joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405940
Capabilities:
Set registry value

Disassembly:
push ebp
mov ecx, str.Recent_file_list
mov ebp, esp
push edi
push esi
lea edx, [ebp - 0x68]
lea eax, [ebp - 0x6c]
push ebx
sub esp, 0x9c
mov edi, dword [ebp + 8]
call fcn.00404de0
test eax, eax
je 0x405980
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call fcn.004053a0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebx, eax
mov eax, dword [ebp + 0xc]
mov esi, 0x3ed
mov dword [esp], eax
call sub.user32.dll_GetMenu
mov dword [ebp - 0x48], 0x30
mov dword [ebp - 0x44], 0x20
sub esp, 4
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x7c], ebx
mov ebx, esi
mov esi, eax
lea eax, [ebp - 0x48]
mov dword [esp + 8], 0
mov dword [esp + 0xc], eax
mov dword [esp + 4], ebx
mov dword [esp], esi
call sub.user32.dll_GetMenuItemInfoW
sub esp, 0x10
test eax, eax
je 0x4059fd
mov eax, dword [ebp - 0x28]
mov dword [ebp + ebx*4 - 0x100c], eax
add ebx, 1
cmp ebx, 0x3f1
jne 0x4059c6
mov eax, dword [ebp - 0x58]
mov ebx, dword [ebp - 0x7c]
mov esi, dword [sym.imp.kernel32.dll_lstrcmpiW]
mov dword [ebp - 0x7c], eax
mov dword [esp + 4], eax
mov dword [esp], edi
call esi
sub esp, 8
test eax, eax
je 0x405ad8
xor edx, edx
mov dword [ebp - 0x80], ebx
mov ebx, edx
mov eax, dword [ebp + ebx*4 - 0x58]
test eax, eax
je 0x405a4b
mov dword [esp + 4], edi
mov dword [esp], eax
call esi
sub esp, 8
test eax, eax
je 0x405af7
add ebx, 1
cmp ebx, 4
jne 0x405a27
mov eax, dword [ebp - 0x7c]
mov ebx, dword [ebp - 0x80]
test eax, eax
je 0x405a67
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x54], eax
lea esi, [ebp - 0x64]
test edi, edi
je 0x405ad8
add ebx, 1
mov dword [esp + 4], str.File_d
mov dword [esp + 8], ebx
mov dword [esp], esi
call sub.user32.dll_wsprintfW
cmp word [edi], 0
je 0x405af0
mov eax, edi
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x405a90
sub eax, edi
add eax, 2
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], esi
mov eax, dword [ebp - 0x6c]
mov dword [esp], eax
call sub.advapi32.dll_RegSetValueExW
sub esp, 0x18
cmp ebx, 4
je 0x405ad8
mov edi, dword [ebp + ebx*4 - 0x58]
jmp 0x405a6a
mov eax, dword [ebp - 0x6c]
mov dword [esp], eax
call sub.advapi32.dll_RegCloseKey
sub esp, 4
jmp 0x405963
mov eax, 2
jmp 0x405a9e
mov edx, ebx
mov ebx, dword [ebp - 0x80]
test edx, edx
je 0x405a67
lea eax, [ebp - 0x58]
shl edx, 2
mov dword [esp + 4], eax
lea eax, [ebp - 0x54]
mov dword [esp + 8], edx
mov dword [esp], eax
call sub.ucrtbase.dll_memmove
jmp 0x405a67

Function at 0x405bd0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov edx, 0x411618
xor eax, eax
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov dword [esp], esi
mov ecx, ebx
call fcn.00405060
mov dword [ebp + 8], esi
add esp, 0x10
mov ecx, ebx
mov edx, 0x41160c
pop ebx
mov eax, 1
pop esi
pop ebp
jmp fcn.00405060
Function at 0x405c10
Capabilities:
Set registry value

Disassembly:
push ebp
mov edx, 0x411618
xor eax, eax
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov dword [esp], esi
mov ecx, ebx
call fcn.00404fa0
mov dword [ebp + 8], esi
add esp, 0x10
mov ecx, ebx
mov edx, 0x41160c
pop ebx
mov eax, 1
pop esi
pop ebp
jmp fcn.00404fa0
Function at 0x4075e0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x6f8]
push ebx
sub esp, 0x71c
mov dword [esp + 4], 0x7d4
mov eax, dword [0x41a708]
mov dword [esp], eax
call sub.user32.dll_GetDlgItem
sub esp, 8
mov ebx, eax
mov dword [esp + 4], 0x7dd
mov dword [esp], eax
call sub.user32.dll_GetDlgItem
sub esp, 8
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x407
mov dword [esp], eax
call sub.user32.dll_SendMessageW
mov ecx, 0x1c
lea edx, [ebp - 0x6fc]
mov dword [ebp - 0x6fc], 0x74
mov esi, eax
xor eax, eax
sub esp, 0x10
rep stosd dword es:[edi], eax
mov dword [esp + 0xc], edx
lea edi, [ebp - 0x612]
mov dword [esp + 8], 1
mov dword [esp + 4], 0x43a
mov eax, dword [0x41a704]
mov dword [esp], eax
call sub.user32.dll_SendMessageW
sub esp, 0x10
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0x104
mov dword [esp + 4], 0xd
mov dword [esp], esi
call sub.user32.dll_SendMessageW
sub esp, 0x10
test eax, eax
jne 0x4076b8
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [sym.imp.kernel32.dll_lstrcmpW]
lea ecx, [ebp - 0x6e2]
mov dword [esp], edi
mov dword [esp + 4], ecx
mov dword [ebp - 0x70c], eax
call eax
sub esp, 8
test eax, eax
je 0x407720
lea ecx, [ebp - 0x6e2]
mov dword [esp], esi
mov dword [esp + 0xc], ecx
mov dword [esp + 8], 0
mov dword [esp + 4], 0xc
call sub.user32.dll_SendMessageW
sub esp, 0x10
mov dword [esp], ebx
mov dword [esp + 4], 0x7de
call sub.user32.dll_GetDlgItem
sub esp, 8
call fcn.00407170
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [ebp - 0x710], eax
lea edi, [ebp - 0x684]
lea ebx, [ebp - 0x688]
mov dword [esp + 4], 0x7d4
mov eax, dword [0x41a708]
mov dword [esp], eax
call sub.user32.dll_GetDlgItem
sub esp, 8
mov dword [esp + 4], 0x7de
mov dword [esp], eax
call sub.user32.dll_GetDlgItem
sub esp, 8
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x407
mov dword [esp], eax
call sub.user32.dll_SendMessageW
mov ecx, 0x1c
mov dword [ebp - 0x688], 0x74
mov esi, eax
mov eax, dword [ebp - 0x710]
sub esp, 0x10
rep stosd dword es:[edi], eax
mov dword [esp + 0xc], ebx
lea edi, [ebp - 0x414]
lea ebx, [ebp - 0x216]
mov dword [esp + 8], 1
mov dword [esp + 4], 0x43a
mov eax, dword [0x41a704]
mov dword [esp], eax
call sub.user32.dll_SendMessageW
sub esp, 0x10
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0x104
mov dword [esp + 4], 0xd
mov dword [esp], esi
call sub.user32.dll_SendMessageW
mov ecx, dword [ebp - 0x67c]
mov eax, 0x66666667
sub esp, 0x10
imul ecx
sar ecx, 0x1f
mov dword [esp + 4], 0x411cf8
mov dword [esp], ebx
sar edx, 3
sub edx, ecx
mov dword [esp + 8], edx
call sub.user32.dll_wsprintfW
mov dword [esp + 4], ebx
mov dword [esp], edi
mov eax, dword [ebp - 0x70c]
call eax
sub esp, 8
test eax, eax
je 0x4076aa
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0
mov dword [esp + 4], 0xc
mov dword [esp], esi
call sub.user32.dll_SendMessageW
sub esp, 0x10
jmp 0x4076aa
Function at 0x407850
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
sub esp, 0x14
mov eax, dword [0x41a708]
mov dword [esp + 4], 0x7d0
mov dword [esp], eax
call sub.user32.dll_GetDlgItem
sub esp, 8
test ebx, ebx
je 0x4078b0
mov dword [esp + 4], 5
mov dword [esp], eax
call sub.user32.dll_ShowWindow
mov eax, dword [0x410284]
sub esp, 8
mov dword [esp], eax
call fcn.00405b30
mov ebx, dword [ebp - 4]
mov edx, dword [eax*4 + 0x41a6e8]
or edx, 2
mov dword [eax*4 + 0x41a6e8], edx
leave
ret
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.user32.dll_ShowWindow
mov eax, dword [0x410284]
sub esp, 8
mov dword [esp], eax
call fcn.00405b30
mov ebx, dword [ebp - 4]
mov edx, dword [eax*4 + 0x41a6e8]
and edx, 0xfffffffd
mov dword [eax*4 + 0x41a6e8], edx
leave
ret

Function at 0x4078f0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
test eax, eax
je 0x407a70
cmp word [eax], 0
je 0x407a94
mov edx, eax
lea esi, [esi]
add edx, 2
cmp word [edx], 0
jne 0x407910
cmp eax, edx
jb 0x40792a
jmp 0x407abd
mov edx, ebx
movzx ecx, word [edx]
cmp cx, 0x5c
je 0x407a88
cmp cx, 0x2f
je 0x407a88
lea ebx, [edx - 2]
cmp eax, ebx
jb 0x407928
movzx eax, word [edx - 2]
test ax, ax
je 0x407ab3
mov eax, ebx
lea esi, [esi]
nop
add eax, 2
cmp word [eax], 0
jne 0x407960
sub eax, ebx
add eax, 0x20
mov dword [esp + 8], eax
mov dword [esp + 4], 8
mov edx, dword fs:[0x18]
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov esi, eax
test eax, eax
je 0x407a69
cmp word [ebx], 0
je 0x407aac
mov eax, ebx
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x4079b0
sub eax, ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ebx
mov dword [esp], esi
call sub.ucrtbase.dll_memcpy
cmp word [ebx], 0
je 0x407aa0
mov eax, ebx
lea esi, [esi]
nop
add eax, 2
cmp word [eax], 0
jne 0x4079e0
sub eax, ebx
lea edx, [eax + 6]
add eax, esi
mov ecx, 0x20
mov dword [eax], 0x2d0020
xor ebx, ebx
mov word [eax + 4], cx
lea eax, [esi + edx]
mov dword [eax], 0x690057
mov dword [eax + 4], 0x65006e
mov dword [eax + 8], 0x570020
mov dword [eax + 0xc], 0x72006f
mov dword [eax + 0x10], 0x700064
mov dword [eax + 0x14], 0x640061
mov word [eax + 0x18], bx
mov dword [esp + 4], esi
mov eax, dword [0x41a708]
mov dword [esp], eax
call sub.user32.dll_SetWindowTextW
sub esp, 8
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
movzx eax, word [0x419aa0]
mov ebx, 0x419aa0
jmp 0x40794c
movzx eax, word [edx + 2]
lea ebx, [edx + 2]
jmp 0x40794c
mov ebx, eax
mov eax, 0x20
jmp 0x40796e
mov eax, esi
mov edx, 6
jmp 0x4079f0
xor eax, eax
jmp 0x4079bb
mov eax, 0x20
jmp 0x40796e
mov ebx, edx
mov eax, 0x20
jmp 0x40796e
Function at 0x407bd0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
mov ebx, edx
sub esp, 0x5c
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 2
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x40000000
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CreateFileW]
sub esp, 0x1c
cmp eax, 0xffffffff
je 0x407db8
mov edi, eax
lea edx, [ebp - 0x24]
cmp ebx, 0x11
je 0x407d70
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x1c], 0x406570
mov dword [esp + 0xc], edx
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x44a
mov eax, dword [0x41a704]
mov dword [esp], eax
call sub.user32.dll_SendMessageW
sub esp, 0x10
mov dword [ebp - 0x3c], eax
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [0x41a704]
sub esp, 4
mov dword [esp], eax
call sub.user32.dll_SetFocus
mov edx, dword [ebp - 0x3c]
sub esp, 4
test edx, edx
je 0x407d20
xor eax, eax
lea esi, [esi]
lea esi, [esi]
movzx edx, word [esi + eax]
add eax, 2
mov word [eax + 0x41a4de], dx
test dx, dx
jne 0x407c90
mov eax, 0x41a4e0
call fcn.004078f0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0xb9
mov eax, dword [0x41a704]
mov dword [esp], eax
call sub.user32.dll_SendMessageW
mov dword [0x410284], ebx
sub esp, 0x10
call fcn.00407ad0
call fcn.00405da0
mov eax, dword [0x410284]
mov dword [esp], eax
call fcn.00405b30
mov eax, dword [eax*4 + 0x41a6f0]
mov dword [esp + 4], eax
mov eax, dword [0x41a708]
mov dword [esp], eax
call fcn.00402f20
lea esp, [ebp - 0xc]
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0x4b0
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov dword [esp + 4], 0x45f
mov eax, dword [0x41a704]
mov dword [esp], eax
call sub.user32.dll_SendMessageW
sub esp, 0x10
test eax, eax
je 0x407c84
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], 0
mov dword [esp + 8], 2
mov dword [esp + 4], 0x411b1c
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WriteFile]
lea edx, [ebp - 0x24]
sub esp, 0x14
cmp dword [ebp - 0x24], 2
je 0x407c30
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_CloseHandle]
xor eax, eax
sub esp, 4
jmp 0x407d5f
mov eax, dword fs:[0x18]
cmp dword [eax + 0x34], 5
mov dword [esp + 0xc], 0x30
sete al
mov dword [esp + 8], 0x411d18
movzx eax, al
add eax, 0x6ab
mov dword [esp + 4], eax
mov eax, dword [0x41a708]
mov dword [esp], eax
call sub.user32.dll_MessageBoxW
xor eax, eax
sub esp, 0x10
jmp 0x407d5f
Function at 0x407fc0
Capabilities:
Get process heap flags
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [0x41a704]
cmp word [0x41a4e0], 0
jne 0x408017
lea edx, [ebp - 0x20]
mov dword [ebp - 0x20], 8
mov dword [ebp - 0x1c], 0x4b0
mov dword [esp + 8], edx
mov dword [esp + 0xc], 0
mov dword [esp + 4], 0x45f
mov dword [esp], eax
call sub.user32.dll_SendMessageW
mov edx, eax
sub esp, 0x10
mov eax, dword [0x41a704]
test edx, edx
je 0x408136
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0xb8
mov dword [esp], eax
call sub.user32.dll_SendMessageW
sub esp, 0x10
test eax, eax
je 0x408136
cmp word [0x41a4e0], 0
movzx eax, word [0x419aa0]
mov ebx, 0x419aa0
jne 0x408148
test ax, ax
je 0x4081a0
mov eax, ebx
lea esi, [esi]
nop
add eax, 2
cmp word [eax], 0
jne 0x408070
sub eax, ebx
sar eax, 1
cmp word [0x4198a0], 0
je 0x4080a3
mov edx, 0x4198a0
lea esi, [esi]
add edx, 2
cmp word [edx], 0
jne 0x408090
sub edx, 0x4198a0
sar edx, 1
add eax, edx
add eax, eax
mov dword [esp + 4], 8
mov dword [esp + 8], eax
mov edi, dword fs:[0x18]
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov esi, eax
test eax, eax
je 0x408190
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x4198a0
mov dword [esp], eax
call sub.user32.dll_wsprintfW
mov dword [esp + 0xc], 0x33
mov dword [esp + 8], 0x411d18
mov dword [esp + 4], esi
mov eax, dword [0x41a708]
mov dword [esp], eax
call sub.user32.dll_MessageBoxW
sub esp, 0x10
mov ebx, eax
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
cmp ebx, 6
je 0x4081b0
cmp ebx, 7
jne 0x408190
lea esp, [ebp - 0xc]
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, 0x41a4e0
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x408150
cmp eax, 0x41a4e0
ja 0x40816a
jmp 0x4081f4
mov eax, ebx
movzx edx, word [eax]
cmp dx, 0x5c
je 0x4081d8
cmp dx, 0x2f
je 0x4081d8
lea ebx, [eax - 2]
cmp ebx, 0x41a4e0
ja 0x408168
movzx eax, word [eax - 2]
jmp 0x40805c
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
xor eax, eax
jmp 0x40807d
cmp word [0x41a4e0], 0
je 0x4081e8
mov edx, dword [0x410284]
lea esp, [ebp - 0xc]
mov eax, 0x41a4e0
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.00407bd0
lea ebx, [eax + 2]
movzx eax, word [eax + 2]
jmp 0x40805c
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.00407e00
mov ebx, eax
xor eax, eax
jmp 0x40807d
Function at 0x40f100
Capabilities:
Get process heap force flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov dword [esp], 1
call sub.ucrtbase.dll__configure_narrow_argv
call sub.ucrtbase.dll__initialize_narrow_environment
call sub.ucrtbase.dll___p___argc
mov esi, dword [eax]
call sub.ucrtbase.dll___p___argv
mov edi, dword [eax]
call sub.ucrtbase.dll__get_initial_narrow_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sub.ucrtbase.dll__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call fcn.0040f1c0
mov dword [esp], eax
call 0x40f170
jmp dword [sym.imp.ucrtbase.dll_exit]

Function at 0x40f1c0
Capabilities:
Accept command line arguments

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
push ebx
push ecx
sub esp, 0x6c
call fcn.0040f1b0
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov ebx, eax
movzx eax, byte [eax]
test al, al
je 0x40f22e
xor ecx, ecx
xor edx, edx
jmp 0x40f206
cmp al, 0x5c
jne 0x40f288
add edx, 1
movzx eax, byte [ebx + 1]
add ebx, 1
test al, al
je 0x40f223
cmp al, 9
je 0x40f20e
cmp al, 0x20
jne 0x40f1f0
test ecx, ecx
je 0x40f223
xor edx, edx
jmp 0x40f1fb
add ebx, 1
movzx eax, byte [ebx]
cmp al, 9
je 0x40f220
cmp al, 0x20
je 0x40f220
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetStartupInfoA]
sub esp, 4
test byte [ebp - 0x30], 1
jne 0x40f249
mov word [ebp - 0x2c], 1
movzx esi, word [ebp - 0x2c]
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.0040dc40
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret
cmp al, 0x22
jne 0x40f212
and edx, 1
jne 0x40f212
xor ecx, 1
jmp 0x40f1fb
Function at 0x40124c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
test esi, esi
jne 0x40125d
pop esi
ret
movzx eax, word [esp + 0xc]
push edi
push eax
movzx eax, word [esp + 0x10]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x401283
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
pop edi
pop esi
ret
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
jne 0x4012a0
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, edi
pop ebx
jmp 0x401280
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x1c]
push ebx
mov dword [ecx], eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x18]
xor edi, edi
mov dword [ecx], eax
inc edi
jmp 0x401294

Function at 0x4014dc
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push esi
push 0x30
xor esi, esi
lea eax, [ebp - 0x34]
push esi
push eax
mov dword [ebp - 4], ecx
call fcn.0040b790
add esp, 0xc
push esi
push esi
lea eax, [ebp - 0x34]
push eax
call fcn.00407839
test eax, eax
je 0x40150e
push 0x27
pop eax
jmp 0x4015cd
push ebx
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 8]
push edi
cmp eax, esi
je 0x4015ac
cmp esi, eax
jge 0x401555
cmp dword [ebp - 0x30], 0
jne 0x401555
push dword [section..data]
mov eax, dword [ebp - 4]
push dword [0x428180]
push esi
push ebx
push dword [eax]
call fcn.0040772a
add esp, 0x14
test eax, eax
jle 0x4015b1
mov ecx, dword [0x428180]
add esi, eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x30], eax
mov eax, dword [0x428184]
mov dword [ebp - 0x24], eax
mov eax, dword [0x426004]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x34]
push eax
call fcn.0040839d
mov edi, eax
test edi, edi
je 0x401579
cmp edi, 4
jne 0x4015b6
mov eax, dword [0x426004]
sub eax, dword [ebp - 0x20]
je 0x40159c
push dword [ebp + 0xc]
push 1
push eax
push dword [0x428184]
call fcn.0040b961
add esp, 0x10
cmp eax, 1
jne 0x4015ba
cmp edi, 4
je 0x4015be
mov eax, dword [ebx + 8]
test eax, eax
jne 0x40151e
push 0x28
pop esi
jmp 0x4015c0
push 6
pop eax
jmp 0x4015cb
push 0x27
jmp 0x4015ae
push 7
jmp 0x4015ae
xor esi, esi
lea eax, [ebp - 0x34]
push eax
call fcn.004082e9
mov eax, esi
pop edi
pop ebx
pop esi
leave
ret 8
Function at 0x4016e8
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x426d40]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push edi
push 0x20
push 1
push ebx
call fcn.0040c241
add esp, 0x10
cmp eax, 0x20
je 0x401718
push 6
pop eax
jmp 0x401797
push esi
push dword [ebx + 8]
mov esi, dword [sym.imp.WSOCK32.dll_ntohl]
call esi
push dword [ebx + 0xc]
mov dword [ebx + 8], eax
call esi
push dword [ebx + 0x10]
mov dword [ebx + 0xc], eax
call esi
push dword [ebx + 0x14]
mov dword [ebx + 0x10], eax
call esi
push dword [ebx + 0x18]
mov dword [ebx + 0x14], eax
call esi
push dword [ebx + 0x1c]
mov dword [ebx + 0x18], eax
call esi
push edi
mov dword [ebx + 0x1c], eax
call fcn.00411ca3
lea ecx, [ebp - 0x34]
push ecx
push eax
call fcn.0040bca5
add esp, 0xc
test eax, eax
je 0x40176a
push 6
jmp 0x40177c
push 2
pop ecx
mov edi, 0x41e334
mov esi, ebx
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
je 0x40177f
push 0x29
pop eax
jmp 0x401796
mov eax, dword [ebx + 0x14]
add eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0x1c]
lea eax, [eax + ecx + 0x20]
sub eax, dword [ebp - 0x20]
neg eax
sbb eax, eax
and eax, 0x29
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.0040b774
leave
ret
Function at 0x4017a5
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, dword [edi + 0x14]
add esi, dword [edi + 0x18]
mov eax, dword [edi + 8]
add eax, dword [ebp + 0x10]
add esi, dword [edi + 0x1c]
mov dword [ebp - 0xc], eax
push esi
call fcn.0040ba14
pop ecx
mov dword [ebp - 0x10], eax
test eax, eax
jne 0x4017d8
push 0xc
pop eax
jmp 0x401913
and dword [ebp + 8], 0
push ebx
mov dword [ebp - 4], eax
test esi, esi
je 0x40180f
mov ebx, 0x7fffffff
cmp esi, ebx
ja 0x4017ef
mov ebx, esi
push dword [ebp + 0xc]
push ebx
push 1
push dword [ebp - 4]
call fcn.0040c241
add esp, 0x10
cmp eax, ebx
jne 0x4018ed
add dword [ebp - 4], eax
sub esi, eax
jne 0x4017e4
mov eax, dword [edi + 0x14]
mov esi, dword [ebp - 0x10]
mov ebx, dword [edi + 0x18]
mov edi, dword [edi + 0x1c]
add eax, esi
add ebx, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], ebx
add edi, ebx
push dword [esi]
call dword [sym.imp.WSOCK32.dll_ntohl]
push dword [esi + 4]
mov dword [esi], eax
call dword [sym.imp.WSOCK32.dll_ntohl]
push dword [esi + 8]
mov dword [esi + 4], eax
call dword [sym.imp.WSOCK32.dll_ntohl]
mov ecx, dword [ebp + 0x10]
mov dword [esi + 8], eax
mov eax, dword [esi]
lea edx, [eax + ecx]
cmp edx, dword [ebp - 0xc]
ja 0x4018ff
mov edx, dword [ebp - 4]
add edx, eax
cmp edx, dword [ebp - 0x14]
ja 0x4018ff
and dword [ebp - 8], 0
test eax, eax
je 0x401888
mov eax, dword [ebp - 4]
sub ecx, eax
mov dl, byte [ecx + eax]
add byte [eax], dl
inc dword [ebp - 8]
mov edx, dword [ebp - 8]
inc eax
cmp edx, dword [esi]
jb 0x401878
push dword [ebp + 0x14]
mov eax, dword [esi]
push eax
push 1
push dword [ebp - 4]
mov dword [ebp - 8], eax
call fcn.0040b961
mov ecx, dword [ebp - 8]
add esp, 0x10
cmp eax, ecx
jne 0x4018f6
mov eax, dword [esi + 4]
add dword [ebp + 0x10], ecx
add dword [ebp - 4], ecx
add eax, ebx
cmp eax, edi
ja 0x4018ff
push dword [ebp + 0x14]
mov eax, dword [esi + 4]
push eax
push 1
push ebx
mov dword [ebp - 8], eax
call fcn.0040b961
add esp, 0x10
cmp eax, dword [ebp - 8]
jne 0x4018f6
mov eax, dword [esi + 8]
add eax, dword [ebp + 0x10]
add ebx, dword [ebp - 8]
cmp eax, dword [ebp - 0xc]
ja 0x4018ff
add esi, 0xc
mov dword [ebp + 0x10], eax
cmp esi, dword [ebp - 0x18]
jb 0x40182a
jmp 0x401906
mov dword [ebp + 8], 6
jmp 0x401906
mov dword [ebp + 8], 7
jmp 0x401906
mov dword [ebp + 8], 0x29
push dword [ebp - 0x10]
call fcn.0040b54d
mov eax, dword [ebp + 8]
pop ecx
pop ebx
pop edi
pop esi
leave
ret