joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41e80c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], edx
mov byte [ebp - 1], al
xor eax, eax
push ebp
push 0x41e9eb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4287f8]
mov eax, dword [eax]
mov edx, dword [eax + 0xe4]
mov eax, dword [0x42a004]
mov eax, dword [eax + 0x5c]
call fcn.0040b86c
mov eax, dword [0x428840]
mov eax, dword [eax]
call fcn.0040bd64
mov eax, 0x28
call fcn.00422b38
mov edi, eax
dec edi
test edi, edi
jl 0x41e9d0
inc edi
xor ebx, ebx
mov esi, ebx
add esi, esi
lea esi, [esi + esi*2]
mov eax, dword [0x4287f4]
mov eax, dword [eax]
mov eax, dword [eax + esi*4 + 0x10]
call fcn.0040d700
xor edx, edx
mov dl, byte [ebp - 1]
cmp eax, edx
jne 0x41e9c8
mov eax, dword [0x4287f4]
mov eax, dword [eax]
mov eax, dword [eax + esi*4 + 4]
lea ecx, [ebp - 0xc]
xor edx, edx
call fcn.0041d480
mov eax, dword [0x4287f4]
mov eax, dword [eax]
mov eax, dword [eax + esi*4 + 8]
lea ecx, [ebp - 0x10]
xor edx, edx
call fcn.0041d480
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 0xc]
call fcn.00405c8c
mov eax, dword [0x4287f4]
mov eax, dword [eax]
mov eax, dword [eax + esi*4 + 0xc]
call fcn.0040d700
mov dword [ebp - 8], eax
mov eax, dword [0x4287f4]
mov eax, dword [eax]
mov eax, dword [eax + esi*4 + 0x14]
call fcn.0040d700
dec eax
jne 0x41e983
lea eax, [ebp - 0x50]
xor ecx, ecx
mov edx, 0x3c
call fcn.00402a94
mov dword [ebp - 0x50], 0x3c
mov eax, dword [0x428840]
mov eax, dword [eax]
mov eax, dword [eax + 0x1c]
mov dword [ebp - 0x48], eax
mov eax, 0x41e9fc
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0xc]
call fcn.00403af4
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x14]
call fcn.00403af4
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x10]
call fcn.00403af4
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x4c], 0x240
lea eax, [ebp - 0x50]
push eax
call sub.shell32.dll_ShellExecuteExA
test eax, eax
je 0x41e9b7
jmp 0x41e966
mov eax, dword [0x428840]
mov eax, dword [eax]
call fcn.0040bd64
push 0x32
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_WaitForSingleObject
cmp eax, 0x102
je 0x41e95a
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_CloseHandle
jmp 0x41e9b7
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x14]
call fcn.00403af4
push eax
mov eax, dword [ebp - 0x10]
call fcn.00403af4
push eax
mov eax, dword [ebp - 0xc]
call fcn.00403af4
push eax
push 0x41e9fc
mov eax, dword [0x428840]
mov eax, dword [eax]
mov eax, dword [eax + 0x1c]
push eax
call sub.shell32.dll_ShellExecuteA
push 0
push 0x2800
mov eax, dword [0x42a004]
call fcn.0041d648
inc ebx
dec edi
jne 0x41e86f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41e9f2
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004036b8
ret
Function at 0x41eecc
Capabilities:
Delete file

Disassembly:
push ebx
add esp, 0xfffffff0
mov ebx, eax
cmp dword [0x42a02c], 0
jle 0x41eeeb
mov eax, dword [0x42a038]
call fcn.00403af4
push eax
call sub.kernel32.dll_DeleteFileA
mov eax, ebx
call fcn.0040ab20
mov dword [esp], eax
mov eax, dword [esp]
mov edx, 0x41efa0
call fcn.00406a68
mov eax, 0x75
call fcn.00422b38
cmp eax, dword [0x42a02c]
jne 0x41ef29
mov eax, 0x76
call fcn.00422b38
cdq
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
jmp 0x41ef3c
mov eax, 0x5f
call fcn.00422b38
cdq
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
cmp dword [0x42a034], 1
jne 0x41ef6b
mov eax, 0x5f
call fcn.00422b38
mov edx, eax
imul edx, dword [0x42a02c]
mov eax, dword [0x42882c]
add edx, dword [eax]
mov eax, dword [0x42a030]
xor ecx, ecx
call fcn.00406b50
push dword [esp + 0xc]
push dword [esp + 0xc]
mov eax, dword [esp + 8]
call fcn.0041ecc8
mov eax, dword [esp]
call fcn.0040a210
mov eax, 0x42a038
mov edx, ebx
call fcn.004036e8
add esp, 0x10
pop ebx
ret
Function at 0x41f208
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
mov esi, edx
lea edi, [ebp - 0x1c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xc], ecx
mov esi, eax
xor eax, eax
push ebp
push 0x41f3c6
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x1d], 1
lea eax, [esi + esi*2]
mov edx, dword [0x42885c]
mov edx, dword [edx]
mov eax, dword [edx + eax*4]
lea ecx, [ebp - 0x24]
xor edx, edx
call fcn.0041d480
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xc]
call fcn.004036e8
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.00403af4
push eax
call sub.kernel32.dll_GetFileAttributesA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x41f35d
test bl, 0x10
jne 0x41f35d
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.00403af4
push eax
call sub.kernel32.dll_CreateFileA
mov edi, eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push edi
call sub.kernel32.dll_GetFileTime
push edi
call sub.kernel32.dll_CloseHandle
lea eax, [esi + esi*2]
mov edx, dword [0x42885c]
mov edx, dword [edx]
mov eax, dword [edx + eax*4 + 4]
call fcn.0040d700
cmp eax, 4
ja case.default.0x41f2cf
jmp dword [eax*4 + 0x41f2d6]
push ebp
call fcn.0041f008
pop ecx
jmp case.default.0x41f2cf
lea edx, [ebp - 0x14]
lea eax, [ebp - 0x1c]
call fcn.00405c1c
dec eax
jne 0x41f30a
push ebp
call fcn.0041f008
pop ecx
jmp case.default.0x41f2cf
mov byte [ebp - 0x1d], 0
jmp case.default.0x41f2cf
mov byte [ebp - 0x1d], 1
jmp case.default.0x41f2cf
lea edx, [ebp - 0x14]
lea eax, [ebp - 0x1c]
call fcn.00405c1c
dec eax
sete byte [ebp - 0x1d]
jmp case.default.0x41f2cf
mov byte [ebp - 0x1d], 0
cmp byte [ebp - 0x1d], 0
je 0x41f372
test bl, 1
je 0x41f34b
and ebx, 0xfffffffe
push ebx
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.00403af4
push eax
call sub.kernel32.dll_SetFileAttributesA
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.00403af4
push eax
call sub.kernel32.dll_DeleteFileA
jmp 0x41f372
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.00405c8c
mov eax, dword [ebp - 0x28]
call fcn.00405ce4
cmp byte [ebp - 0x1d], 0
jne 0x41f382
mov eax, dword [ebp - 0xc]
call fcn.00403694
jmp 0x41f3a8
lea eax, [esi + esi*2]
mov edx, dword [0x42885c]
mov edx, dword [edx]
mov eax, dword [edx + eax*4 + 8]
call fcn.0040d700
dec eax
jne 0x41f3a8
mov edx, dword [ebp - 0xc]
mov edx, dword [edx]
mov eax, dword [0x42a03c]
call fcn.0040c46c
mov bl, byte [ebp - 0x1d]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41f3cd
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.004036b8
ret
Function at 0x422c0c
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x422ce5
push dword fs:[eax]
mov dword fs:[eax], esp
xor edi, edi
lea ecx, [ebp - 4]
xor edx, edx
mov eax, edi
call fcn.00422b48
mov eax, dword [ebp - 4]
call fcn.00403af4
push eax
call sub.kernel32.dll_DeleteFileA
inc edi
cmp edi, 0x12
jne 0x422c2b
test bl, bl
je 0x422ca2
mov eax, 0x1a
call fcn.00422b38
mov esi, eax
add esi, 0x14
sub esi, 0x14
jl 0x422ca2
inc esi
mov edi, 0x14
lea ecx, [ebp - 8]
xor edx, edx
mov eax, edi
call fcn.00422b48
mov eax, dword [ebp - 8]
call fcn.00403af4
push eax
call sub.kernel32.dll_DeleteFileA
lea ecx, [ebp - 0xc]
lea eax, [edi + 0x1e]
xor edx, edx
call fcn.00422b48
mov eax, dword [ebp - 0xc]
call fcn.00403af4
push eax
call sub.kernel32.dll_DeleteFileA
inc edi
dec esi
jne 0x422c69
lea ecx, [ebp - 0x14]
xor edx, edx
mov eax, 1
call fcn.00422b48
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.00405c8c
mov eax, dword [ebp - 0x10]
call fcn.00403af4
push eax
call sub.kernel32.dll_RemoveDirectoryA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x422cec
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.004036b8
ret

Function at 0x42307c
Capabilities:
Compare security identifiers

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov byte [esp], 0
lea eax, [esp + 4]
push eax
push 0xffffffffffffffff
push 8
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.advapi32.dll_OpenThreadToken
mov ebx, eax
test ebx, ebx
jne 0x4230c0
call sub.kernel32.dll_GetLastError
cmp eax, 0x3f0
jne 0x4230c0
lea eax, [esp + 4]
push eax
push 8
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
mov ebx, eax
test ebx, ebx
je 0x423157
mov eax, 0x400
call fcn.00402830
mov esi, eax
lea eax, [esp + 8]
push eax
push 0x400
push esi
push 2
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_GetTokenInformation
mov ebx, eax
mov eax, dword [esp + 4]
push eax
call sub.kernel32.dll_CloseHandle
test ebx, ebx
je 0x423150
lea eax, [esp + 0xc]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
push 0x4287d0
call sub.advapi32.dll_AllocateAndInitializeSid
mov ebx, dword [esi]
dec ebx
test ebx, ebx
jl 0x423146
inc ebx
xor edi, edi
mov eax, dword [esi + edi*8 + 4]
push eax
mov eax, dword [esp + 0x10]
push eax
call sub.advapi32.dll_EqualSid
test eax, eax
je 0x423142
mov byte [esp], 1
jmp 0x423146
inc edi
dec ebx
jne 0x423129
mov eax, dword [esp + 0xc]
push eax
call sub.advapi32.dll_FreeSid
mov eax, esi
call fcn.00402860
mov al, byte [esp]
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x423450
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403ae4
xor eax, eax
push ebp
push 0x4234c1
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0040a9b4
mov edx, dword [ebp - 8]
mov eax, 0x42a0dc
call fcn.004036e8
xor eax, eax
mov dword [0x42a0d8], eax
push 0
push 0x423364
call sub.user32.dll_EnumWindows
mov ebx, dword [0x42a0d8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4234c8
lea eax, [ebp - 8]
mov edx, 2
call fcn.004036b8
ret

Function at 0x4234d0
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
push ecx
mov esi, eax
xor ebx, ebx
test esi, esi
jns 0x4234e1
call fcn.00402d14
push esi
push 0xffffffffffffffff
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
mov edi, eax
test edi, edi
jns 0x4234f9
call fcn.00402d14
push esp
mov esi, edi
test esi, esi
jns 0x423505
call fcn.00402d14
push esi
call sub.kernel32.dll_GetExitCodeProcess
test edi, edi
je 0x423528
mov eax, dword [esp]
push eax
test edi, edi
jns 0x42351c
call fcn.00402d14
push esi
call sub.kernel32.dll_TerminateProcess
cmp eax, 1
sbb ebx, ebx
inc ebx
test edi, edi
jns 0x423531
call fcn.00402d14
push esi
call sub.kernel32.dll_CloseHandle
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x4035ac
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x82f008], 0x8088405
inc edx
mov dword [ebx + 0x82f008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x41cd64
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ebp
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0x41cd95
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cd7d
add dl, dl
jne 0x41cda0
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cdf1
xor eax, eax
add dl, dl
jne 0x41cdad
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41ce8e
add dl, dl
jne 0x41cdbc
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cdc7
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cdd2
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cddd
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x41cde7
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x41cd8c
mov eax, 1
add dl, dl
jne 0x41cdff
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41ce0a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cdf6
sub eax, ebx
mov ebx, 1
jne 0x41ce3d
mov ecx, 1
add dl, dl
jne 0x41ce23
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41ce2e
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41ce1a
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cd8c
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x41ce54
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41ce5f
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41ce4b
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cd8c
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x41ceaf
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x41cd8c
pop ebp
sub edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x41e5a4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x816a63
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov ecx, ebx
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [ecx + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x78]
test edx, edx
je 0x41e655
add edx, ebx
mov eax, edx
mov esi, dword [eax + 0x18]
mov edx, dword [eax + 0x1c]
add edx, ebx
mov dword [ebp - 0x10], edx
mov edi, dword [eax + 0x20]
add edi, ebx
mov edx, dword [eax + 0x24]
add edx, ebx
mov dword [ebp - 0xc], edx
mov edx, dword [ebp - 4]
cmp edx, 0xffff
jbe 0x41e63e
test esi, esi
jbe 0x41e655
mov eax, dword [edi]
add eax, ebx
mov edx, dword [ebp - 4]
call fcn.004088e4
test eax, eax
jne 0x41e630
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x41e655
add dword [ebp - 0xc], 2
add edi, 4
dec esi
test esi, esi
ja 0x41e60d
jmp 0x41e655
mov ecx, edx
sub ecx, dword [eax + 0x10]
cmp ecx, dword [eax + 0x14]
jae 0x41e655
mov eax, ecx
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x816a6a
ret
Function at 0x41eec4
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ecx
mov word [ebp - 2], dx
xor eax, eax
push ebp
push 0x817473
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00404cd0
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0x41eeff
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x41ef18
lea eax, [ebp - 0x10]
mov edx, dword [0x8312a4]
mov edx, dword [edx]
mov edx, dword [edx + 0xc]
call fcn.00404d30
jmp 0x41ef2b
lea eax, [ebp - 0x10]
mov edx, dword [0x8312a4]
mov edx, dword [edx]
mov edx, dword [edx + 0x10]
call fcn.00404d30
lea eax, [ebp - 0x10]
mov edx, ebx
sar edx, 1
jns 0x41ef37
adc edx, 0
mov edx, dword [edx*4 + 0x83010c]
call fcn.00404f20
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x10]
call fcn.00404f04
push eax
call fcn.00406b1c
mov esi, eax
cmp esi, 0xffffffff
je 0x41f045
mov eax, 0x40
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x40
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x41f038
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x41f038
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.00406ddc
mov eax, edi
call fcn.00403288
mov eax, 0x18
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x18
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x41f038
mov eax, edi
cmp dword [eax], 0x4550
jne 0x41f038
add eax, 4
mov dx, word [eax]
cmp dx, 0x14c
jb 0x41f038
cmp dx, 0x150
ja 0x41f038
mov eax, edi
call fcn.00403288
mov eax, 0xe0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0xe0
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x41f038
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 2]
jne 0x41f038
mov eax, dword [eax + 0x10]
mov edx, dword [ebp - 8]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
mov eax, edi
call fcn.00403288
push esi
call fcn.00406ad4
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.0040502c
jne 0x41f05d
inc ebx
cmp ebx, 0x19
jne 0x41eef1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x81747a
lea eax, [ebp - 0x10]
call fcn.00404cd0
ret
Function at 0x401230
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x401249
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x40125d
pop esi
pop edi
xor eax, eax
pop ebx
ret
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x40127e
cmp esi, eax
jae 0x401257
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x401270
cmp esi, eax
jae 0x401257
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret
Function at 0x407430
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x462050
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x64
mov eax, dword [0x487140]
push ebx
xor eax, ebp
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x14], eax
mov al, byte [edi + 0x29c]
xor ebx, ebx
cmp al, bl
mov dword [ebp - 0x10], esp
mov dword [ebp - 4], ebx
jne 0x407486
push ebx
push 0x466b38
push 0x4679e4
mov ecx, 0x4df0a8
call fcn.00424cf0
jmp 0x40756b
cmp dword [edi + 0x2fc], ebx
jbe 0x40756b
mov eax, dword [edi + 0x300]
cmp eax, 0x10
lea esi, [edi + 0x2e8]
jb 0x4074a8
mov eax, dword [esi + 4]
jmp 0x4074ab
lea eax, [esi + 4]
push ebx
push eax
call fcn.00430de1
add esp, 8
cmp eax, 0xffffffff
jne 0x407586
mov edi, 0xf
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
push esi
lea eax, [ebp - 0x70]
push 0x4679dc
push eax
mov byte [ebp - 4], 1
call fcn.00407070
add esp, 0xc
push 0x4679d0
push eax
lea ecx, [ebp - 0x54]
push ecx
mov byte [ebp - 4], 2
call fcn.00406f00
add esp, 0xc
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 3
call fcn.004060b0
mov eax, dword [ebp - 0x3c]
mov esi, 0x10
cmp eax, esi
jb 0x407520
mov edx, dword [ebp - 0x50]
push edx
call fcn.0044f7c9
add esp, 4
cmp dword [ebp - 0x58], esi
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x40], ebx
mov byte [ebp - 0x50], bl
mov byte [ebp - 4], 1
jb 0x40753e
mov eax, dword [ebp - 0x6c]
push eax
call fcn.0044f7c9
add esp, 4
cmp dword [ebp - 0x18], esi
mov eax, dword [ebp - 0x2c]
jae 0x407549
lea eax, [ebp - 0x2c]
push ebx
push 0x466b70
push eax
mov ecx, 0x4df0a8
call fcn.00424cf0
cmp dword [ebp - 0x18], esi
jb 0x40756b
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.0044f7c9
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043049e
mov esp, ebp
pop ebp
ret
push ebx
call dword [sym.imp.USER32.dll_PostQuitMessage]
push 0xffffffffffffffff
push ebx
push esi
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
call fcn.004060b0
push 0xd
push str._zfs4connect_
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 4
call fcn.00401db0
push 0xffffffffffffffff
push ebx
add edi, 0x2cc
push edi
lea ecx, [ebp - 0x30]
call fcn.00401cc0
mov eax, dword [ebp - 0x18]
mov esi, 0x10
cmp eax, esi
mov eax, dword [ebp - 0x2c]
jae 0x4075dd
lea eax, [ebp - 0x2c]
mov edx, dword [0x4f4838]
push eax
push str.Run:__s_n
push edx
call fcn.00441300
mov eax, dword [ebp - 0x18]
add esp, 0xc
cmp eax, esi
mov eax, dword [ebp - 0x2c]
jae 0x4075ff
lea eax, [ebp - 0x2c]
push 5
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
mov eax, dword [0x4f4838]
push str.run_game_client_end_n
push eax
call fcn.00441300
add esp, 8
jmp 0x40755a
Function at 0x4108a0
Capabilities:
Terminate process

Disassembly:
push esi
push 0x28
call fcn.004300c0
mov esi, eax
add esp, 4
test esi, esi
jne 0x4108bb
mov eax, str.out_of_dynamic_memory_in_yy_create_buffer__
jmp 0x410810
mov eax, dword [esp + 0xc]
mov dword [esi + 0xc], eax
add eax, 2
push eax
call fcn.004300c0
add esp, 4
test eax, eax
mov dword [esi + 4], eax
jne 0x4108df
mov eax, str.out_of_dynamic_memory_in_yy_create_buffer__
jmp 0x410810
push esi
mov dword [esi + 0x14], 1
call fcn.004107b0
mov eax, dword [esp + 0xc]
mov dword [esi], eax
add esp, 4
mov dword [esi + 0x20], 1
mov dword [esi + 0x18], 0
mov eax, esi
pop esi
ret
Function at 0x4119c0
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x194
mov eax, dword [0x487140]
xor eax, esp
mov dword [esp + 0x190], eax
mov eax, dword [0x4a9010]
test eax, eax
push ebx
push esi
mov esi, ecx
jne 0x4119f0
call sub.WINMM.dll_timeGetTime
mov dword [0x4a9010], eax
mov dword [0x4a9024], eax
mov ebx, dword [esp + 0x1a4]
xor ecx, ecx
mov ch, bl
lea eax, [esp + 8]
push eax
mov cl, byte [esp + 0x1a4]
push ecx
call sub.WS2_32.dll_WSAStartup
test eax, eax
je 0x411a23
mov edx, dword [0x4f482c]
add esi, 0x2c
push esi
push str._s:_WSAStartup_error_n
push edx
jmp 0x411a66
mov ax, word [esp + 8]
movzx ecx, al
cmp ecx, ebx
jne 0x411a56
movzx edx, ah
cmp edx, dword [esp + 0x1a0]
jne 0x411a56
mov eax, dword [0x4f4838]
add esi, 0x2c
push esi
push str._s:_WSAStartup_ok_n
push eax
call fcn.00441300
add esp, 0xc
mov al, 1
jmp 0x411a75
mov ecx, dword [0x4f482c]
add esi, 0x2c
push esi
push 0x469914
push ecx
call fcn.00441300
add esp, 0xc
call fcn.0044c326
xor al, al
mov ecx, dword [esp + 0x198]
pop esi
pop ebx
xor ecx, esp
call fcn.0043049e
add esp, 0x194
ret 8