joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1004543
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x100805c]
mov ecx, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 4], eax
push edi
xor eax, eax
cmp ecx, dword [eax*8 + 0x1008070]
je 0x100456d
inc eax
cmp eax, 0x12
jb 0x100455e
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x1008070]
mov dword [ebp - 0x110], esi
jne 0x1004718
mov eax, dword [0x10081fc]
cmp eax, 1
je 0x10046e6
test eax, eax
jne 0x10045a3
cmp dword [0x1008064], 1
je 0x10046e6
cmp ecx, 0xfc
je 0x1004718
push 0x104
lea eax, [ebp - 0x10c]
push eax
push 0
mov byte [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x10045de
push 5
pop ecx
mov esi, 0x10018bc
lea edi, [ebp - 0x10c]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea ebx, [ebp - 0x10c]
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10045e9
sub eax, edx
inc eax
cmp eax, 0x3c
jbe 0x1004621
lea eax, [ebp - 0x10c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1004601
sub eax, edx
push 3
lea ebx, [ebp + eax - 0x147]
push 0x10018b8
push ebx
call fcn.01005e00
add esp, 0xc
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1004626
sub eax, edx
mov ecx, eax
mov eax, dword [ebp - 0x110]
mov eax, dword [eax + 0x1008074]
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1004640
sub eax, esi
lea eax, [eax + ecx + 0x1c]
add eax, 3
and eax, 0xfffffffc
call fcn.01003ea0
mov edx, esp
push 6
pop ecx
mov esi, 0x100189c
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov eax, ebx
movsw word es:[edi], word [esi]
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100466c
mov edi, edx
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x1004678
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, edx
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x1004691
mov eax, dword [ebp - 0x110]
mov esi, 0x1001898
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov eax, dword [eax + 0x1008074]
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10046af
mov edi, edx
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x10046bb
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push 0x12010
mov ecx, eax
and ecx, 3
push 0x1001870
push edx
rep movsb byte es:[edi], byte [esi]
call fcn.01005cf1
add esp, 0xc
jmp 0x1004718
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
test eax, eax
je 0x1004718
mov esi, dword [esi + 0x1008074]
mov ecx, esi
lea edx, [ecx + 1]
mov bl, byte [ecx]
inc ecx
test bl, bl
jne 0x10046fd
push 0
sub ecx, edx
lea edx, [ebp - 0x114]
push edx
push ecx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x120]
mov ecx, dword [ebp - 4]
call fcn.01003b81
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1004bc4
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1008464]
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
push edi
xor ebx, ebx
cmp eax, ebx
push 2
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
pop edi
jne 0x1004c17
call esi
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x1004bfe
mov dword [0x1008464], 1
jmp 0x1004c1c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x1004c12
mov eax, edi
mov dword [0x1008464], eax
jmp 0x1004c17
mov eax, dword [0x1008464]
cmp eax, 1
jne 0x1004c83
cmp dword [ebp - 4], ebx
jne 0x1004c31
call esi
cmp eax, ebx
mov dword [ebp - 4], eax
jne 0x1004c31
xor eax, eax
jmp 0x1004d42
mov ecx, dword [ebp - 4]
cmp word [ecx], bx
mov eax, ecx
je 0x1004c49
add eax, edi
cmp word [eax], bx
jne 0x1004c3b
add eax, edi
cmp word [eax], bx
jne 0x1004c3b
sub eax, ecx
add eax, edi
mov esi, eax
push esi
call fcn.01004103
cmp eax, ebx
pop ecx
jne 0x1004c6a
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
jmp 0x1004d42
mov ecx, esi
mov esi, dword [ebp - 4]
mov edx, ecx
shr ecx, 2
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ebx, eax
jmp 0x1004c5a
cmp eax, edi
je 0x1004c8b
cmp eax, ebx
jne 0x1004c2a
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov esi, eax
cmp esi, ebx
mov dword [ebp - 4], esi
je 0x1004c2a
cmp byte [esi], bl
je 0x1004cd0
push ebx
push ebx
push 0xffffffffffffffff
push esi
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, ebx
je 0x1004c2a
add dword [ebp - 8], eax
mov eax, esi
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x1004cbc
sub eax, edi
lea esi, [esi + eax + 1]
cmp byte [esi], bl
jne 0x1004c9e
mov esi, dword [ebp - 4]
inc dword [ebp - 8]
mov eax, dword [ebp - 8]
add eax, eax
push eax
call fcn.01004103
cmp eax, ebx
pop ecx
mov dword [ebp - 0xc], eax
jne 0x1004ce9
push esi
jmp 0x1004d53
mov edi, esi
mov esi, eax
mov eax, dword [ebp - 4]
cmp byte [eax], bl
je 0x1004d33
mov ecx, dword [ebp - 8]
mov eax, esi
sub eax, dword [ebp - 0xc]
sar eax, 1
sub ecx, eax
push ecx
push esi
push 0xffffffffffffffff
push edi
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x1004d47
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x1004d17
sub eax, edx
push esi
lea edi, [edi + eax + 1]
call fcn.0100417c
cmp byte [edi], bl
pop ecx
lea esi, [esi + eax*2 + 2]
jne 0x1004cf4
push dword [ebp - 4]
mov word [esi], bx
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret
push dword [ebp - 0xc]
call fcn.0100403e
pop ecx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
jmp 0x1004c2a
Function at 0x1004d63
Capabilities:
Accept command line arguments

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x1008468]
test eax, eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetCommandLineW]
jne 0x1004da7
call esi
test eax, eax
je 0x1004d8c
mov dword [0x1008468], 1
jmp 0x1004dac
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x1004da3
mov dword [0x1008468], 2
jmp 0x1004db5
xor eax, eax
jmp 0x1004e0b
cmp eax, 1
jne 0x1004db0
call esi
jmp 0x1004e0b
cmp eax, 2
jne 0x1004da3
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
push 0
push 0xffffffffffffffff
push eax
push 1
push 0
mov dword [ebp - 8], eax
call esi
mov edi, eax
test edi, edi
je 0x1004e08
lea eax, [edi + edi]
push eax
call fcn.01004103
test eax, eax
pop ecx
mov dword [ebp - 4], eax
je 0x1004e08
push edi
push eax
push 0xffffffffffffffff
push dword [ebp - 8]
push 1
push 0
call esi
test eax, eax
je 0x1004dff
mov eax, dword [ebp - 4]
jmp 0x1004e0a
push dword [ebp - 4]
call fcn.0100403e
pop ecx
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x100515a
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x100518b
mov eax, dword fs:[4]
mov dword [ebp + 8], eax
mov eax, dword fs:[8]
mov dword [ebp - 4], eax
cmp ebx, dword [ebp - 4]
jb 0x1005192
cmp ebx, dword [ebp + 8]
jae 0x1005192
xor eax, eax
jmp 0x1005382
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0x10051a3
xor eax, eax
inc eax
jmp 0x1005381
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x10051b9
cmp ecx, edx
jae 0x10052fe
cmp dword [eax + 4], 0
je 0x10051c2
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x10051aa
cmp dword [ebp + 8], 0
je 0x10051e4
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x10052fe
cmp eax, esi
jae 0x10052fe
mov eax, dword [0x1008470]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
jle 0x1005209
cmp dword [esi*4 + 0x1008478], edi
je 0x1005302
inc esi
cmp esi, eax
jl 0x10051f7
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x100537e
cmp dword [ebp - 8], 0x1000000
jne 0x100537e
test byte [ebp - 0xc], 0xcc
je 0x1005287
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0x100537e
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x100537e
cmp word [eax + 0x18], 0x10b
jne 0x100537e
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0x100537e
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0x1005287
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0x1005287
test byte [ecx + 0x27], 0x80
jne 0x10052fe
push 1
push 0x10084b8
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
test eax, eax
jne 0x100519b
mov ecx, dword [0x1008470]
test ecx, ecx
mov edx, ecx
jle 0x10052bb
lea eax, [ecx*4 + 0x1008474]
cmp dword [eax], edi
je 0x10052bb
dec edx
sub eax, 4
test edx, edx
jg 0x10052af
test edx, edx
jne 0x10052ec
push 0xf
pop ebx
cmp ecx, ebx
jg 0x10052c8
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0x10052e0
lea eax, [edx*4 + 0x1008478]
mov esi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], edi
mov edi, esi
jle 0x10052ce
cmp ecx, 0x10
jge 0x10052ec
inc ecx
mov dword [0x1008470], ecx
push 0
push 0x10084b8
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
jmp 0x100519b
xor eax, eax
jmp 0x1005381
test esi, esi
jle 0x100519b
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push 1
push 0x10084b8
call ebx
test eax, eax
jne 0x100519b
cmp dword [esi*4 + 0x1008478], edi
je 0x1005358
mov eax, dword [0x1008470]
lea esi, [eax - 1]
test esi, esi
jl 0x1005346
cmp dword [esi*4 + 0x1008478], edi
je 0x1005342
dec esi
jns 0x1005336
test esi, esi
jge 0x1005356
cmp eax, 0x10
jge 0x1005351
inc eax
mov dword [0x1008470], eax
lea esi, [eax - 1]
jmp 0x1005358
je 0x1005370
xor ecx, ecx
test esi, esi
jl 0x1005370
lea eax, [ecx*4 + 0x1008478]
mov edx, dword [eax]
inc ecx
cmp ecx, esi
mov dword [eax], edi
mov edi, edx
jle 0x100535e
push 0
push 0x10084b8
call ebx
jmp 0x100519b
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1005cf1
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x10084e4], ebx
push esi
push edi
jne 0x1005d73
push 0x1001938
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x1005dae
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x100192c
push edi
call esi
test eax, eax
mov dword [0x10084e4], eax
je 0x1005dae
push 0x100191c
push edi
call esi
push 0x1001908
push edi
mov dword [0x10084e8], eax
call esi
cmp dword [0x100820c], 2
mov dword [0x10084ec], eax
jne 0x1005d73
push 0x10018ec
push edi
call esi
test eax, eax
mov dword [0x10084f4], eax
je 0x1005d73
push 0x10018d4
push edi
call esi
mov dword [0x10084f0], eax
mov eax, dword [0x10084f0]
test eax, eax
je 0x1005db8
call eax
test eax, eax
je 0x1005d9f
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x10084f4]
test eax, eax
je 0x1005d9f
test byte [ebp - 8], 1
jne 0x1005db8
cmp dword [0x1008218], 4
jb 0x1005db2
or byte [ebp + 0x12], 0x20
jmp 0x1005dd7
xor eax, eax
jmp 0x1005de7
or byte [ebp + 0x12], 4
jmp 0x1005dd7
mov eax, dword [0x10084e8]
test eax, eax
je 0x1005dd7
call eax
mov ebx, eax
test ebx, ebx
je 0x1005dd7
mov eax, dword [0x10084ec]
test eax, eax
je 0x1005dd7
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x10084e4]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1006509
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
push 4
pop eax
call fcn.01003ea0
mov ebx, esp
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x100656f
mov edi, dword [ebp - 0x1c]
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [0x100820c]
mov esi, dword [ebp - 0x40]
mov ecx, eax
dec ecx
neg ecx
sbb ecx, ecx
lea edx, [esi - 1]
and ecx, 0x103
not edx
and edx, ebx
inc ecx
sub edx, esi
dec eax
neg eax
sbb eax, eax
and eax, 0xfffffff1
add eax, 0x11
imul eax, esi
add eax, edi
cmp edx, eax
jae 0x1006573
xor eax, eax
jmp 0x1006580
lea eax, [ebp - 4]
push eax
push ecx
push esi
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x50]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4013b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, eax
mov eax, dword [ebp + 8]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4013c8
pop edi
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4013fa
mov ecx, dword [ebp + 8]
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, esi
and edi, 0xf
jbe 0x4013f6
cmp esi, eax
jae 0x4013fa
dec edi
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x4013e8
cmp esi, eax
jb 0x401400
pop esi
xor eax, eax
pop edi
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebp
ret

Function at 0x401410
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor esi, esi
push esi
mov ecx, 0x41d620
call fcn.0040856d
mov ebx, eax
mov dword [ebp - 4], 1
test ebx, ebx
je 0x4014c4
test esi, esi
jne 0x4014c4
mov eax, dword [ebp + 8]
shr eax, 4
inc eax
push esi
movzx ecx, ax
push ecx
push 6
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
mov edi, eax
test edi, edi
je 0x4014a8
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4014a2
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4014a2
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 8]
add eax, esi
and ecx, 0xf
jbe 0x401491
cmp esi, eax
jae 0x401495
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x401483
cmp esi, eax
jb 0x401499
xor eax, eax
jmp 0x4014a2
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
mov esi, eax
test eax, eax
jne 0x4014cd
mov edi, dword [ebp - 4]
push edi
mov ecx, 0x41d620
call fcn.0040856d
mov ebx, eax
inc edi
mov dword [ebp - 4], edi
test ebx, ebx
jne 0x401435
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401b60
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x415148
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x224
push ebx
push esi
xor esi, esi
push edi
mov edi, ecx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], esi
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov ebx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x1c]
or eax, 0x2001f
push edx
call fcn.00401a50
mov ebx, eax
cmp ebx, esi
je 0x401bcd
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
cmp eax, esi
je 0x401bc6
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x1c], esi
mov eax, ebx
jmp 0x401c6c
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x1c]
push esi
push esi
push esi
lea ecx, [ebp - 0x20]
push ecx
lea edx, [ebp - 0x22c]
push edx
push esi
push eax
mov dword [ebp - 0x20], 0x100
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x401c32
lea ecx, [ebp - 0x22c]
push ecx
lea ecx, [ebp - 0x1c]
call fcn.00401b60
mov ebx, eax
cmp ebx, esi
jne 0x401bae
lea edx, [ebp - 0x28]
push edx
mov edx, dword [ebp - 0x1c]
push esi
push esi
push esi
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x22c]
push ecx
push esi
push edx
mov dword [ebp - 0x20], 0x100
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x401bf5
mov eax, dword [ebp - 0x1c]
cmp eax, esi
je 0x401c43
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x1c], esi
mov ebx, dword [ebp + 8]
mov eax, edi
mov dword [ebp - 0x18], esi
call fcn.004018f0
mov edi, eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
cmp eax, esi
je 0x401c6a
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x1c], esi
mov eax, edi
mov ecx, dword [ebp - 0xc]
pop edi
mov dword [ebp - 0x18], esi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x402270
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x415873
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x428
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 4], ebx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x430], ebx
mov byte [ebp - 4], 1
push 2
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
mov dword [ebp + 8], esi
cmp esi, ebx
jne 0x4022ce
call fcn.004014e0
mov edi, eax
jmp 0x4023e1
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
cmp edi, ebx
jne 0x4022ed
call fcn.004014e0
jmp 0x4023d8
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp + 0xc], eax
cmp eax, ebx
jne 0x402306
call fcn.004014e0
jmp 0x4023d8
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov dword [ebp + 0x10], edi
lea eax, [edi + 1]
cmp eax, edi
jae 0x402324
mov edi, 0x8007000e
jmp 0x4023da
mov byte [ebp - 4], 2
xor ecx, ecx
shld ecx, eax, 1
mov dword [ebp - 0x1c], ecx
add eax, eax
mov dword [ebp - 0x20], eax
cmp ecx, ebx
ja 0x40233f
cmp eax, 0xffffffff
jbe 0x402349
push 0x80070216
call fcn.00401080
cmp eax, 0x400
jbe 0x402365
lea ecx, [ebp - 0x430]
push ecx
call fcn.00406820
mov dword [ebp - 4], 1
jmp 0x40238f
lea edx, [ebp - 0x42c]
mov dword [ebp - 0x430], edx
mov dword [ebp - 4], 1
jmp 0x40238f
mov eax, dword [ebp - 0x430]
cmp eax, ebx
jne 0x4023a0
mov edi, 0x8007000e
jmp 0x4023da
push edi
push eax
push edi
mov eax, dword [ebp + 0xc]
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, ebx
jne 0x4023ba
call fcn.004014e0
jmp 0x4023d8
xor ecx, ecx
mov edx, dword [ebp - 0x430]
mov word [edx + eax*2], cx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp - 0x430]
lea edx, [ebp - 0x18]
call fcn.00403070
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x42c]
cmp dword [ebp - 0x430], ecx
je 0x4023fd
lea eax, [ebp - 0x430]
call fcn.00406410
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x404a80
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
mov esi, eax
xor eax, eax
push 0x3e
push eax
lea ecx, [ebp - 0x42]
push ecx
mov word [ebp - 0x44], ax
call fcn.00409ae0
push 3
lea edx, [ebp - 0x44]
push 0x418978
push edx
mov edx, 0x20
call fcn.00406dd0
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.crt.dll_Ordinal_64]
add esp, 0x1c
test al, al
je 0x404ac8
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
push ebx
call fcn.00404680
mov bl, al
test bl, bl
je 0x404b07
cmp dword [esi + 4], 0
je 0x404b07
lea ecx, [ebp - 4]
push ecx
push 0
push esi
push 0x404b10
push 0
push 0
mov dword [esi + 8], 3
mov dword [ebp - 4], 0
call fcn.0040902e
add esp, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
pop ebx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x404d10
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x415352
push eax
mov dword fs:[0], esp
sub esp, 0x20
cmp dword [ebp + 8], 0
push esi
push edi
mov edi, ecx
je 0x404e2f
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x404e2f
mov dword [ebp - 0x18], 0
mov dword [ebp - 4], 1
lea eax, [ebp - 0x18]
push eax
push 0x418e94
push 0x17
push 0
push 0x418e84
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x404e19
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x404e19
mov ecx, dword [eax]
mov edx, dword [ecx + 0xfc]
push 0
push eax
call edx
lea esi, [ebp - 0x2c]
call fcn.00401520
mov byte [ebp - 4], 3
mov edi, dword [eax]
mov edx, dword [ebp - 0x18]
mov esi, dword [edx]
lea ecx, [ebp - 0x14]
push ecx
sub esp, 0x10
mov ecx, esp
mov dword [ecx], edi
mov edi, dword [eax + 4]
mov dword [ecx + 4], edi
mov edi, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov dword [ecx + 8], edi
mov dword [ecx + 0xc], eax
mov ecx, dword [esi + 0xe8]
push edx
call ecx
mov byte [ebp - 4], 1
lea edx, [ebp - 0x2c]
push edx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
or ecx, 0xffffffff
cmp word [ebp - 0x14], cx
je 0x404dec
mov dword [ebp - 4], ecx
lea eax, [ebp - 0x18]
push eax
call fcn.00405510
jmp 0x404e2f
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp + 8]
mov dword [ebp - 0x18], 0
mov dword [edx], eax
mov dword [ebp - 4], ecx
lea eax, [ebp - 0x18]
push eax
call fcn.00405510
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x404e2f
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, 1
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret