax, eax
jne 0x5289e9
mov dword [esi + 0x2e], 0x100
mov ecx, dword [esi + 0x2e]
mov ebp, dword [esi + 0x16]
mov ebx, dword [esi + 0x12]
cmp ebp, 0x1e0
lea ecx, [ecx*4 + 0x36]
jne 0x528a09
cmp ebx, 0x280
je 0x528a31
cmp ebp, 0x258
jne 0x528a19
cmp ebx, 0x320
je 0x528a31
cmp ebp, 0x300
jne 0x528aee
cmp ebx, 0x400
jne 0x528aee
cmp word [esi + 0x1c], 8
jne 0x528aee
test ebp, ebp
mov dword [esp + 0x1c], 1
jbe 0x528a93
mov eax, ebx
add esi, ecx
neg eax
mov dword [esp + 0x20], eax
lea eax, [ebp - 1]
imul eax, ebx
mov dword [esp + 0x10], esi
add eax, edi
mov dword [esp + 0x14], ebp
mov ecx, ebx
mov edi, eax
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov edx, dword [esp + 0x20]
and ecx, 3
add eax, edx
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
add esi, ebx
dec ecx
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], ecx
jne 0x528a62
mov esi, dword [esp + 0x24]
push 0x180
push 0x8302
push 0x40e48c
call fcn.00531968
mov edi, eax
push 0x436
push esi
push edi
call fcn.0052f34a
imul ebp, ebx
mov eax, dword [esp + 0x30]
push ebp
push eax
push edi
call fcn.0052f34a
push edi
call fcn.0052f825
mov ecx, dword [esp + 0x58]
push ecx
push 1
push 0x40e48c
call fcn.0052b0f0
push 0x40e48c
call fcn.0052c52c
mov edi, dword [esp + 0x50]
add esp, 0x38
jmp 0x528af6
mov dword [esp + 0x1c], 0
mov edx, dword [esp + 0x28]
push edx
call fcn.0052f825
push edi
call fcn.0052c310
push esi
call fcn.0052c310
mov eax, dword [esp + 0x28]
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
Function at 0x528ff0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
push 0x8002
push eax
call fcn.00531968
add esp, 8
cmp eax, 0xffffffff
mov dword [0x4185c0], eax
jne 0x52900f
or eax, eax
ret
push 0x100000
call fcn.0052c5f9
mov ecx, dword [0x4185c0]
push 2
push 0
push ecx
mov dword [0x4185a8], eax
call fcn.0052f2b0
mov edx, dword [0x4185c0]
push 0
push 0
push edx
mov dword [0x418594], eax
call fcn.0052f2b0
mov eax, dword [0x418594]
add esp, 0x1c
cmp eax, 0x100000
jbe 0x529064
mov eax, dword [0x4185a8]
push eax
call fcn.0052c310
add esp, 4
or eax, 0xffffffff
ret
mov ecx, dword [0x4185a8]
mov edx, dword [0x4185c0]
sub ecx, eax
push eax
add ecx, 0x100000
push ecx
push edx
call fcn.0052fc34
add esp, 0xc
call fcn.00529190
test eax, eax
je 0x5290a9
push 0x40e9d4
call fcn.0052c5c8
push 0x40e9a0
call fcn.0052c5c8
add esp, 8
mov eax, 0x4b
ret
mov eax, dword [0x41859c]
mov edx, dword [0x418590]
mov ecx, dword [0x4185b0]
and eax, 0xfffff
mov dword [0x40e8d0], eax
mov eax, dword [0x4185a0]
and edx, 0xfffff
and eax, 0xfffff
and ecx, 0xfffff
mov dword [0x40e8e4], edx
mov edx, dword [0x4185b8]
mov dword [0x40e8e8], eax
mov eax, dword [0x4185a4]
mov dword [0x40e8d4], ecx
mov ecx, dword [0x40f744]
and edx, 0xfffff
and eax, 0xfffff
mov dword [0x40e904], ecx
mov ecx, dword [0x4185b4]
mov dword [0x40e8f8], edx
mov edx, dword [0x418598]
mov dword [0x40e8fc], eax
mov eax, 1
and ecx, 0xfffff
and edx, 0xfffff
mov dword [0x4185bc], eax
mov dword [0x4185ac], eax
mov dword [0x40e90c], ecx
mov dword [0x40e910], edx
xor eax, eax
ret