joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10112e40
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], 0
mov edx, dword [ebp + 8]
mov dword [edx + 8], 0
mov eax, dword [ebp + 8]
push eax
call fcn.10112bd0
add esp, 4
mov ecx, dword [ebp + 8]
cmp dword [ecx], 0
je 0x10112ede
mov dword [ebp - 4], 0
jmp 0x10112e89
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
cmp ecx, dword [eax + 8]
jae 0x10112ede
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov ecx, dword [ebp - 4]
mov edx, dword [eax + ecx*4]
push edx
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10112edc
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.10113300
add esp, 0xc
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
jmp 0x10112e80
mov esp, ebp
pop ebp
ret

Function at 0x10113490
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
cmp dword [eax], 0
je 0x10113506
mov dword [ebp - 4], 0
jmp 0x101134b0
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
cmp eax, dword [edx + 8]
jae 0x101134f1
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov eax, dword [ebp - 4]
mov ecx, dword [edx + eax*4]
push ecx
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x101134ef
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
jmp 0x101134a7
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
push 0
mov eax, dword [0x109562a0]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
nop
mov esp, ebp
pop ebp
ret

Function at 0x10113950
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 8]
movzx eax, byte [edx + ecx]
test eax, eax
je 0x10113999
mov ecx, 1
imul edx, ecx, 0
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + edx]
cmp ecx, 0x90
je 0x10113999
mov edx, 1
imul eax, edx, 0
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + eax]
cmp edx, 0xcc
je 0x10113999
xor eax, eax
jmp 0x101139da
mov dword [ebp - 4], 1
jmp 0x101139ab
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x101139d5
mov edx, dword [ebp + 8]
add edx, dword [ebp - 4]
movzx eax, byte [edx]
mov ecx, 1
imul edx, ecx, 0
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + edx]
cmp eax, edx
je 0x101139d3
xor eax, eax
jmp 0x101139da
jmp 0x101139a2
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x10118ab0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
push edi
mov eax, dword [eax + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebx + 0x78]
test eax, eax
je 0x10118ad3
push dword [ebx + 0x74]
call eax
add esp, 4
push esi
mov esi, dword [ebx + 0x54]
test esi, esi
je 0x10118b39
nop dword [eax + eax]
mov edi, dword [esi + 4]
xor edx, edx
mov eax, dword [edi + 0x60]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
mov eax, dword [edi + 0x54]
test eax, eax
je 0x10118b32
mov ecx, dword [eax + 8]
cmp eax, esi
je 0x10118b06
mov edx, eax
mov eax, ecx
test eax, eax
jne 0x10118af5
jmp 0x10118b32
test edx, edx
jne 0x10118b0f
mov dword [edi + 0x54], ecx
jmp 0x10118b12
mov dword [edx + 8], ecx
mov eax, dword [esi + 0x14]
test eax, eax
je 0x10118b1f
push esi
call eax
add esp, 4
push esi
call fcn.10118ed0
mov eax, dword [ebp - 4]
push esi
push eax
mov eax, dword [eax + 8]
call eax
add esp, 0xc
mov esi, dword [ebx + 0x54]
test esi, esi
jne 0x10118ae0
mov edi, dword [ebp + 8]
lea ecx, [ebx + 0x6c]
mov dword [ebp - 8], ecx
test ecx, ecx
je 0x10118bc0
test edi, edi
je 0x10118bc0
mov eax, dword [ecx]
test eax, eax
je 0x10118bb3
mov ebx, eax
mov esi, dword [ebx + 8]
mov eax, dword [ebx + 4]
mov dword [ebp - 4], eax
mov eax, dword [esi + 8]
test eax, eax
je 0x10118b68
push esi
call eax
add esp, 4
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x3c]
test eax, eax
je 0x10118b7b
push esi
call eax
add esp, 4
mov eax, dword [esi + 0x28]
test eax, eax
je 0x10118b8c
push eax
mov eax, dword [edi + 8]
push edi
call eax
add esp, 8
mov dword [esi + 0x28], 0
mov eax, dword [edi + 8]
push esi
push edi
call eax
mov eax, dword [edi + 8]
push ebx
push edi
call eax
mov eax, dword [ebp - 4]
add esp, 0x10
mov ebx, eax
test eax, eax
jne 0x10118b52
mov ebx, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov eax, dword [ebx + 0x30]
mov dword [ebx + 0x58], 0
test eax, eax
je 0x10118bd4
push ebx
call eax
add esp, 4
push edi
push ebx
call fcn.10118a30
mov eax, dword [ebp - 0xc]
add esp, 8
mov eax, dword [eax + 0x34]
test eax, eax
je 0x10118bee
push ebx
call eax
add esp, 4
mov esi, dword [ebx + 0x68]
mov eax, dword [ebx + 8]
mov dword [ebp + 0xc], eax
test esi, esi
je 0x10118c24
mov ecx, dword [esi + 0x18]
mov eax, dword [esi + 0x1c]
mov dword [ebp + 0x10], eax
test ecx, ecx
je 0x10118c11
push esi
call ecx
mov eax, dword [ebp + 0x10]
add esp, 4
test dword [ebp + 0xc], 0x400
jne 0x10118c24
push esi
push eax
mov eax, dword [eax + 8]
call eax
add esp, 8
mov eax, dword [ebx + 0x80]
mov dword [ebx + 0x68], 0
pop esi
test eax, eax
je 0x10118c4a
push eax
mov eax, dword [edi + 8]
push edi
call eax
add esp, 8
mov dword [ebx + 0x80], 0
mov eax, dword [edi + 8]
push ebx
push edi
call eax
add esp, 8
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1016f1ab
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
xor ecx, ecx
test eax, eax
jne 0x1016f1d2
mov eax, ecx
mov dword [ebp - 4], eax
jmp 0x1016f1d5
mov eax, dword [ebp - 4]
push esi
mov esi, dword [ebp + 0xc]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.1016f187
pop esi
leave
ret 8
Function at 0x100096a0
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [esp + 8], 1
jne 0x1000986d
pushal
mov esi, 0x62c8000
lea edi, [esi - 0x7000]
push edi
jmp 0x100096ca
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x100096d1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x100096c0
mov eax, 1
add ebx, ebx
jne 0x100096e3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x100096d8
jne 0x100096f4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x100096d8
xor ecx, ecx
sub eax, 3
jb 0x10009708
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x1000977a
mov ebp, eax
add ebx, ebx
jne 0x10009713
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x10009720
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x10009744
inc ecx
add ebx, ebx
jne 0x10009730
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x10009725
jne 0x10009741
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x10009725
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x10009764
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x10009755
jmp 0x100096c6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x10009764
add edi, ecx
jmp 0x100096c6
pop esi
mov edi, esi
mov ecx, 0x85
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x10009782
cmp byte [edi], 4
jne 0x10009782
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x10009787
lea edi, [esi + 0x7000]
mov eax, dword [edi]
or eax, eax
je 0x100097ff
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x91b8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x921c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x100097b4
mov ecx, edi
jns 0x100097e3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x9220]
or eax, eax
je 0x100097f9
mov dword [ebx], eax
add ebx, 4
jmp 0x100097d1
popal
xor eax, eax
ret 0xc
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x10009830
cmp al, 0xef
ja 0x10009823
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x10009805
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x10009812
mov ebp, dword [esi + 0x9224]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x20f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x10009864
sub esp, 0xffffff80
jmp 0x1000335f
Function at 0x4014f0
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
sub esp, 0x18
mov eax, dword [0x452944]
mov ecx, dword [0x44e0f0]
mov dword [esp + 0x14], eax
mov eax, dword [0x44e0f4]
sub eax, ecx
mov ecx, dword [0x44e10c]
push ebx
push ebp
lea edx, [eax + ecx + 0x23d17]
mov eax, dword [esp + 0x2c]
test eax, eax
push esi
push edi
mov dword [0x44e0f8], edx
mov dword [esp + 0x10], 0
jle 0x401650
mov edi, dword [esp + 0x2c]
mov ebx, dword [sym.imp.WS2_32.dll_htons]
mov ebp, dword [sym.imp.WS2_32.dll_htonl]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x401557
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [0x44e0f0]
mov eax, dword [str._r_____r____]
mov edx, dword [0x44e0fc]
add eax, ecx
mov ecx, dword [0x44e0ec]
lea eax, [edx + eax + 0x18c64]
sub ecx, dword [0x44e0f4]
mov edx, dword [0x44e100]
mov dword [0x44e0fc], eax
lea eax, [edx + ecx + 0x1d19c]
push edi
mov word [esp + 0x18], 2
mov dword [0x44e100], eax
call ebx
push 0
mov word [esp + 0x1a], ax
call ebp
mov ecx, dword [0x44e0f0]
mov edx, dword [0x44e100]
push 0
mov dword [esp + 0x1c], eax
mov eax, dword [0x44e10c]
add edx, ecx
push 1
lea ecx, [edx + eax + 0x14f81]
push 2
mov dword [0x44e104], ecx
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
je 0x40166c
push 0x10
lea edx, [esp + 0x18]
push edx
push esi
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
jne 0x401666
mov eax, dword [0x44e0f0]
mov ecx, dword [0x44e104]
mov edx, dword [0x44e0ec]
sub eax, ecx
sub eax, edx
add eax, 0x879e
push esi
mov dword [0x44e108], eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov ecx, dword [0x44e100]
mov esi, dword [0x44e0fc]
mov edx, dword [0x44e0f4]
sub ecx, esi
lea eax, [ecx + edx - 0xe06]
mov ecx, dword [esp + 0x34]
mov dword [0x44e10c], eax
mov eax, dword [esp + 0x10]
inc eax
cmp eax, ecx
mov dword [esp + 0x10], eax
jl 0x401544
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x14]
call fcn.004249c1
add esp, 0x18
ret
mov ecx, dword [esp + 0x30]
mov dword [ecx], esi
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
call fcn.004249c1
add esp, 0x18
ret

Function at 0x4016a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4016b9
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x4016cd
pop esi
pop edi
xor eax, eax
pop ebx
ret
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x4016ee
cmp esi, eax
jae 0x4016c7
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x4016e0
cmp esi, eax
jae 0x4016c7
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret
Function at 0x40dcb0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
sub esp, 0x118
mov eax, dword [0x452944]
mov edx, dword [esp + 0x11c]
push ebp
push esi
mov ebp, ecx
lea ecx, [esp + 0x10]
push ecx
push 0x2001f
push 0
mov dword [esp + 0x128], eax
mov eax, dword [ebp]
push edx
push eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x24], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x40ddd2
lea ecx, [esp + 8]
call fcn.0040db90
mov esi, eax
test esi, esi
mov eax, dword [esp + 0x10]
mov dword [esp + 8], eax
jne 0x40ddd6
push edi
lea ecx, [esp + 0x18]
push ecx
push esi
push esi
push esi
lea edx, [esp + 0x20]
push edx
lea ecx, [esp + 0x34]
push ecx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
push eax
mov dword [esp + 0x30], 0x100
call esi
test eax, eax
jne 0x40dd80
lea edx, [esp + 0x20]
push edx
lea ecx, [esp + 0x10]
call fcn.0040dcb0
mov edi, eax
test edi, edi
jne 0x40ddfa
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x10]
push edi
push edi
push edi
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x34]
push edx
push edi
push eax
mov dword [esp + 0x30], 0x100
call esi
test eax, eax
je 0x40dd42
mov eax, dword [esp + 0xc]
test eax, eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x40dd99
push eax
call edi
mov dword [esp + 0xc], 0
mov ecx, dword [esp + 0x128]
mov edx, dword [ebp]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
mov eax, dword [esp + 0xc]
test eax, eax
je 0x40ddb8
push eax
call edi
pop edi
mov eax, esi
pop esi
pop ebp
mov ecx, dword [esp + 0x114]
call fcn.004249c1
add esp, 0x118
ret 4
mov eax, dword [esp + 8]
test eax, eax
je 0x40dde1
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ebp
mov ecx, dword [esp + 0x114]
call fcn.004249c1
add esp, 0x118
ret 4
mov eax, dword [esp + 0xc]
test eax, eax
je 0x40de09
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x120]
mov eax, edi
pop edi
pop esi
pop ebp
call fcn.004249c1
add esp, 0x118
ret 4
Function at 0x40e2e0
Capabilities:
Set registry value

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
mov ebp, ecx
xor edi, edi
push esi
call ebx
inc eax
add esi, eax
add edi, eax
cmp eax, 1
jne 0x40e2f2
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, dword [ebp]
push edi
push eax
push 7
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebp
pop ebx
ret 8
Function at 0x411720
Capabilities:
Create thread

Disassembly:
mov ecx, dword [0x4518e8]
push ebx
mov ebx, dword [0x4518dc]
mov eax, 0x6614bc37
imul ecx
push esi
mov esi, dword [0x4518d8]
push edi
mov edi, dword [0x4518f4]
imul edi, edi, 0x926
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, edi
sub edx, eax
sub edx, esi
lea eax, [edx + ebx + 0x1503]
mov dword [str._r_____r_____n], eax
cmp dword [esp + 0x10], 0x132b600
je 0x411790
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, 0x64
lea esp, [esp]
push 0x3e8
call edi
dec esi
jne 0x411780
pop edi
pop esi
xor eax, eax
pop ebx
ret
mov esi, dword [0x4518ec]
mov eax, 0x4152dddf
imul ecx
push ebp
sar edx, 0xa
mov ebp, esi
imul ebp, ebp, 0xfffff5f8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4518f0]
sub ebp, eax
mov eax, 0x6a79dd7b
imul edx
sar edx, 9
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4518d4]
sub ebp, eax
add ebp, dword [str._r_____r_____n]
lea eax, [edx + ebp - 0x86c]
mov dword [0x4518d4], eax
mov eax, dword [0x563c68]
mov edx, eax
inc eax
test edx, edx
mov dword [0x563c68], eax
pop ebp
jle 0x41182d
mov eax, 0x8c03f71d
imul esi, esi, 0x1538
imul ebx
add edx, ebx
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4518e0]
add eax, esi
sub eax, edi
sub eax, edx
pop edi
add eax, 0x2044
pop esi
mov dword [0x4518d8], eax
mov eax, 1
pop ebx
ret
mov eax, 0x8b081419
imul ecx
add edx, ecx
sar edx, 0xc
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0xa5b2ed37
imul ebx
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, ecx
mov ecx, dword [0x4518f4]
sub eax, esi
lea edx, [eax + ecx - 0x866]
lea eax, [esp + 0x10]
push eax
push 0
push 0
push 0x411300
push 0
push 0
mov dword [0x563978], 0
mov dword [0x4518dc], edx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x4518e8]
mov esi, dword [0x4518d8]
mov eax, 0x61dea4df
imul esi, esi, 0x1538
imul ecx
mov eax, dword [0x4518f0]
sar edx, 0xb
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x4518e4]
imul edx, edx, 0x4cf
sub esi, ecx
add esi, eax
lea eax, [edx + esi + 0x14d5]
pop edi
pop esi
mov dword [0x4518e0], eax
mov eax, 1
pop ebx
ret
Function at 0x415250
Capabilities:
Create thread

Disassembly:
mov ecx, dword [0x4518e0]
mov eax, 0x8c03f71d
imul ecx
add edx, ecx
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4518e4]
push esi
mov esi, eax
mov eax, 0x1bfba0af
imul edx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4518f4]
imul edx, edx, 0x86d
sub eax, esi
sub eax, edx
add eax, 0x322e
mov dword [0x4518e4], eax
cmp dword [esp + 8], 0x132b600
je 0x4152c2
push edi
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, 0x64
push 0x3e8
call edi
dec esi
jne 0x4152b3
pop edi
xor eax, eax
pop esi
ret
mov edx, dword [0x4518d8]
imul ecx, ecx, 0x86d
mov esi, dword [0x4518dc]
mov eax, edx
imul esi, esi, 0xa08
imul eax, eax, 0xfad
sub esi, eax
mov eax, 0x6a79dd7b
imul edx
mov eax, dword [0x56396c]
add esi, ecx
sar edx, 9
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub esi, ecx
test eax, eax
mov dword [0x4518e8], esi
jne 0x415373
lea edx, [esp + 8]
push edx
push 0
push 0
push 0x414080
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [0x4518e8]
mov esi, dword [0x4518d8]
mov dword [0x56395c], eax
imul esi, esi, 0x1538
mov eax, 0x61dea4df
imul ecx
mov ecx, dword [0x4518e4]
sar edx, 0xb
imul ecx, ecx, 0x4cf
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
add esi, dword [0x4518f0]
lea edx, [ecx + esi + 0x14d5]
mov dword [0x56396c], 1
mov dword [0x4518e0], edx
mov eax, 1
pop esi
ret
Function at 0x417760
Capabilities:
Print debug messages

Disassembly:
push 0xffffffffffffffff
push 0x43f848
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov ecx, dword [0x4518e8]
mov eax, 0x6614bc37
imul ecx
mov ecx, dword [0x4518f4]
imul ecx, ecx, 0x926
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4518d8]
sub ecx, eax
sub ecx, edx
mov edx, dword [0x4518dc]
lea eax, [ecx + edx + 0x1503]
mov edx, dword [0x567354]
push esi
mov ecx, 0x567354
mov dword [str._r_____r_____n], eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 4], eax
mov ecx, dword [0x4518e8]
mov eax, 0x8b081419
imul ecx
add edx, ecx
mov ecx, dword [0x4518dc]
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
mov esi, eax
mov eax, 0xa5b2ed37
imul ecx
sar edx, 0xa
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x4518ec]
sub ecx, esi
sub ecx, edx
mov edx, dword [0x4518f4]
lea eax, [ecx + edx - 0x866]
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x1c]
push ecx
push edx
lea ecx, [esp + 0xc]
mov dword [esp + 0x18], 0
mov dword [0x4518dc], eax
call fcn.004174d0
mov ecx, dword [0x4518d8]
mov esi, dword [0x4518dc]
mov edx, dword [0x4518e0]
imul esi, esi, 0xa08
mov eax, ecx
imul edx, edx, 0x86d
imul eax, eax, 0xfad
sub esi, eax
add esi, edx
mov eax, 0x6a79dd7b
imul ecx
sar edx, 9
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov dword [0x4518e8], esi
mov esi, dword [esp + 4]
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea eax, [esi - 0x10]
mov dword [esp + 0x10], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
pop esi
jg 0x4178a5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x41bb73
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
je 0x41bbc6
call fcn.0043c732
mov edi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, ebx
je 0x41bbc6
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebx
mov dword [ebp - 8], eax
jne 0x41bbbc
xor eax, eax
jmp 0x41bcdf
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], ebx
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0xc], 1
je 0x41bbf6
mov eax, dword [esi]
push edi
push dword [ebp - 4]
mov ecx, esi
push ebx
call dword [eax + 0x1c]
cmp dword [ebp - 8], 0
mov dword [ebp - 0xc], eax
je 0x41bbf6
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebx + 0x48]
test eax, eax
je 0x41bcdc
mov ecx, dword [eax + 0x40]
and dword [ebp + 0xc], 0
test ecx, ecx
mov dword [ebp + 8], ecx
mov dword [ebp - 8], ecx
je 0x41bc23
lea ecx, [eax + 0x3c]
lea eax, [ebp + 8]
push eax
call fcn.0041c317
mov eax, dword [eax]
mov dword [ebp + 0xc], eax
xor eax, eax
cmp dword [edi + 8], eax
mov dword [ebp - 4], eax
jbe 0x41bcdc
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x41bc6c
mov ecx, dword [ecx + 4]
mov edx, dword [edi + 0xc]
mov ecx, dword [ecx + 0x28]
cmp ecx, dword [edx + eax*8]
jne 0x41bc6c
mov eax, dword [ebp + 8]
test eax, eax
mov dword [ebp - 8], eax
je 0x41bc66
mov ecx, dword [ebx + 0x48]
lea eax, [ebp + 8]
add ecx, 0x3c
push eax
call fcn.0041c317
mov eax, dword [eax]
mov dword [ebp + 0xc], eax
jmp 0x41bccc
and dword [ebp + 0xc], 0
jmp 0x41bccc
mov ecx, dword [edi + 0xc]
shl eax, 3
cmp dword [eax + ecx], 0
mov dword [ebp - 0x10], eax
je 0x41bccc
push 0xc
call fcn.00436634
mov esi, eax
test esi, esi
pop ecx
je 0x41bcae
mov eax, dword [edi + 0xc]
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebx + 0x1c]
add eax, edx
push dword [eax]
mov edi, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
and dword [esi + 4], 0
mov dword [esi + 8], edi
mov edi, dword [ebp + 0x10]
mov dword [esi], eax
jmp 0x41bcb0
xor esi, esi
mov ecx, dword [ebx + 0x48]
add ecx, 0x3c
cmp dword [ebp - 8], 0
push esi
je 0x41bcc7
push dword [ebp - 8]
call fcn.00432087
jmp 0x41bccc
call fcn.0043205e
mov eax, dword [ebp - 4]
inc eax
cmp eax, dword [edi + 8]
mov dword [ebp - 4], eax
jb 0x41bc31
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x424edd
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x424efd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004271ac
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x424f20
test byte [esp + 8], 2
je 0x424f20
call fcn.0042719a
mov dword [eax], 0xd
call fcn.004271a3
mov dword [eax], 5
jmp 0x424ef9
xor eax, eax
ret