joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401a6e
Capabilities:
Read file on windows
Write file on windows

Disassembly:
jmp 0x483190
push 0xffffffffffffffff
push 0x5569ec
mov eax, dword fs:[0]
push eax
sub esp, 0x104
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5c1d10]
xor eax, esp
push eax
lea eax, [esp + 0x118]
mov dword fs:[0], eax
mov esi, dword [esp + 0x128]
xor ebx, ebx
cmp esi, ebx
jne 0x4831d9
push 6
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x4833d1
cmp dword [esp + 0x12c], ebx
je 0x4831f0
push esi
call fcn.0047ae10
add esp, 4
jmp 0x4833cc
mov ebp, dword [esi + 0x12c]
cmp dword [esi + 0x128], ebp
lea edi, [esi + 0x124]
jbe 0x483209
call fcn.00402590
mov eax, dword [edi + 4]
cmp eax, dword [edi + 8]
mov dword [esp + 0x14], eax
jbe 0x48321e
call fcn.00402590
mov eax, dword [esp + 0x14]
push ebp
push edi
push eax
push edi
call fcn.004027f2
push esi
call fcn.0040377e
add esp, 0x14
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x120], ebx
lea eax, [esp + 0x18]
push eax
sub esp, 0x10
mov ecx, esp
mov dword [esp + 0x28], esp
push edi
call fcn.0040254f
mov byte [esp + 0x134], 1
mov byte [esp + 0x134], 0
call fcn.00482610
mov ecx, dword [esi + 4]
mov edx, dword [esi]
push ebx
add ecx, 0x14
push ecx
push edx
call fcn.004fa081
mov eax, dword [esi]
push eax
push 1
lea ecx, [esp + 0x60]
push 0xe0
push ecx
call fcn.004fa972
lea edi, [esp + 0x48]
call fcn.00474e30
mov ebx, eax
mov eax, esi
call fcn.00478e50
mov ebp, eax
call fcn.00474fe0
mov ecx, dword [esp + 0x8c]
lea edi, [ebx + 3]
add ebp, 3
and ebp, 0xfffffffc
add eax, ebp
and edi, 0xfffffffc
add eax, edi
lea edx, [ecx - 1]
lea ebx, [ecx + eax - 1]
not edx
and ebx, edx
mov edx, dword [esp + 0x88]
push edx
push ecx
mov ecx, dword [esp + 0xa8]
push ecx
push eax
push esi
call fcn.0040447b
add esp, 0x44
test eax, eax
je 0x483315
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
push esi
call fcn.0047ae10
add esp, 4
mov dword [esp + 0x120], 0xffffffff
lea ecx, [esp + 0x18]
call fcn.004021df
xor eax, eax
jmp 0x4833d1
push ebx
call fcn.004b14ff
push ebx
push 0
push eax
mov dword [esp + 0x24], eax
call fcn.004f4420
mov edx, dword [esp + 0x24]
add edx, edi
push edx
lea eax, [esp + 0x3c]
push esi
push eax
call fcn.0047f140
add esp, 0x1c
mov byte [esp + 0x120], 2
add ebp, edi
push ebp
push edi
sub esp, 0xc
lea edx, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0x48], esp
push edx
call fcn.00401870
mov byte [esp + 0x134], 3
mov edi, dword [esp + 0x28]
push edi
push esi
mov byte [esp + 0x13c], 2
lea ecx, [esp + 0x34]
call fcn.0047f330
mov eax, dword [esi + 0x110]
mov ecx, dword [esi]
push 0
push eax
push ecx
call fcn.004fa081
mov edx, dword [esi]
push edx
push ebx
push 1
push edi
call fcn.004fa265
push edi
call fcn.004b1504
push esi
call fcn.0047ae10
add esp, 0x40
mov byte [esp + 0x120], 0
lea ecx, [esp + 0x28]
call fcn.00401a5f
mov dword [esp + 0x120], 0xffffffff
lea ecx, [esp + 0x18]
call fcn.004021df
mov eax, 1
mov ecx, dword [esp + 0x118]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret
Function at 0x401aa5
Capabilities:
Extract resource via kernel32 functions

Disassembly:
jmp 0x43cfa0
push 0xffffffffffffffff
push 0x54f78e
mov eax, dword fs:[0]
push eax
sub esp, 0x1cc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5c1d10]
xor eax, esp
push eax
lea eax, [esp + 0x1e0]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0x1e8], 0
mov esi, dword [esp + 0x1f0]
test esi, esi
je 0x43d1d4
mov eax, dword [edi + 0x2b8]
push 2
push 0
add eax, 0x7c
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
test eax, eax
mov dword [edi + 0x2bc], eax
jne 0x43d01a
push eax
push eax
push str.Cant_find_resource._r_nNot_a_Valid_PE_File_or_File_Is_opened_by_other_program_
mov ecx, edi
call fcn.004b9f2e
jmp 0x43d1d4
mov edx, dword [esp + 0x1f4]
test edx, 0xffff0000
jne 0x43d02c
movzx edx, dx
test esi, 0xffff0000
movzx ecx, si
je 0x43d039
mov ecx, esi
push edx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov ebp, eax
test ebp, ebp
je 0x43d107
mov ecx, dword [edi + 0x2bc]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x43d161
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edx, dword [edi + 0x2bc]
push ebp
mov ebx, eax
push edx
mov dword [esp + 0x1c], ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebp, eax
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x43d161
push ebp
call fcn.004f53cf
mov ebx, eax
mov eax, dword [esp + 0x18]
push ebp
push eax
push ebx
call fcn.004f40b0
sub esi, dword [edi + 0x2bc]
mov ecx, dword [esp + 0x208]
mov edx, dword [esp + 0x210]
add esi, 1
mov dword [ecx], esi
mov esi, dword [esp + 0x20c]
add esp, 0x10
push edx
mov ecx, esi
call fcn.004bf794
mov eax, dword [edi + 0x2bc]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push str.Resource_Ok.
mov ecx, esi
call fcn.004bf794
mov dword [esp + 0x1e8], 0xffffffff
lea ecx, [esp + 0x200]
call fcn.00402798
mov eax, ebx
jmp 0x43d1ed
cmp dword [0x5c4d84], 0
je 0x43d161
mov eax, dword [edi + 0x2b8]
mov ecx, dword [eax + 0x27c]
test ecx, ecx
jne 0x43d129
mov ecx, eax
call fcn.00401c7b
jmp 0x43d130
push 5
call fcn.004bf851
mov ecx, dword [edi + 0x2b8]
mov ecx, dword [ecx + 0x27c]
push 1
push 0x18
push str.The_PE_is_maybe_packed...
add ecx, 0xa8
call fcn.00402a13
mov ecx, dword [esp + 0x1fc]
push str.Resource_not_found.
call fcn.004bf794
mov edi, dword [edi + 0x2bc]
test edi, edi
je 0x43d172
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x20]
call fcn.004015b9
mov byte [esp + 0x1e8], 1
push eax
lea eax, [esp + 0x18]
push str.Resource_Corrupted..._r_n
push eax
call fcn.00403a76
add esp, 0xc
mov byte [esp + 0x1e8], 2
mov eax, dword [eax]
mov ecx, dword [esp + 0x1fc]
push eax
call fcn.004bf794
mov byte [esp + 0x1e8], 1
lea ecx, [esp + 0x14]
call fcn.00402798
mov byte [esp + 0x1e8], 0
lea ecx, [esp + 0x18]
call fcn.00402798
mov dword [esp + 0x1e8], 0xffffffff
lea ecx, [esp + 0x200]
call fcn.00402798
xor eax, eax
mov ecx, dword [esp + 0x1e0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1d8
ret 0x14
Function at 0x401cb2
Capabilities:
Log keystrokes via polling

Disassembly:
jmp 0x4248d0
push esi
push 0x10
mov esi, ecx
call dword [sym.imp.USER32.dll_GetKeyState]
movsx eax, ax
and eax, 0x80000000
cmp eax, 0x80000000
sete cl
cmp dword [esi + 0x98], 0
je 0x42499c
or edx, 0xffffffff
test cl, cl
push edi
mov edi, dword [esi + 0xb4]
jne 0x42491e
mov dword [esi + 0xd4], edx
mov dword [esi + 0xac], edx
mov dword [esi + 0xd8], edx
mov dword [esi + 0xb0], edx
mov eax, dword [esp + 0xc]
test eax, eax
jle 0x42493c
add edi, eax
mov eax, dword [esi + 0xbc]
cmp edi, eax
jb 0x424953
lea edi, [eax - 1]
mov byte [esp + 0x10], 0
jmp 0x424953
jge 0x424953
push ebx
mov ebx, eax
neg ebx
cmp ebx, edi
pop ebx
ja 0x42494c
add edi, eax
jmp 0x424953
xor edi, edi
mov byte [esp + 0x10], 1
test cl, cl
je 0x424983
mov eax, dword [esi + 0xd4]
cmp eax, edx
je 0x424983
cmp eax, edi
mov dword [esi + 0xd8], edi
mov dword [esi + 0xac], eax
mov dword [esi + 0xb0], edi
jbe 0x424983
mov dword [esi + 0xb0], eax
mov dword [esi + 0xac], edi
push 1
push edi
push edi
mov ecx, esi
call fcn.0040376f
mov ecx, dword [esp + 0x10]
push ecx
push edi
mov ecx, esi
call fcn.004019ce
pop edi
pop esi
ret 8
Function at 0x40227f
Capabilities:
Terminate process

Disassembly:
jmp 0x463070
mov eax, dword [0x5c809c]
push eax
call fcn.004f9258
add esp, 4
test eax, eax
je 0x463084
jmp eax
push 2
call fcn.004f916d
add esp, 4
jmp fcn.00404200
Function at 0x402388
Capabilities:
Enumerate pe sections

Disassembly:
jmp 0x454f50
mov ecx, dword [esp + 4]
test ecx, ecx
jne 0x454f5d
xor eax, eax
ret 4
push esi
push edi
mov edi, dword [ecx + 0x128]
test edi, edi
je 0x454f95
mov esi, dword [ecx + 0x124]
test esi, esi
jne 0x454f95
mov eax, edi
neg eax
cmp eax, 0x40
jb 0x454fa2
mov edx, edi
movzx eax, word [edx + 0x16]
push ebx
movzx ebx, word [edx + 8]
movzx edx, word [edx + 0x14]
add eax, ebx
shl eax, 4
add eax, edx
pop ebx
jmp 0x454f9e
mov esi, dword [ecx + 0x124]
mov eax, dword [esi + 0x28]
test eax, eax
jne 0x454fa9
xor eax, eax
pop edi
pop esi
ret 4
test edi, edi
je 0x454fb1
test esi, esi
je 0x454fa4
pop edi
pop esi
mov dword [esp + 4], eax
jmp fcn.00403fda
Function at 0x4025bd
Capabilities:
Enumerate pe sections

Disassembly:
jmp 0x463ad0
mov ecx, dword [ecx + 0x124]
movzx eax, word [ecx + 0x14]
movzx edx, word [ecx + 6]
push esi
lea esi, [eax + ecx + 0x18]
xor eax, eax
test edx, edx
jbe 0x463b06
lea ecx, [esi + 0x10]
mov esi, edx
push edi
nop
mov edx, dword [ecx + 4]
mov edi, dword [ecx]
add edx, edi
cmp edx, eax
jbe 0x463afd
mov eax, edx
add ecx, 0x28
sub esi, 1
jne 0x463af0
pop edi
pop esi
ret

Function at 0x4027cf
Capabilities:
Write file on windows

Disassembly:
jmp 0x46f350
mov eax, dword [esp + 4]
sub esp, 0x28
push ebx
push edi
xor ebx, ebx
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x46f38e
push ebx
push ebx
push str.Error_Opening_ICO_File
call fcn.004b468e
pop edi
xor eax, eax
pop ebx
add esp, 0x28
ret 0xc
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
lea ecx, [esp + 0x3c]
push ecx
push 6
lea edx, [esp + 0x28]
mov eax, 1
push edx
push edi
mov word [esp + 0x30], bx
mov word [esp + 0x32], ax
mov word [esp + 0x34], ax
call ebp
test eax, eax
je 0x46f3c4
cmp dword [esp + 0x38], 6
je 0x46f3db
push ebx
push ebx
push str.Error_Writing_ICO
call fcn.004b468e
pop ebp
pop edi
xor eax, eax
pop ebx
add esp, 0x28
ret 0xc
push esi
mov esi, dword [esp + 0x40]
mov al, byte [esi + 4]
movzx edx, word [esi + 0xe]
mov cl, byte [esi + 8]
mov byte [esp + 0x10], al
movzx eax, word [esi + 0xc]
mov word [esp + 0x14], ax
movzx eax, ax
imul eax, edx
shr cl, 1
cmp eax, 8
mov byte [esp + 0x11], cl
mov byte [esp + 0x13], bl
mov word [esp + 0x16], bx
jl 0x46f417
mov byte [esp + 0x12], bl
jmp 0x46f426
movzx ecx, word [esi + 0xc]
imul ecx, edx
mov dl, 1
shl dl, cl
mov byte [esp + 0x12], dl
mov ebx, dword [esp + 0x44]
push 0
lea eax, [esp + 0x40]
push eax
push 0x10
lea ecx, [esp + 0x1c]
push ecx
push edi
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], 0x16
call ebp
test eax, eax
je 0x46f499
cmp dword [esp + 0x3c], 0x10
jne 0x46f499
cmp ebx, 0xffff
jbe 0x46f482
lea ebx, [ebx]
push 0
lea edx, [esp + 0x40]
push edx
push 0xffff
push esi
push edi
call ebp
test eax, eax
je 0x46f4a5
sub ebx, 0xffff
cmp ebx, 0xffff
ja 0x46f460
push 0
lea eax, [esp + 0x40]
push eax
push ebx
push esi
push edi
call ebp
test eax, eax
je 0x46f4a5
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ebp
pop edi
xor eax, eax
pop ebx
add esp, 0x28
ret 0xc
push 0
push 0
push str.Error_Writing_File
call fcn.004b468e
pop esi
pop ebp
pop edi
xor eax, eax
pop ebx
add esp, 0x28
ret 0xc
Function at 0x402b8f
Capabilities:
Parse pe header

Disassembly:
jmp 0x46eae0
push ebp
lea ebp, [esp - 0x404]
sub esp, 0x404
push 0xffffffffffffffff
push 0x555a48
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x5c1d10]
xor eax, ebp
mov dword [ebp + 0x400], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, ecx
mov edx, dword [eax + 0x110]
test edx, edx
jne 0x46eb5e
push str.Open_a_file_before_n
call fcn.004fa567
add esp, 4
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x400]
xor ecx, ebp
call fcn.004f409d
add ebp, 0x404
mov esp, ebp
pop ebp
ret 4
movzx ecx, word [edx]
cmp cx, 0x5a4d
je 0x46eb6f
push str.Not_a_windows_executable_n
jmp 0x46eb2d
mov ecx, dword [edx + 0x3c]
cmp dword [edx + ecx], 0x4550
je 0x46eb82
push str.Not_a_PE_format_executable_n
jmp 0x46eb2d
add ecx, 4
mov dword [eax + 0x120], ecx
lea esi, [edx + ecx]
mov dword [eax + 0x124], esi
add ecx, 0x14
lea esi, [edx + ecx]
mov dword [eax + 0x12c], esi
add esi, 0x60
mov dword [eax + 0x134], esi
mov esi, dword [eax + 0x124]
movzx esi, word [esi + 0x10]
add ecx, esi
add edx, ecx
mov dword [eax + 0x138], edx
mov dword [ebp - 4], 0
cmp byte [ebp + 0x40c], 0
je 0x46ec0a
xor edx, edx
mov dword [ebp - 0x14], edx
mov ecx, dword [eax + 0x124]
movzx ecx, word [ecx + 2]
cmp edx, ecx
jae 0x46ec0a
lea ecx, [edx + edx*4]
add ecx, ecx
add ecx, ecx
add ecx, ecx
mov esi, dword [eax + 0x138]
add esi, ecx
mov edi, dword [esi + 0xc]
mov dword [esi + 0x14], edi
mov esi, dword [eax + 0x138]
add ecx, esi
mov esi, dword [ecx + 8]
mov dword [ecx + 0x10], esi
add edx, 1
jmp 0x46ebcf
mov dword [ebp - 4], 0xffffffff
mov al, 1
jmp 0x46eb37
Function at 0x402cde
Capabilities:
Check for time delay via gettickcount

Disassembly:
jmp 0x446d50
push 0xffffffffffffffff
push 0x550e58
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5c1d10]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 0x14]
call fcn.00404bc4
mov dword [esp + 0x30], 0
mov eax, dword [esi + 0x74]
add eax, 0x7c
push eax
lea ecx, [esp + 0x20]
call fcn.00404133
mov bl, 1
mov byte [esp + 0x30], bl
mov ecx, dword [esp + 0x1c]
cmp dword [ecx - 0xc], 0
jne 0x446dbf
push 0
push 0
push str.Please_select_a_file_
mov ecx, esi
call fcn.004b9f2e
jmp 0x446ec9
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
push 0x484
mov ecx, esi
mov ebp, eax
call fcn.004bf5a3
mov edx, dword [eax + 0x20]
push 0
push 0
push pe_nt_image_headers32
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
test eax, eax
je 0x446e36
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push 0x5647d4
call fcn.00404133
mov byte [esp + 0x34], 2
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.Press__ESC__for_cancel...
call fcn.00404133
mov byte [esp + 0x38], 3
mov byte [esp + 0x38], bl
mov ecx, esi
call fcn.004040b1
lea eax, [esp + 0x20]
push eax
mov ecx, esi
call fcn.0040119a
mov byte [esp + 0x30], 4
jmp 0x446e47
lea ecx, [esp + 0x20]
push ecx
mov ecx, esi
call fcn.00404359
mov byte [esp + 0x30], 5
push eax
lea ecx, [esp + 0x18]
call fcn.00402432
mov byte [esp + 0x30], bl
lea ecx, [esp + 0x20]
call fcn.00402798
call edi
lea ecx, [esp + 0x18]
mov edi, eax
call fcn.00404bc4
mov byte [esp + 0x30], 6
sub edi, ebp
push edi
lea edx, [esp + 0x1c]
push str.searching_time_:__i_ms
push edx
call fcn.004012df
add esp, 8
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
call fcn.004015fa
mov byte [esp + 0x34], 7
push ecx
lea edx, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x28], esp
push edx
call fcn.004015fa
mov byte [esp + 0x38], 8
mov byte [esp + 0x38], 6
mov ecx, esi
call fcn.004040b1
mov byte [esp + 0x30], bl
lea ecx, [esp + 0x18]
call fcn.00402798
mov byte [esp + 0x30], 0
lea ecx, [esp + 0x1c]
call fcn.00402798
mov dword [esp + 0x30], 0xffffffff
lea ecx, [esp + 0x14]
call fcn.00402798
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x402d4c
Capabilities:
Enumerate pe sections
Parse pe header
Read file via mapping

Disassembly:
jmp 0x472910
mov eax, dword [esp + 4]
push ebx
push ebp
push esi
xor ebx, ebx
push ebx
push 0x80
push 3
mov esi, ecx
push ebx
push 3
push SysReAllocString
mov ebp, 1
push eax
mov dword [esi], ebx
mov dword [esi + 8], ebx
mov dword [esi + 4], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x28], ebp
mov dword [esi + 0x34], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x38], ebp
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esi + 0x2c], eax
je 0x472a4d
push ebx
push ebx
push ebx
push 2
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
cmp eax, ebx
mov dword [esi + 0x30], eax
je 0x472a4d
push ebx
push ebx
push ebx
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
cmp eax, ebx
mov dword [esi + 0x34], eax
je 0x472a4d
cmp word [eax], 0x5a4d
jne 0x472a4d
mov ecx, dword [eax + 0x3c]
push edi
lea edi, [ecx + eax]
push 0xf8
push edi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x472a4c
cmp dword [edi], 0x4550
jne 0x472a4c
cmp word [edi + 0x18], 0x20b
jne 0x4729c8
mov eax, ebp
cmp eax, ebx
mov edx, dword [esi + 0x34]
mov dword [esi + 0xc], edx
je 0x4729da
mov ebp, dword [edi + 0x98]
jmp 0x4729e0
mov ebp, dword [edi + 0x88]
cmp eax, ebx
mov dword [esi + 4], ebp
je 0x4729ef
mov eax, dword [edi + 0x9c]
jmp 0x4729f5
mov eax, dword [edi + 0x8c]
cmp ebp, ebx
mov dword [esi + 8], eax
je 0x472a4c
mov dword [esi], ebp
movzx eax, word [edi + 0x14]
lea eax, [eax + edi + 0x18]
movzx edi, word [edi + 6]
test edi, edi
jbe 0x472a36
mov edi, edi
mov ecx, dword [eax + 8]
test ecx, ecx
mov edx, dword [eax + 0xc]
je 0x472a1f
cmp ecx, dword [eax + 0x10]
jae 0x472a22
mov ecx, dword [eax + 0x10]
cmp ebp, edx
jb 0x472a2c
add ecx, edx
cmp ebp, ecx
jb 0x472a36
add ebx, 1
add eax, 0x28
cmp ebx, edi
jb 0x472a10
mov ecx, dword [eax + 0x10]
mov dword [esi + 0x18], ecx
mov edx, dword [eax + 0x14]
sub edx, dword [eax + 0xc]
mov ecx, esi
mov dword [esi + 0x10], edx
call fcn.00402a95
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x402f3b
Capabilities:
Read file on windows

Disassembly:
jmp 0x46f090
push ecx
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x110]
xor ebx, ebx
cmp eax, ebx
push edi
je 0x46f0b6
cmp byte [esi + 4], bl
jne 0x46f0b0
push eax
call fcn.004b1504
add esp, 4
mov dword [esi + 0x110], ebx
mov edi, dword [esp + 0x14]
push 0x5866e4
lea eax, [esp + 0x10]
push edi
push eax
call fcn.004f9b26
mov eax, dword [esp + 0x18]
add esp, 0xc
cmp eax, ebx
jne 0x46f0ec
push edi
push str.Cant_open_for_reading_the_file__s_n
call fcn.004fa567
add esp, 8
pop edi
pop esi
xor al, al
pop ebx
pop ecx
ret 4
push 2
push ebx
push eax
call fcn.004fa081
mov ecx, dword [esp + 0x18]
push ecx
call fcn.004f9f8c
mov edx, dword [esp + 0x1c]
push ebx
push ebx
push edx
mov dword [esi + 0x114], eax
call fcn.004fa081
mov eax, dword [esi + 0x114]
push eax
call fcn.004b14ff
mov ecx, dword [esp + 0x2c]
mov edx, dword [esi + 0x114]
push ecx
push edx
push 1
push eax
mov dword [esi + 0x110], eax
call fcn.004fa972
add esp, 0x30
cmp eax, dword [esi + 0x114]
je 0x46f181
push edi
push str.Cant_open_for_reading_the_whole_file__s_n
call fcn.004fa567
mov eax, dword [esp + 0x14]
push eax
call fcn.004f984c
mov eax, dword [esi + 0x110]
add esp, 0xc
cmp eax, ebx
je 0x46f178
cmp byte [esi + 4], bl
jne 0x46f172
push eax
call fcn.004b1504
add esp, 4
mov dword [esi + 0x110], ebx
pop edi
pop esi
xor al, al
pop ebx
pop ecx
ret 4
mov ecx, dword [esp + 0xc]
push ecx
call fcn.004f984c
add esp, 4
push ebx
mov ecx, esi
call fcn.00402b8f
mov bl, al
test bl, bl
je 0x46f1ae
push edi
push 0x104
add esi, 0xc
push esi
call fcn.004f63c1
add esp, 0xc
pop edi
pop esi
mov al, bl
pop ebx
pop ecx
ret 4

Function at 0x4032b0
Capabilities:
Write file on windows

Disassembly:
jmp 0x46e420
push esi
mov esi, ecx
cmp dword [esi + 0x110], 0
jne 0x46e43f
push str.Open_a_file_before___n
call fcn.004fa567
add esp, 4
xor al, al
pop esi
ret 4
push edi
mov edi, dword [esp + 0xc]
push 0x5865d0
lea eax, [esp + 0x10]
push edi
push eax
call fcn.004f9b26
mov eax, dword [esp + 0x18]
add esp, 0xc
test eax, eax
jne 0x46e474
push edi
push str.Cant_open_for_writing_the_file__s_n
call fcn.004fa567
add esp, 8
pop edi
xor al, al
pop esi
ret 4
mov ecx, dword [esi + 0x114]
mov edx, dword [esi + 0x110]
push eax
push ecx
push 1
push edx
call fcn.004fa265
add esp, 0x10
cmp eax, dword [esi + 0x114]
je 0x46e4b3
push str.Cant_write_the_whole_executable_n
call fcn.004fa567
mov eax, dword [esp + 0x10]
push eax
call fcn.004f984c
add esp, 8
pop edi
xor al, al
pop esi
ret 4
mov ecx, dword [esp + 0xc]
push ecx
call fcn.004f984c
add esp, 4
pop edi
mov al, 1
pop esi
ret 4
Function at 0x40367f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
jmp 0x40c950
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x40c969
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x40c9a4
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x40c9a0
lea ebx, [ebx]
cmp esi, eax
jae 0x40c9a4
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x40c990
cmp esi, eax
jb 0x40c9aa
pop esi
pop edi
xor eax, eax
pop ebx
ret
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret
Function at 0x403b1b
Capabilities:
Write file on windows

Disassembly:
jmp 0x470390
mov eax, dword [esp + 8]
push 0x5865d0
push eax
lea ecx, [esp + 0x10]
push ecx
call fcn.004f9b26
mov eax, dword [esp + 0x14]
add esp, 0xc
test eax, eax
jne 0x4703b7
mov eax, 0xfffffffc
ret 0x10
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0x14]
push eax
mov eax, dword [esp + 0x14]
push esi
add edx, eax
push 1
push edx
call fcn.004fa265
add esp, 0x10
cmp eax, esi
je 0x4703e0
mov eax, 0xfffffffd
pop esi
ret 0x10
mov ecx, dword [esp + 0xc]
push ecx
call fcn.004f984c
add esp, 4
mov eax, esi
pop esi
ret 0x10
Function at 0x403d00
Capabilities:
Get graphical window text

Disassembly:
jmp 0x44ce00
sub esp, 0x404
mov eax, dword [0x5c1d10]
xor eax, esp
mov dword [esp + 0x400], eax
mov eax, dword [esp + 0x410]
push ebx
mov ebx, dword [esp + 0x410]
push ebp
mov ebp, dword [esp + 0x410]
push esi
mov esi, dword [esp + 0x420]
push edi
mov edi, dword [sym.imp.USER32.dll_GetWindowTextA]
push 0x100
lea ecx, [esp + 0x114]
push ecx
push eax
call edi
push 0x100
lea edx, [esp + 0x14]
push edx
push esi
call edi
lea eax, [esp + 0x10]
push 0x20
push eax
call fcn.004f88c0
add esp, 8
test eax, eax
jne 0x44cee2
lea esi, [esp + 0x110]
push 0x5c
push esi
call fcn.004f88c0
add eax, 1
mov esi, eax
push 0x5c
push esi
call fcn.004f88c0
add esp, 0x10
test eax, eax
jne 0x44ce71
push 0xff
push esi
call fcn.004f8b2d
lea ecx, [esp + 0x18]
push ecx
push esi
lea edx, [esp + 0x220]
push str._s__s
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
lea eax, [esp + 0x210]
push eax
push 0xffffffffffffffff
push 0x1a2
push ebx
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 0xffffffff
je 0x44cee9
push 0x10
push str.PEImport_Function_Adder
push str.Function_already_imported
push ebp
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, 1
jmp 0x44ceeb
xor eax, eax
mov ecx, dword [esp + 0x410]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004f409d
add esp, 0x404
ret 0x10

Function at 0x403de1
Capabilities:
Enumerate pe sections

Disassembly:
jmp 0x463760
mov ecx, dword [ecx + 0x124]
movzx eax, word [ecx + 0x14]
push ebx
push esi
movzx esi, word [ecx + 6]
xor edx, edx
test esi, esi
push edi
lea eax, [eax + ecx + 0x18]
jbe 0x46379a
mov edi, dword [esp + 0x10]
nop
mov ecx, dword [eax + 0x14]
cmp edi, ecx
jb 0x463790
mov ebx, dword [eax + 0x10]
add ebx, ecx
cmp edi, ebx
jb 0x4637a3
add edx, 1
add eax, 0x28
cmp edx, esi
jb 0x463780
pop edi
pop esi
or eax, 0xffffffff
pop ebx
ret 4
mov edx, edi
sub edx, ecx
cmp edx, dword [eax + 8]
ja 0x46379a
mov eax, dword [eax + 0xc]
sub eax, ecx
add eax, edi
pop edi
pop esi
pop ebx
ret 4

Function at 0x403e81
Capabilities:
Extract resource via kernel32 functions

Disassembly:
jmp 0x4834b0
mov eax, dword [esp + 4]
push esi
push edi
mov esi, ecx
mov ecx, dword [esp + 0x10]
mov edx, dword [esi + 8]
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x4834e2
push str.Could_not_locate_resource.
call fcn.004fa567
add esp, 4
pop edi
xor eax, eax
pop esi
ret 0x10
mov eax, dword [esi + 8]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x483505
push str.Could_not_load_resource.
call fcn.004fa567
add esp, 4
pop edi
xor eax, eax
pop esi
ret 0x10
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
jne 0x48352a
push str.Could_not_lock_resource.
call fcn.004fa567
add esp, 4
pop edi
xor eax, eax
pop esi
ret 0x10
mov edx, dword [esi + 8]
push edi
push edx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x14]
pop edi
mov dword [ecx], eax
mov eax, 1
pop esi
ret 0x10