joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43f730
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x43f763
push esi
call fcn.00442820
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x43f75c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x43f7e9
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x43f7d2
mov eax, dword [esi + 8]
test eax, eax
je 0x43f787
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x43f7ce
cmp eax, 2
je 0x43f7d2
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x43f77a
cmp eax, 3
je 0x43f7ad
cmp eax, 1
jne 0x43f77a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x43f77a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x43f77a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.0043f810
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x43f7f8
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.0043f810
add esp, 4
pop esi
ret

Function at 0x45dd4a
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x45dd82
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0045bdfe
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0045bdd6
jmp 0x45dd8e
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x45f438
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x45f47a
call fcn.00464ef1
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x45f47a
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x45f471
xor eax, eax
jmp 0x45f482
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0045f488
pop edi
pop esi
pop ebx
ret 4

Function at 0x465421
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x46544f
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x46546d
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00465387
jmp 0x46546d
mov eax, dword [esi + 0x14]
test eax, eax
je 0x46546d
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00465387
test edi, edi
mov eax, edi
jne 0x465457
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
pop eax
nop
nop
nop
nop
nop
add eax, 0x403ac5
nop
nop
sub eax, 0x403a6b
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x42e030
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
jne 0x42e01e
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp fcn.00401219
Function at 0x1000360c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0xc]
mov dword [0x100085e7], eax
mov dword [ebp - 8], esp
mov ebx, dword [ebp + 8]
push dword [ebx]
push 1
push 2
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x10003652
push 6
call fcn.10004c3f
add esp, 4
mov dword [0x100085eb], eax
cmp dword [0x100085eb], 0
je 0x1000372e
mov dword [ebp - 8], esp
push 0
push 0
push 0
push 2
push dword [0x100085eb]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x1000369d
push 6
call fcn.10004c3f
add esp, 4
mov dword [0x100085ef], eax
cmp dword [ebp + 0x10], 0
mov eax, 0
sete al
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x1000370d
fild dword [ebp + 0x14]
fstp qword [ebp - 0xc]
fld qword [ebp - 0xc]
fmul qword [0x10008328]
fstp qword [ebp - 0x14]
mov dword [ebp - 0x18], esp
lea eax, [ebp - 4]
push eax
push 0
fld qword [ebp - 0x14]
call fcn.10001061
push eax
push 0x10003abe
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
nop
nop
nop
nop
cmp dword [ebp - 0x18], esp
je 0x1000370d
push 6
call fcn.10004c3f
add esp, 4
cmp dword [0x100085ef], 0
je 0x10003729
mov eax, 1
jmp 0x1000374c
jmp 0x10003742
cmp dword [ebp + 0x1c], 0
jne 0x10003742
push 0
call fcn.10004c4b
add esp, 4
mov eax, 0
jmp 0x1000374c
mov esp, ebp
pop ebp
ret 0x1c

Function at 0x10003bab
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
mov dword [ebp - 8], esp
mov eax, 0
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x10003bfb
push 6
call fcn.10004c3f
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp + 0x18], 0
jne 0x10003c2f
mov dword [ebp - 8], esp
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x10003c2a
push 6
call fcn.10004c3f
add esp, 4
jmp 0x10003c37
mov eax, dword [ebp - 4]
mov ebx, dword [ebp + 0x14]
mov dword [ebx], eax
cmp dword [ebp - 4], 0
mov eax, 0
setne al
jmp 0x10003c48
mov esp, ebp
pop ebp
ret 0x14
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x4ff290
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xbf000]
push edi
or ebp, 0xffffffff
jmp 0x4ff2b2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4ff2b9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4ff2a8
mov eax, 1
add ebx, ebx
jne 0x4ff2cb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4ff2dc
jne 0x4ff2fb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4ff2fb
dec eax
add ebx, ebx
jne 0x4ff2e8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4ff2c0
add ebx, ebx
jne 0x4ff2f7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4ff34d
xor ecx, ecx
sub eax, 3
jb 0x4ff313
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4ff382
sar eax, 1
mov ebp, eax
jmp 0x4ff31e
add ebx, ebx
jne 0x4ff31e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4ff2ec
inc ecx
add ebx, ebx
jne 0x4ff32c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4ff2ec
add ebx, ebx
jne 0x4ff339
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4ff32e
jne 0x4ff34a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4ff32e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4ff36c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4ff35e
jmp 0x4ff2ae
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4ff36c
add edi, ecx
jmp 0x4ff2ae
pop esi
mov edi, esi
mov ecx, 0x3493
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4ff38a
cmp byte [edi], 0x4c
jne 0x4ff38a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4ff38f
lea edi, [esi + 0xfb000]
mov eax, dword [edi]
or eax, eax
je 0x4ff407
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x156b70]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x156cc4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4ff3bc
mov ecx, edi
jns 0x4ff3eb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x156cc8]
or eax, eax
je 0x4ff401
mov dword [ebx], eax
add ebx, 4
jmp 0x4ff3d9
call dword [esi + 0x156cd8]
mov ebp, dword [esi + 0x156ccc]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4ff43b
sub esp, 0xffffff80
jmp 0x417770
Function at 0x401750
Capabilities:
Terminate process

Disassembly:
nop
pushfd
nop
not byte [eax - 0x1374aa36]
mov edi, dword [edi + 0x51]
mov ecx, dword [sym.imp.MSVCRT.dll__iob]
fadd qword [ebx + 0x6a684089]
mov dword [eax + 0x68], eax
push 0xffffffffffffffd2
inc eax
add byte [ecx - 1], dl
adc eax, 0x40fd80
mov dword [eax + 0x68], eax
push 0xffffffffffffffd2
inc eax
add byte [ecx - 1], dl
adc eax, 0x40fd80
mov eax, dword [0x4102ac]
or dword [0x74c05e0c], 0xf
fild qword [eax + 0x54]
je 0x4017bd
add bh, bh
inc ebx
add eax, dword fs:[eax]
jg 0x40174a
or byte [edx + 1], ch
call dword [sym.imp.MSVCRT.dll_exit]
nop
push ebp
mov ebp, esp
sub esp, 0xb8
mov eax, dword [0x41ac78]
test eax, eax
mov eax, dword [0x3404c]
je 0x4017bb
push 0xe2413907
push eax
mov al, 0x9e
leave
add byte [eax], bh
mov cx, word [0x410206]
jmp 0x4017cf
mov edx, dword [0x411800]
push edx
push eax
add byte [eax], bl
inc ecx
add byte [edx + 0x50], dl
call 0x76e57e3
pop ss
lahf
or eax, 0x4117cf
mov ebx, 0x411808
mov eax, dword [0x410288]
push ebx
push esi
mov esi, dword [0xf5c1a1]
mov word [0x4177b4], cx
test eax, eax
push edi
jne 0x4017e9
rcl byte [edi + 0x75], 0xfc
push ecx
adc eax, 0x411800
push edx
sbb al, 0x98
cwde
cmovo eax, dword [eax]
push ebx
salc
mov eax, dword [0x410278]
add esp, 8
test eax, eax
je 0x4017e9
mov eax, dword [0x410274]
wait
push 0x410640
push 0x52d484
call esi
movsb byte es:[edi], byte [esi]
les ecx, [eax + ecx]
adc al, 0xd0
add byte [eax], al
test eax, eax
loope 0x4017f5
aam 0x5f
add byte [ebp + 5], dh
mov eax, 0xb8d47c
and al, 0x68
wait
aam 0x40
add bh, bh
push ebx
mov ecx, dword [0x400ac8]
add ecx, 0x20
push ecx
call dword [sym.imp.MSVCRT.dll_fflush]
mov eax, dword [0x158b0cc4]
sbb al, dl
inc eax
add byte [ebx - 0x3ea7cb], cl
add byte [eax + 0x60], ch
or byte [eax], al
rcl dword [edx - 1]
sub ebx, dword [edx - 0x50]
mov es, word [ecx]
mov eax, dword [0x40fb5d]
push 0xffffffffffffffb9
push eax
invalid

Function at 0x4056f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add byte [eax], al
js 0x405670
not byte [eax + 0x60feb90]
pop esi
push esi
test dword [eax], ebx
mov ebx, 0x4f1b8f18
cmp bl, dh
stc
jcxz 0x4056fd
xor eax, 0x8b51ea5a
in al, dx
jl 0x4056f7
jmp 0x405686

Function at 0x405730
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jne 0x40576f
push es
call 0x42c0a28
pushfd
mov ebx, 0xc190202c
iretd
push edx
adc bl, ch
push cs
mov edi, 0x61791a2e
inc edi
or esp, edi
and ecx, dword [ebp - 0x52]
mov ah, 0xd
salc
Function at 0x405b28
Capabilities:
Encode data using xor

Disassembly:
cmp eax, 0x75a25b78
call 0x3f6e00
invalid
call 0x4059fb
xor ecx, ecx
sub cx, 0xff28
call 0x405b28
rcr byte [esi - 0x7f], 0x76
push cs
test byte [edi - 0x37], bl
mov bl, 0x83
out dx, al
cld
xor dword [esi + 0xe], 0xb3c95f84
sub esi, 0xfffffffc
loop 0x405b2b
js 0x405b1d
jl 0x405b71
cli
cmp esp, dword [edx]
mov edi, 0xadf809da
sub dword [esi + 0xa], ebx
inc esp
sub bh, byte [esi]
jo 0x405bb8
mov al, 0x36
dec esp
jnp 0x405b0d
sbb eax, 0xfe8db79d
movsb byte es:[edi], byte [esi]
dec ebx
lahf
mov al, byte [ebp - 0x1e]
pop es
cmp eax, 0x950769ea
push esi
mov ah, 6
adc al, 0x9a
cmc
push es
adc al, 0x1a
dec ebp
pop ecx
xchg ecx, eax
std
call [ebp + 0x27db40a8]
xchg esi, eax
or al, 0x1f
movsd dword es:[edi], dword [esi]
fidiv dword [ebx + 0x7a]
dec ecx
xchg ah, dl
ret
popfd
test al, 0x40
invalid
jo 0x405be3
add al, byte [eax]
std
xor eax, 0x56bfd993
or ebp, dword [ebx]
jp 0x405c2f
push ecx
xchg dword [eax + 0x33], esi
fisttp word ds:[edi]
rcr dword [ecx + 0x6c], 0x3d
xor al, 0xb4
sbb esp, 0xffffffe6
sbb dh, dh
inc edx
pop eax
out 4, eax
mov al, byte [0xf9543727]
outsd dx, dword [esi]
jmp 0x405bf8
pop edx
shr dword [edx], cl
retf
mov dword [ebx - 0x60604fff], esp
clc
invalid
Function at 0x401b6c
Capabilities:
Decrypt data using tea

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov ebx, 0x20
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edx, dword [eax]
mov edi, dword [esi]
mov eax, dword [ecx + 4]
mov dword [ebp - 4], edi
mov ecx, 0xc6ef3720
mov edi, dword [esi + 4]
mov dword [ebp - 8], edi
mov edi, dword [esi + 8]
mov dword [ebp - 0xc], edi
mov esi, dword [esi + 0xc]
mov dword [ebp - 0x10], esi
jmp 0x401bde
mov esi, edx
shl esi, 4
add esi, dword [ebp - 0xc]
lea edi, [ecx + edx]
xor esi, edi
mov edi, edx
shr edi, 5
add edi, dword [ebp - 0x10]
xor esi, edi
sub eax, esi
mov esi, eax
shl esi, 4
add esi, dword [ebp - 4]
lea edi, [ecx + eax]
xor esi, edi
mov edi, eax
shr edi, 5
add edi, dword [ebp - 8]
xor esi, edi
sub edx, esi
sub ecx, 0x9e3779b9
mov esi, ebx
add ebx, 0xffffffff
test esi, esi
jg 0x401ba6
mov ecx, dword [ebp + 8]
mov dword [ecx], edx
mov edx, dword [ebp + 8]
mov dword [edx + 4], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x401bfc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov eax, dword [ebp + 8]
cmp ecx, edx
jbe 0x401c14
xor byte [eax], 0xf5
inc edx
inc eax
cmp ecx, edx
ja 0x401c0b
pop ebp
ret
Function at 0x401c58
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffddc
mov eax, dword [0x40a264]
mov edx, dword [0x40a26c]
lea ecx, [ebp - 0x224]
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [0x40a268]
mov dword [ebp - 8], eax
mov dword [ebp - 0x1c], edx
mov edx, dword [0x40a270]
mov dword [0x40f130], 1
mov dword [ebp - 0x18], edx
push 0x208
push ecx
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0
push 0
push 3
push 0
push 3
push 0x80000000
lea eax, [ebp - 0x224]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x401d9c
push 0
push ebx
call sub.KERNEL32.DLL_GetFileSize
mov edi, eax
push 2
push 0
push 0xfffffffffffffff8
push ebx
call sub.KERNEL32.DLL_SetFilePointer
lea eax, [ebp - 4]
push 0
push eax
lea edx, [ebp - 0x14]
push 8
push edx
push ebx
call sub.KERNEL32.DLL_ReadFile
test eax, eax
jne 0x401d07
push ebx
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
jmp 0x401d9e
push 8
lea edx, [ebp - 0x14]
push edx
lea ecx, [ebp - 0x1c]
push ecx
call fcn.00403570
add esp, 0xc
test eax, eax
je 0x401d21
xor eax, eax
jmp 0x401d9e
push 2
push 0
push 0xfffffffffffffff4
push ebx
call sub.KERNEL32.DLL_SetFilePointer
push 0
lea edx, [ebp - 4]
push edx
push 4
push esi
push ebx
call sub.KERNEL32.DLL_ReadFile
test eax, eax
jne 0x401d4a
push ebx
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
jmp 0x401d9e
push 4
push 0x1000
mov edx, dword [esi]
push edx
push 0
call sub.KERNEL32.DLL_VirtualAlloc
mov dword [0x40a16c], eax
mov eax, edi
sub eax, dword [esi]
sub eax, 0xc
push 0
push 0
push eax
push ebx
call sub.KERNEL32.DLL_SetFilePointer
lea edx, [ebp - 4]
push 0
push edx
mov eax, dword [0x40a16c]
mov ecx, dword [esi]
push ecx
push eax
push ebx
call sub.KERNEL32.DLL_ReadFile
test eax, eax
jne 0x401d95
push ebx
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
jmp 0x401d9e
mov eax, 1
jmp 0x401d9e
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x401da8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffec4
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
push 0x2350
push 0x69
push esi
call sub.KERNEL32.DLL_FindResourceA
mov ebx, eax
test ebx, ebx
jne 0x401ddf
mov eax, dword [ebp + 0x14]
push eax
call fcn.00401c58
pop ecx
test eax, eax
jne 0x401e40
xor eax, eax
jmp 0x401ee7
push ebx
push esi
call sub.KERNEL32.DLL_LoadResource
mov edi, eax
test edi, edi
jne 0x401e06
push 0x10
push 0x40a2ad
push 0x40a294
push 0
call sub.USER32.DLL_MessageBoxA
xor eax, eax
jmp 0x401ee7
push edi
call sub.KERNEL32.DLL_LockResource
mov dword [0x40a16c], eax
cmp dword [0x40a16c], 0
jne 0x401e34
push 0x10
push 0x40a2cc
push str.Cant_load_dll_from_Res_
push 0
call sub.USER32.DLL_MessageBoxA
xor eax, eax
jmp 0x401ee7
push ebx
push esi
call sub.KERNEL32.DLL_SizeofResource
mov edx, dword [ebp + 0x14]
mov dword [edx], eax
mov eax, 1
jmp 0x401ee7
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x402df4
Capabilities:
Get memory capacity

Disassembly:
add esp, 0xffffffe0
mov dword [esp], 0x20
push esp
call sub.KERNEL32.DLL_GlobalMemoryStatus
mov eax, dword [esp + 0xc]
add esp, 0x20
ret

Function at 0x406e28
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
test eax, eax
je 0x406e8a
call fcn.00406dd8
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push esi
call fcn.004034a4
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push edi
call fcn.004034a4
pop ecx
push eax
push edi
push ebx
call sub.KERNEL32.DLL_WriteFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x406ee8
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
cmp dword [0x40bd34], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x406fc2
cmp dword [0x40bd30], 0
jne 0x406fc2
cmp dword [0x40bf24], 0
je 0x406f7c
push 0x80
lea eax, [ebp - 0x84]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x84]
push edx
call fcn.00406cd8
add esp, 8
mov ebx, eax
test eax, eax
jne 0x406f62
push 0x3a
lea edx, [ebp - 0x84]
push edx
call fcn.00406cd8
add esp, 8
mov ebx, eax
test eax, eax
jne 0x406f62
lea ebx, [ebp - 0x84]
jmp 0x406f63
inc ebx
call fcn.00406ea4
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.USER32.DLL_MessageBoxA
jmp 0x406ffd
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x40bd38
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.004034a4
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x40bd3b
push ebx
call sub.KERNEL32.DLL_WriteFile
jmp 0x406ffd
cmp dword [0x40bd30], 0
je 0x406fdc
cmp dword [0x40bd30], 0xffffffff
je 0x406ffd
push esi
call dword [0x40bd30]
pop ecx
mov eax, dword [0x40bd34]
test eax, eax
je 0x406ffd
cmp dword [0x40bd34], 0xffffffff
je 0x406ffd
cmp byte [eax], 0
je 0x406ffd
push esi
push eax
call fcn.00406e28
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4077e8
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x40f980], 0
jne 0x407869
cmp dword [0x40f9a0], 0
jne 0x407818
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x40f9a0], eax
test eax, eax
jne 0x407818
push str.GetEnvironmentStrings_failed
call fcn.00407014
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x40f9a0]
jmp 0x40782c
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.004034a4
pop ecx
mov edi, eax
test eax, eax
jne 0x407824
lea edi, [ebp + 1]
push edi
call fcn.004023ac
pop ecx
mov ebx, eax
mov dword [0x40f984], ebx
test ebx, ebx
jne 0x407856
xor eax, eax
jmp 0x40792c
push edi
mov edx, dword [0x40f9a0]
push edx
push ebx
call fcn.00403390
add esp, 0xc
jmp 0x407889
xor esi, esi
mov ebx, dword [0x40f980]
jmp 0x407883
push eax
call fcn.004034a4
pop ecx
test eax, eax
jne 0x40787f
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x407873
lea ebx, [esi + 4]
push 4
mov dword [0x40f988], ebx
inc ebx
push ebx
call fcn.00401f10
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x4078ac
xor eax, eax
jmp 0x40792c
cmp dword [0x40f980], 0
jne 0x4078dd
xor esi, esi
mov ebx, dword [0x40f984]
mov eax, dword [esp]
mov ebp, eax
jmp 0x4078ce
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.004034a4
pop ecx
mov edi, eax
test eax, eax
jne 0x4078c4
jmp 0x40790e
xor esi, esi
mov ebx, dword [0x40f980]
mov eax, dword [esp]
mov edi, eax
jmp 0x407908
push eax
call fcn.004034a4
pop ecx
test eax, eax
je 0x4078fd
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x407901
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x4078ec
mov eax, dword [0x40f980]
test eax, eax
je 0x40791e
push eax
call fcn.004023bc
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x40f980], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret