joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42df46
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x58], ebx
test ebx, 0xffff0000
jne 0x42df6a
cmp dword [edi + 0x54], 0
jne 0x42df6a
movzx eax, bx
mov dword [edi + 0x54], eax
call fcn.0043a223
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.0042df07
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x433994
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x4339db
call fcn.0043a223
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x4339db
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x4339f7
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.0043350e
mov esi, eax
test edi, edi
je 0x4339f5
test ebx, ebx
je 0x4339f5
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x4348e7
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x46bbc6
call fcn.0044e939
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x43490c
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x434952
lea ecx, [ebp - 0x10]
call fcn.00402620
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004340aa
add esp, 0x10
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00402920
mov eax, esi
call fcn.0044ea11
ret 8
Function at 0x438f32
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
cmp dword [ebp + 0xc], ebx
je 0x438f7a
call fcn.0043a223
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x438f7a
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
test eax, eax
je 0x438fbd
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
test ebx, ebx
je 0x438fa6
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x438fa6
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x438fba
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x44b4c8
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x48bb84]
jne 0x44b4d2
repz ret
jmp fcn.00452575
Function at 0x4607c7
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00453668
and dword [ebp - 4], 0
cmp dword [0x491318], 0
mov ebx, eax
jne 0x460878
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x460929
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x47aab4
push edi
call esi
test eax, eax
je 0x460929
push eax
call fcn.004535f6
mov dword [esp], 0x47aaa4
push edi
mov dword [0x491318], eax
call esi
push eax
call fcn.004535f6
mov dword [esp], 0x47aa90
push edi
mov dword [0x49131c], eax
call esi
push eax
call fcn.004535f6
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x491320], eax
call esi
push eax
call fcn.004535f6
pop ecx
mov dword [0x491328], eax
test eax, eax
je 0x460878
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004535f6
pop ecx
mov dword [0x491324], eax
mov eax, dword [0x491324]
cmp eax, ebx
je 0x4608d0
cmp dword [0x491328], ebx
je 0x4608d0
push eax
call fcn.00453671
push dword [0x491328]
mov esi, eax
call fcn.00453671
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4608d0
test edi, edi
je 0x4608d0
call esi
test eax, eax
je 0x4608c7
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4608c7
test byte [ebp - 0xc], 1
jne 0x4608d0
or dword [ebp + 0x10], 0x200000
jmp 0x460909
mov eax, dword [0x49131c]
cmp eax, ebx
je 0x460909
push eax
call fcn.00453671
pop ecx
test eax, eax
je 0x460909
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x460909
mov eax, dword [0x491320]
cmp eax, ebx
je 0x460909
push eax
call fcn.00453671
pop ecx
test eax, eax
je 0x460909
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x491318]
call fcn.00453671
pop ecx
test eax, eax
je 0x460929
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x46092b
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401c10
Capabilities:
Query environment variable

Disassembly:
push ebp
mov eax, 0x812c
mov ebp, esp
push edi
push esi
push ebx
call fcn.00406960
lea edi, [ebp - 0x8018]
xor ebx, ebx
mov esi, 0x7fff
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], edi
call sub.msvcrt.dll_memset
mov dword [esp + 4], edi
mov ecx, 0x7fff
mov dword [esp + 8], ecx
mov dword [esp], str.Launch4j
call sub.KERNEL32.dll_GetEnvironmentVariableA
mov eax, dword [ebp + 8]
sub esp, 0xc
mov edx, str.__l4j_debug
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.msvcrt.dll_strstr
test eax, eax
je 0x401d66
lea ebx, [ebp - 0x8128]
mov edx, 0x104
xor esi, esi
mov dword [esp + 8], edx
mov dword [esp + 4], esi
mov esi, 0x6f6c2e6a
mov dword [esp], ebx
call sub.msvcrt.dll_memset
mov dword [esp], ebx
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], ecx
mov dword [esp + 4], eax
call sub.msvcrt.dll_strncpy
mov dword [esp], ebx
call sub.msvcrt.dll_strlen
mov dword [eax + ebx], 0x75616c5c
mov edx, 0x3468636e
mov ecx, 0x408090
mov dword [eax + ebx + 4], edx
mov dword [eax + ebx + 8], esi
mov word [eax + ebx + 0xc], 0x67
mov dword [esp], ebx
mov dword [esp + 4], ecx
call sub.msvcrt.dll_fopen
mov dword [0x409090], eax
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x401d5e
mov eax, dword [ebp + 8]
mov ecx, str.__l4j_debug_all
xor esi, esi
mov dword [esp + 4], ecx
mov dword [esp], eax
call sub.msvcrt.dll_strstr
test eax, eax
je 0x401d87
mov esi, 1
mov dword [0x409028], esi
test ebx, ebx
je 0x401d59
mov dword [esp], ebx
mov esi, 0x4080b7
mov edi, str._n_nVersion:_t_s_n
mov dword [esp + 8], esi
mov dword [esp + 4], edi
call sub.msvcrt.dll_fprintf
mov eax, dword [0x409090]
test eax, eax
je 0x401d59
mov dword [esp], eax
mov edx, dword [ebp + 8]
mov ebx, str.CmdLine:_t_s__s_n
mov dword [esp + 4], ebx
mov ecx, dword [ebp + 0xc]
mov dword [esp + 0xc], edx
mov dword [esp + 8], ecx
call sub.msvcrt.dll_fprintf
mov eax, 1
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], edi
mov edx, str.debug
mov dword [esp + 4], edx
call sub.msvcrt.dll_strstr
test eax, eax
jne 0x401c75
mov ebx, dword [0x409090]
jmp 0x401d13
mov dword [esp], edi
mov edx, str.debug_all
mov dword [esp + 4], edx
call sub.msvcrt.dll_strstr
test eax, eax
jne 0x401d08
jmp 0x401d0d
Function at 0x401eb0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
call sub.KERNEL32.dll_GetLastError
mov ebx, eax
mov eax, dword [0x409090]
test eax, eax
jne 0x402038
test ebx, ebx
jne 0x401fb0
mov ecx, dword [0x409024]
test ecx, ecx
je 0x401f80
cmp byte [0x411690], 0
jne 0x401f50
mov dword [esp], 0x411710
call sub.msvcrt.dll_puts
cmp byte [0x411b10], 0
je 0x401f42
mov eax, dword [0x409090]
test eax, eax
jne 0x402057
mov dword [esp], 0
mov eax, 1
xor ecx, ecx
mov dword [esp + 0x14], eax
mov edx, 0x411b10
mov eax, str.open
mov dword [esp + 0x10], ecx
xor ebx, ebx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], edx
mov dword [esp + 4], eax
call sub.SHELL32.DLL_ShellExecuteA
sub esp, 0x18
mov eax, dword [0x409090]
test eax, eax
jne 0x401f70
mov ebx, dword [ebp - 4]
leave
ret
mov dword [esp], str._s:__s_n
mov edx, 0x411690
mov eax, 0x411710
mov dword [esp + 8], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_printf
jmp 0x401ef6
mov dword [esp], eax
call sub.msvcrt.dll_fclose
mov ebx, dword [ebp - 4]
leave
ret
mov dword [esp], 0
xor edx, edx
mov ecx, 0x411690
mov dword [esp + 0xc], edx
mov ebx, 0x411710
mov dword [esp + 8], ecx
mov dword [esp + 4], ebx
call sub.USER32.dll_MessageBoxA
sub esp, 0x10
jmp 0x401ef6
mov dword [esp + 8], ebx
xor eax, eax
xor ecx, ecx
mov dword [esp + 0x18], eax
lea edx, [ebp - 8]
mov eax, 0x400
mov dword [esp + 0x10], edx
xor ebx, ebx
mov dword [esp + 0x14], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 4], ebx
mov dword [esp], 0x1300
call sub.KERNEL32.dll_FormatMessageA
mov edx, dword [0x409090]
sub esp, 0x1c
test edx, edx
jne 0x402076
mov dword [esp], 0x411710
mov ebx, 0xa0a
call sub.msvcrt.dll_strlen
mov word [eax + 0x411710], bx
mov byte [eax + 0x411712], 0
mov eax, dword [ebp - 8]
mov dword [esp], 0x411710
mov dword [esp + 4], eax
call sub.msvcrt.dll_strcat
mov edx, dword [ebp - 8]
mov dword [esp], edx
call sub.KERNEL32.dll_LocalFree
sub esp, 4
jmp 0x401ed3
mov dword [esp], eax
mov ecx, 0x411710
mov edx, str.Error_msg:_t_s_n
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
call sub.msvcrt.dll_fprintf
jmp 0x401ecb
mov dword [esp], eax
mov ecx, 0x411b10
mov ebx, str.Open_URL:_t_s_n
mov dword [esp + 8], ecx
mov dword [esp + 4], ebx
call sub.msvcrt.dll_fprintf
jmp 0x401f0c
mov ecx, dword [ebp - 8]
mov ebx, str.Error:_t_t_s_n
mov dword [esp + 4], ebx
mov dword [esp], edx
mov dword [esp + 8], ecx
call sub.msvcrt.dll_fprintf
jmp 0x401ff3
Function at 0x4020a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov eax, 0x400
mov ebp, esp
push esi
mov edx, 0xa
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov dword [esp + 0xc], eax
movzx ecx, si
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov eax, dword [0x411680]
mov dword [esp], eax
call sub.KERNEL32.dll_FindResourceExA
sub esp, 0x10
test eax, eax
je 0x40213b
mov dword [esp + 4], eax
mov edx, dword [0x411680]
mov dword [esp], edx
call sub.KERNEL32.dll_LoadResource
sub esp, 8
test eax, eax
je 0x402150
mov dword [esp], eax
call sub.KERNEL32.dll_LockResource
sub esp, 4
test eax, eax
mov ecx, eax
je 0x402150
xor edx, edx
mov esi, esi
lea edi, [edi]
movzx eax, byte [edx + ecx]
mov byte [edx + ebx], al
inc edx
test al, al
jne 0x402110
mov ecx, dword [0x409028]
test ecx, ecx
je 0x40212f
mov eax, dword [0x409090]
test eax, eax
jne 0x402159
mov eax, 1
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
mov dword [esp], 0
call sub.KERNEL32.dll_SetLastError
mov byte [ebx], 0
sub esp, 4
lea esi, [esi]
lea esp, [ebp - 8]
xor eax, eax
pop ebx
pop esi
pop ebp
ret
mov dword [esp + 0xc], ebx
mov ebx, str.Resource__d:_t_s_n
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov eax, 1
jmp 0x402134

Function at 0x402180
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
xor eax, eax
mov ebp, esp
push edi
cld
mov ecx, 5
push esi
lea edi, [ebp - 0x38]
push ebx
sub esp, 0x4c
rep stosd dword es:[edi], eax
mov esi, dword [ebp + 8]
mov ecx, 0x400
mov edi, 0xa
mov dword [esp + 0xc], ecx
lea ebx, [ebp - 0x38]
mov dword [esp + 4], edi
movzx edx, si
mov dword [esp + 8], edx
mov eax, dword [0x411680]
mov dword [esp], eax
call sub.KERNEL32.dll_FindResourceExA
sub esp, 0x10
test eax, eax
je 0x40225d
mov dword [esp + 4], eax
mov edx, dword [0x411680]
mov dword [esp], edx
call sub.KERNEL32.dll_LoadResource
sub esp, 8
test eax, eax
je 0x402240
mov dword [esp], eax
call sub.KERNEL32.dll_LockResource
sub esp, 4
test eax, eax
mov ecx, eax
je 0x402240
xor edx, edx
lea esi, [esi]
movzx eax, byte [edx + ecx]
mov byte [edx + ebx], al
inc edx
test al, al
jne 0x402200
mov ecx, dword [0x409028]
test ecx, ecx
je 0x402240
mov eax, dword [0x409090]
test eax, eax
je 0x402240
mov dword [esp + 8], esi
mov esi, str.Resource__d:_t_s_n
mov dword [esp + 0xc], ebx
mov dword [esp + 4], esi
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
nop
lea esi, [esi]
cld
mov esi, ebx
mov edi, str.true
mov ecx, 5
repe cmpsb byte [esi], byte es:[edi]
sete bl
lea esp, [ebp - 0xc]
movzx eax, bl
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], 0
mov esi, ebx
mov edi, str.true
call sub.KERNEL32.dll_SetLastError
mov byte [ebp - 0x38], 0
cld
mov ecx, 5
sub esp, 4
repe cmpsb byte [esi], byte es:[edi]
sete bl
lea esp, [ebp - 0xc]
movzx eax, bl
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x402390
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov edx, str.HKEY_CLASSES_ROOT
mov ebp, esp
push edi
push esi
mov esi, 0x80000000
push ebx
sub esp, 0x2c
mov ebx, dword [ebp + 8]
mov dword [esp + 4], edx
mov dword [esp], ebx
call sub.msvcrt.dll_strstr
cmp eax, ebx
je 0x402428
mov dword [esp], ebx
mov eax, str.HKEY_CURRENT_USER
mov esi, 0x80000001
mov dword [esp + 4], eax
call sub.msvcrt.dll_strstr
cmp eax, ebx
je 0x402428
mov dword [esp], ebx
mov ecx, str.HKEY_LOCAL_MACHINE
mov esi, 0x80000002
mov dword [esp + 4], ecx
call sub.msvcrt.dll_strstr
cmp eax, ebx
je 0x402428
mov dword [esp], ebx
mov esi, str.HKEY_USERS
mov dword [esp + 4], esi
mov esi, 0x80000003
call sub.msvcrt.dll_strstr
cmp eax, ebx
je 0x402428
mov dword [esp], ebx
mov edi, str.HKEY_CURRENT_CONFIG
mov esi, 0x80000005
mov dword [esp + 4], edi
call sub.msvcrt.dll_strstr
cmp eax, ebx
je 0x402428
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], ebx
mov ecx, 0x5c
mov dword [esp + 4], ecx
call sub.msvcrt.dll_strchr
mov dword [esp], ebx
lea edi, [eax + 1]
mov eax, 0x5c
mov dword [esp + 4], eax
call sub.msvcrt.dll_strrchr
lea ebx, [eax + 1]
mov byte [ebx - 1], 0
mov edx, dword [0x409020]
mov dword [ebp - 0x18], 0
test edx, edx
jne 0x4024e3
mov dword [esp + 4], edi
xor edx, edx
lea ecx, [ebp - 0x10]
mov dword [esp + 0x10], ecx
mov eax, 0x20019
mov dword [esp + 0xc], eax
mov dword [esp + 8], edx
mov dword [esp], esi
call sub.ADVAPI32.DLL_RegOpenKeyExA
sub esp, 0x14
test eax, eax
jne 0x4024d4
lea edx, [ebp + 0x10]
xor ecx, ecx
lea esi, [ebp - 0x14]
mov dword [esp + 0x14], edx
mov edi, dword [ebp + 0xc]
mov dword [esp + 0xc], esi
mov dword [esp + 8], ecx
mov dword [esp + 0x10], edi
mov dword [esp + 4], ebx
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegQueryValueExA
sub esp, 0x18
mov esi, dword [ebp - 0x10]
test eax, eax
sete dl
movzx edi, dl
mov dword [ebp - 0x18], edi
mov dword [esp], esi
call sub.ADVAPI32.DLL_RegCloseKey
sub esp, 4
mov byte [ebx - 1], 0x5c
mov eax, dword [ebp - 0x18]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], edi
xor edx, edx
lea ecx, [ebp - 0x10]
mov dword [esp + 0x10], ecx
mov eax, 0x20119
mov dword [esp + 0xc], eax
mov dword [esp + 8], edx
mov dword [esp], esi
call sub.ADVAPI32.DLL_RegOpenKeyExA
sub esp, 0x14
test eax, eax
je 0x40248e
jmp 0x402465
Function at 0x402730
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov edx, 0x104
mov ebp, esp
push edi
xor eax, eax
xor edi, edi
push esi
push ebx
sub esp, 0x25c
lea ebx, [ebp - 0x23c]
mov dword [esp + 8], edx
mov esi, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov dword [ebp - 0x248], esi
lea esi, [ebp - 0x128]
mov dword [esp], esi
call sub.msvcrt.dll_memset
mov dword [esp + 0x10], ebx
mov ecx, dword [ebp - 0x248]
xor edx, edx
mov dword [esp + 8], edx
mov eax, dword [ebp + 8]
mov dword [esp], 0x80000002
and ecx, 0x100
or ecx, 0x20019
mov dword [esp + 0xc], ecx
mov dword [esp + 4], eax
call sub.ADVAPI32.DLL_RegOpenKeyExA
sub esp, 0x14
test eax, eax
je 0x4027c0
mov esi, 1
mov dword [0x4111dc], esi
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
xor edx, edx
lea ebx, [ebp - 0x238]
mov ecx, 0x104
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], ebx
call sub.msvcrt.dll_memset
mov dword [esp + 0x10], ebx
lea ecx, [ebp - 0x240]
mov eax, 0x104
mov dword [esp + 0x14], ecx
mov ecx, dword [ebp - 0x23c]
lea edx, [ebp - 0x244]
mov dword [ebp - 0x240], eax
mov ebx, str.JavaHome
xor eax, eax
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov dword [esp + 4], ebx
mov dword [esp], ecx
call sub.ADVAPI32.DLL_RegQueryValueExA
sub esp, 0x18
test eax, eax
jne 0x40287d
xor edx, edx
lea esi, [esi]
lea edi, [edi]
movzx ebx, byte [edx + ebp - 0x238]
mov byte [edx + ebp - 0x128], bl
inc edx
test bl, bl
jne 0x402830
test byte [ebp - 0x248], 2
je 0x402873
mov dword [esp], esi
call sub.msvcrt.dll_strlen
cmp byte [eax + esi - 1], 0x5c
je 0x402862
mov word [eax + esi], 0x5c
mov dword [esp], esi
mov edi, 0x408203
mov dword [esp + 4], edi
call sub.msvcrt.dll_strcat
mov dword [esp], esi
call fcn.00402620
mov edi, eax
mov eax, dword [ebp - 0x23c]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegCloseKey
sub esp, 4
test edi, edi
je 0x4027a4
mov dword [esp + 4], esi
mov dword [esp], 0x411464
call sub.msvcrt.dll_strcpy
jmp 0x4027af
Function at 0x402b40
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 8], esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], edi
mov eax, dword [0x4111d0]
cmp eax, 9
je 0x402be0
cmp eax, 2
je 0x402ba0
jle 0x402b85
cmp eax, 3
je 0x402ca2
cmp eax, 4
je 0x402baa
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
dec eax
jne 0x402b78
mov edx, dword [0x409020]
test edx, edx
je 0x402b78
mov ecx, ebx
or ecx, 0x100
mov dword [esp + 4], ecx
jmp 0x402bae
mov edi, dword [0x409020]
test edi, edi
jne 0x402bc3
mov dword [esp + 4], ebx
mov dword [esp], esi
call fcn.004028b0
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov dword [esp], esi
mov eax, ebx
or eax, 0x100
mov dword [esp + 4], eax
call fcn.004028b0
test byte [0x4111d5], 1
jmp 0x402b76
cld
xor eax, eax
lea edx, [ebp - 0x38]
mov edi, edx
mov ecx, 5
rep stosd dword es:[edi], eax
mov eax, 0x400
mov ecx, 0x1e
mov edi, edx
mov dword [esp + 0xc], eax
mov edx, 0xa
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov eax, dword [0x411680]
mov dword [esp], eax
call sub.KERNEL32.dll_FindResourceExA
sub esp, 0x10
test eax, eax
je 0x402cc9
mov dword [esp + 4], eax
mov edx, dword [0x411680]
mov dword [esp], edx
call sub.KERNEL32.dll_LoadResource
sub esp, 8
test eax, eax
je 0x402c90
mov dword [esp], eax
call sub.KERNEL32.dll_LockResource
sub esp, 4
test eax, eax
mov ecx, eax
je 0x402c90
xor edx, edx
movzx eax, byte [edx + ecx]
mov byte [edx + edi], al
inc edx
test al, al
jne 0x402c50
mov ecx, dword [0x409028]
test ecx, ecx
je 0x402c90
mov eax, dword [0x409090]
test eax, eax
je 0x402c90
mov dword [esp + 0xc], edi
mov ecx, 0x1e
mov edx, str.Resource__d:_t_s_n
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
lea esi, [esi]
mov dword [esp], edi
call sub.msvcrt.dll_atoi
mov dword [0x4111d0], eax
jmp 0x402b63
mov dword [esp + 4], ebx
mov dword [esp], esi
call fcn.004028b0
mov eax, dword [0x4111d4]
test eax, eax
je 0x402b88
test ah, 1
je 0x402b78
jmp 0x402b88
mov dword [esp], 0
call sub.KERNEL32.dll_SetLastError
mov byte [ebp - 0x38], 0
sub esp, 4
jmp 0x402c90
Function at 0x404ee0
Capabilities:
Extract resource via kernel32 functions
Set environment variable

Disassembly:
push ebp
mov eax, 0x1001c
mov ebp, esp
push edi
push esi
push ebx
call fcn.00406960
lea esi, [ebp - 0x8018]
xor ebx, ebx
mov edi, dword [ebp + 0xc]
mov dword [esp + 4], ebx
mov eax, 0x8000
lea ebx, [ebp - 0x10018]
mov dword [esp + 8], eax
mov dword [esp], esi
call sub.msvcrt.dll_memset
mov dword [esp], ebx
xor edx, edx
mov ecx, 0x7fff
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
call sub.msvcrt.dll_memset
mov eax, 0x400
mov ecx, 0x13
mov edx, 0xa
mov dword [esp + 0xc], eax
mov eax, dword [0x411680]
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.KERNEL32.dll_FindResourceExA
sub esp, 0x10
test eax, eax
je 0x40506c
mov dword [esp + 4], eax
mov edx, dword [0x411680]
mov dword [esp], edx
call sub.KERNEL32.dll_LoadResource
sub esp, 8
test eax, eax
je 0x404fd0
mov dword [esp], eax
call sub.KERNEL32.dll_LockResource
sub esp, 4
test eax, eax
mov ecx, eax
je 0x404fd0
xor edx, edx
lea esi, [esi]
movzx eax, byte [edx + ecx]
mov byte [edx + ebx], al
inc edx
test al, al
jne 0x404f90
mov ecx, dword [0x409028]
test ecx, ecx
je 0x404fd0
mov eax, dword [0x409090]
test eax, eax
je 0x404fd0
mov dword [esp + 0xc], ebx
mov ecx, 0x13
mov edx, str.Resource__d:_t_s_n
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
lea esi, [esi]
mov dword [esp], ebx
mov eax, 0x408438
mov dword [esp + 4], eax
jmp 0x404fff
mov dword [esp], ebx
mov ebx, 0x408438
mov dword [esp + 4], esi
call sub.KERNEL32.dll_SetEnvironmentVariableA
sub esp, 8
mov dword [esp + 4], ebx
mov dword [esp], 0
call sub.msvcrt.dll_strtok
test eax, eax
mov ebx, eax
je 0x405064
mov dword [esp], eax
mov ecx, 0x3d
mov dword [esp + 4], ecx
call sub.msvcrt.dll_strchr
mov byte [eax], 0
mov edx, dword [ebp + 8]
inc eax
mov byte [ebp - 0x8018], 0
mov dword [esp + 0xc], edi
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], esi
call fcn.00402f40
mov eax, dword [0x409090]
test eax, eax
je 0x404fe0
mov dword [esp + 0xc], esi
mov edx, str.Set_var:_t_s___s_n
mov dword [esp + 8], ebx
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
jmp 0x404fe0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], 0
call sub.KERNEL32.dll_SetLastError
mov byte [ebp - 0x10018], 0
sub esp, 4
jmp 0x404fd0