joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40499e
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 8]
cmp esi, dword [0x40ab04]
push edi
jae 0x404b65
mov eax, esi
sar eax, 5
lea ebx, [eax*4 + 0x40ab20]
mov eax, dword [ebx]
and esi, 0x1f
shl esi, 3
add eax, esi
mov dl, byte [eax + 4]
test dl, 1
je 0x404b65
and dword [ebp - 0xc], 0
cmp dword [ebp + 0x10], 0
mov edi, dword [ebp + 0xc]
mov ecx, edi
je 0x404a44
test dl, 2
jne 0x404a44
test dl, 0x48
je 0x404a0e
mov al, byte [eax + 5]
cmp al, 0xa
je 0x404a0e
dec dword [ebp + 0x10]
mov byte [edi], al
mov eax, dword [ebx]
lea ecx, [edi + 1]
mov dword [ebp - 0xc], 1
mov byte [eax + esi + 5], 0xa
push 0
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0x10]
mov eax, dword [ebx]
push ecx
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x404a57
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 5
pop ecx
cmp eax, ecx
jne 0x404a3f
mov dword [0x4096d0], ecx
jmp 0x404b6c
cmp eax, 0x6d
jne 0x404a4b
xor eax, eax
jmp 0x404b79
push eax
call fcn.00401aff
pop ecx
jmp 0x404b76
mov eax, dword [ebx]
mov edx, dword [ebp - 0x10]
add dword [ebp - 0xc], edx
lea ecx, [eax + esi + 4]
mov al, byte [ecx]
test al, al
jns 0x404b60
test edx, edx
je 0x404a7a
cmp byte [edi], 0xa
jne 0x404a7a
or al, 4
jmp 0x404a7c
and al, 0xfb
mov byte [ecx], al
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0xc]
add ecx, eax
cmp eax, ecx
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], ecx
jae 0x404b5a
mov eax, dword [ebp - 8]
mov al, byte [eax]
cmp al, 0x1a
je 0x404b4a
cmp al, 0xd
je 0x404ab0
mov byte [edi], al
inc edi
inc dword [ebp - 8]
jmp 0x404b3c
dec ecx
cmp dword [ebp - 8], ecx
jae 0x404aca
mov eax, dword [ebp - 8]
inc eax
cmp byte [eax], 0xa
jne 0x404ac5
add dword [ebp - 8], 2
jmp 0x404b1e
mov dword [ebp - 8], eax
jmp 0x404b38
inc dword [ebp - 8]
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
mov eax, dword [ebx]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x404af2
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x404b38
cmp dword [ebp - 0x10], 0
je 0x404b38
mov eax, dword [ebx]
test byte [eax + esi + 4], 0x48
je 0x404b13
mov al, byte [ebp - 1]
cmp al, 0xa
je 0x404b1e
mov byte [edi], 0xd
mov ecx, dword [ebx]
mov byte [ecx + esi + 5], al
jmp 0x404b3b
cmp edi, dword [ebp + 0xc]
jne 0x404b23
cmp byte [ebp - 1], 0xa
jne 0x404b23
mov byte [edi], 0xa
jmp 0x404b3b
push 1
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.00404c7e
add esp, 0xc
cmp byte [ebp - 1], 0xa
je 0x404b3c
mov byte [edi], 0xd
inc edi
mov ecx, dword [ebp - 0xc]
cmp dword [ebp - 8], ecx
jb 0x404a94
jmp 0x404b5a
mov eax, dword [ebx]
lea esi, [eax + esi + 4]
mov al, byte [esi]
test al, 0x40
jne 0x404b5a
or al, 2
mov byte [esi], al
sub edi, dword [ebp + 0xc]
mov dword [ebp - 0xc], edi
mov eax, dword [ebp - 0xc]
jmp 0x404b79
and dword [0x4096d0], 0
mov dword [0x4096cc], 9
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x404d0a
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x4091b0]
xor eax, dword [ebp + 4]
mov ecx, dword [ebp + 8]
cmp ecx, dword [0x40ab04]
push ebx
push esi
mov dword [ebp - 4], eax
push edi
jae 0x404e9a
mov eax, ecx
sar eax, 5
lea ebx, [eax*4 + 0x40ab20]
mov eax, dword [ebx]
mov esi, ecx
and esi, 0x1f
shl esi, 3
mov al, byte [eax + esi + 4]
test al, 1
mov dword [ebp - 0x18], ebx
je 0x404e9a
xor edi, edi
cmp dword [ebp + 0x10], edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x14], edi
jne 0x404d69
xor eax, eax
jmp 0x404eae
test al, 0x20
je 0x404d7a
push 2
push edi
push edi
push ecx
call fcn.0040654d
add esp, 0x10
mov eax, dword [ebx]
add eax, esi
test byte [eax + 4], 0x80
je 0x404e36
cmp dword [ebp + 0x10], edi
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov dword [ebp + 8], edi
jbe 0x404e6e
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x41c]
cmp ecx, dword [ebp + 0x10]
jae 0x404dd0
mov edx, dword [ebp - 8]
inc dword [ebp - 8]
mov dl, byte [edx]
inc ecx
cmp dl, 0xa
jne 0x404dc1
inc dword [ebp - 0x14]
mov byte [eax], 0xd
inc eax
inc edi
mov ebx, dword [ebp - 0x18]
mov byte [eax], dl
inc eax
inc edi
cmp edi, 0x400
jl 0x404da6
mov edi, eax
lea eax, [ebp - 0x41c]
sub edi, eax
push 0
lea eax, [ebp - 0x10]
push eax
push edi
lea eax, [ebp - 0x41c]
push eax
mov eax, dword [ebx]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x404e10
mov eax, dword [ebp - 0x10]
add dword [ebp - 0xc], eax
cmp eax, edi
jl 0x404e19
mov eax, dword [ebp - 8]
sub eax, dword [ebp + 0xc]
xor edi, edi
cmp eax, dword [ebp + 0x10]
jb 0x404d9a
jmp 0x404e1b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 8], eax
xor edi, edi
mov eax, dword [ebp - 0xc]
cmp eax, edi
jne 0x404e95
cmp dword [ebp + 8], edi
je 0x404e6e
push 5
pop eax
cmp dword [ebp + 8], eax
jne 0x404e63
mov dword [0x4096d0], eax
jmp 0x404ea1
push edi
lea ecx, [ebp - 0x10]
push ecx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x404e58
mov eax, dword [ebp - 0x10]
mov dword [ebp + 8], edi
mov dword [ebp - 0xc], eax
jmp 0x404e1b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 8], eax
jmp 0x404e1b
push dword [ebp + 8]
call fcn.00401aff
pop ecx
jmp 0x404eab
mov eax, dword [ebx]
test byte [eax + esi + 4], 0x40
je 0x404e83
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0x1a
je 0x404d62
mov dword [0x4096cc], 0x1c
mov dword [0x4096d0], edi
jmp 0x404eab
sub eax, dword [ebp - 0x14]
jmp 0x404eae
and dword [0x4096d0], 0
mov dword [0x4096cc], 9
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
pop edi
pop esi
pop ebx
call fcn.00401c07
leave
ret
Function at 0x405445
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x409850], ebx
push esi
push edi
jne 0x4054c5
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x405500
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x407cbc
push edi
call esi
test eax, eax
mov dword [0x409850], eax
je 0x405500
push str.GetActiveWindow
push edi
call esi
push str.GetLastActivePopup
push edi
mov dword [0x409854], eax
call esi
cmp dword [0x4096d8], 2
mov dword [0x409858], eax
jne 0x4054c5
push str.GetUserObjectInformationA
push edi
call esi
test eax, eax
mov dword [0x409860], eax
je 0x4054c5
push str.GetProcessWindowStation
push edi
call esi
mov dword [0x40985c], eax
mov eax, dword [0x40985c]
test eax, eax
je 0x40550a
call eax
test eax, eax
je 0x4054f1
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x409860]
test eax, eax
je 0x4054f1
test byte [ebp - 8], 1
jne 0x40550a
cmp dword [0x4096e4], 4
jb 0x405504
or byte [ebp + 0x12], 0x20
jmp 0x405529
xor eax, eax
jmp 0x405539
or byte [ebp + 0x12], 4
jmp 0x405529
mov eax, dword [0x409854]
test eax, eax
je 0x405529
call eax
mov ebx, eax
test ebx, ebx
je 0x405529
mov eax, dword [0x409858]
test eax, eax
je 0x405529
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x409850]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x406118
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
push 4
pop eax
call fcn.00401840
mov ebx, esp
push 0x1c
lea eax, [ebp - 0x24]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x4061ad
mov edi, dword [ebp - 0x20]
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x44]
lea esi, [eax - 1]
not esi
and esi, ebx
sub esi, eax
mov dword [ebp - 4], eax
mov eax, dword [0x4096d8]
mov ecx, eax
dec ecx
neg ecx
sbb ecx, ecx
and ecx, 0xffff1000
add ecx, 0x11000
add ecx, edi
cmp esi, ecx
jb 0x4061ad
cmp eax, 1
je 0x4061c5
mov ebx, edi
mov edi, 0x1000
push 0x1c
lea eax, [ebp - 0x24]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x4061ad
add ebx, dword [ebp - 0x18]
test dword [ebp - 0x14], edi
je 0x406182
test byte [ebp - 0xf], 1
mov ebx, dword [ebp - 0x24]
je 0x4061a9
xor eax, eax
inc eax
jmp 0x4061e1
cmp esi, ebx
jae 0x4061b1
xor eax, eax
jmp 0x4061e1
push 4
push edi
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x4096d8]
jmp 0x4061c7
mov ebx, esi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 8]
push ecx
inc eax
push eax
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x54]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x406889
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1008
call fcn.00401840
mov eax, dword [0x4091b0]
xor eax, dword [ebp + 4]
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
cmp ebx, dword [0x40ab04]
mov dword [ebp - 4], eax
jae 0x4069c9
mov eax, ebx
sar eax, 5
mov eax, dword [eax*4 + 0x40ab20]
mov ecx, ebx
and ecx, 0x1f
test byte [eax + ecx*8 + 4], 1
je 0x4069c9
push 1
push esi
push ebx
call fcn.00404c7e
add esp, 0xc
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
je 0x4069d3
push 2
push esi
push ebx
call fcn.00404c7e
add esp, 0xc
cmp eax, 0xffffffff
je 0x4069d3
push edi
mov edi, dword [ebp + 0xc]
sub edi, eax
test edi, edi
jle 0x406976
push 0x1000
lea eax, [ebp - 0x1008]
push esi
push eax
call fcn.00405ea0
push reloc.KERNEL32.dll_FreeEnvironmentStringsA
push ebx
call fcn.00406bdb
add esp, 0x14
mov dword [ebp + 8], eax
mov eax, 0x1000
cmp edi, eax
jge 0x406935
mov eax, edi
push eax
lea eax, [ebp - 0x1008]
push eax
push ebx
call fcn.00404d0a
add esp, 0xc
cmp eax, 0xffffffff
je 0x406953
sub edi, eax
test edi, edi
jg 0x40692a
jmp 0x406969
cmp dword [0x4096d0], 5
jne 0x406966
mov dword [0x4096cc], 0xd
or esi, 0xffffffff
push dword [ebp + 8]
push ebx
call fcn.00406bdb
pop ecx
pop ecx
jmp 0x4069b6
jge 0x4069b6
push 0
push dword [ebp + 0xc]
push ebx
call fcn.00404c7e
push ebx
call fcn.00406511
add esp, 0x10
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov esi, eax
neg esi
sbb esi, esi
neg esi
dec esi
cmp esi, 0xffffffff
jne 0x4069b6
mov dword [0x4096cc], 0xd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x4096d0], eax
push 0
push dword [ebp - 8]
push ebx
call fcn.00404c7e
add esp, 0xc
mov eax, esi
pop edi
jmp 0x4069d6
mov dword [0x4096cc], 9
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
pop esi
pop ebx
call fcn.00401c07
leave
ret
Function at 0x10001010
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get file size
Print debug messages
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push 0x1fc
push eax
mov word [ebp - 0x204], ax
lea eax, [ebp - 0x202]
push eax
call fcn.100054d0
add esp, 0xc
lea eax, [ebp - 0x204]
push 0xff
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [ebp - 0x204]
lea edx, [ecx + 2]
mov edi, edi
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10001060
sub ecx, edx
sar ecx, 1
lea ecx, [ecx*2 - 6]
cmp ecx, 0x1fe
jae 0x10001166
xor eax, eax
mov word [ebp + ecx - 0x204], ax
lea ecx, [ebp - 0x204]
add ecx, 0xfffffffe
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x10001095
mov eax, dword [0x10010474]
push ebx
mov dword [ecx], eax
mov eax, dword [0x10010478]
push esi
mov dword [ecx + 4], eax
lea eax, [ebp - 0x204]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 0
push 0
push 3
push 0
push 3
push 0xc0000000
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x100010f6
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000117d
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x208]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
push edi
call fcn.1000118c
add esp, 4
mov ebx, eax
lea eax, [ebp - 0x208]
push 0
push eax
push edi
push ebx
push esi
mov dword [ebx], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [ebp - 0x208], edi
jne 0x100010e3
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x40
push 0x1000
push edi
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push edi
mov esi, eax
push ebx
push esi
call fcn.10005ae0
add esp, 0xc
call esi
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ecx]
push 0x64
call esi
jmp 0x10001160
call fcn.100012cd
int3
Function at 0x401fc0
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
mov eax, dword [esp + 8]
push ebx
push ebp
push esi
push edi
and eax, 0xffff
xor ebp, ebp
push 0x404798
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
je 0x402041
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x402041
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x402041
mov ecx, dword [esp + 0x14]
push 0x404794
push ecx
call dword [sym.imp.MSVCRT.dll_fopen]
mov edi, eax
add esp, 8
test edi, edi
je 0x402041
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
push edi
push esi
push 1
push ebx
call dword [sym.imp.MSVCRT.dll_fwrite]
push edi
mov ebx, eax
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0x14
xor eax, eax
cmp ebx, esi
pop edi
pop esi
pop ebp
pop ebx
sete al
ret
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
ret

Function at 0x402140
Capabilities:
Get file version info

Disassembly:
sub esp, 0x10c
push ebx
mov ebx, dword [esp + 0x114]
push esi
push edi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
test esi, esi
jg 0x40216a
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x10c
ret
push esi
call sub.MFC42.DLL_operatornew
mov edi, eax
add esp, 4
test edi, edi
jne 0x402183
pop edi
pop esi
pop ebx
add esp, 0x10c
ret
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
jne 0x4021a6
push edi
call sub.MFC42.DLL_operatordelete
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x10c
ret
lea eax, [esp + 0xc]
push ebp
lea ecx, [esp + 0x18]
push eax
push ecx
push 0x404868
push edi
call sub.VERSION.dll_VerQueryValueA
mov eax, dword [esp + 0x18]
xor edx, edx
xor ecx, ecx
xor ebp, ebp
mov dx, word [eax + 2]
mov cx, word [eax]
push edx
push ecx
lea edx, [esp + 0x24]
push 0x404840
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
lea eax, [esp + 0x10]
lea ecx, [esp + 0x14]
lea edx, [esp + 0x1c]
push eax
push ecx
push edx
push edi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x402248
mov esi, dword [esp + 0x14]
mov eax, dword [esp + 0x124]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x40222a
test cl, cl
je 0x402226
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x40222a
add eax, 2
add esi, 2
test cl, cl
jne 0x402206
xor eax, eax
jmp 0x40222f
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jg 0x40223a
mov ebp, 1
jmp 0x402248
push 0x40482c
push ebx
call fcn.004020a0
add esp, 8
push edi
call sub.MFC42.DLL_operatordelete
add esp, 4
mov eax, ebp
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x10c
ret
Function at 0x401000
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp - 0x7c], eax
mov dword [ebp - 8], 8
mov dword [ebp - 4], 0x4000
lea ecx, [ebp - 8]
push ecx
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov edx, dword [ebp + 8]
mov dword [ebp - 0x80], edx
mov eax, dword [ebp + 8]
push eax
call fcn.00402fd0
add esp, 4
push str.Times_New_Roman
lea ecx, [ebp - 0xa0]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov dword [ebp - 0xac], 0xe
mov dword [ebp - 0xbc], 0xa
lea edx, [ebp - 0xbc]
push edx
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
mov dword [0x405324], eax
push 0x14
push str.darry
lea eax, [ebp - 0xa0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00403050
add esp, 8
test eax, eax
jne 0x4010ab
xor eax, eax
jmp 0x4010e4
push 0
push 0
push 0
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x4010de
lea ecx, [ebp - 0x128]
push ecx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea edx, [ebp - 0x128]
push edx
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x4010ab
mov eax, dword [ebp - 0x120]
mov esp, ebp
pop ebp
ret 0x10

Function at 0x401195
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
mov al, byte [esi]
cmp al, 0x22
jne 0x4011be
mov al, byte [esi + 1]
inc esi
test al, al
je 0x4011b6
cmp al, 0x22
jne 0x4011aa
cmp byte [esi], 0x22
jne 0x4011c8
inc esi
jmp 0x4011c8
cmp al, 0x20
jle 0x4011c8
inc esi
cmp byte [esi], 0x20
jg 0x4011c2
mov al, byte [esi]
test al, al
je 0x4011d2
cmp al, 0x20
jle 0x4011bb
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.00401ae8
push 0x405004
push section..data
call fcn.00401228
test byte [ebp - 0x18], 1
pop ecx
pop ecx
je 0x401202
movzx eax, word [ebp - 0x14]
jmp 0x401205
push 0xa
pop eax
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov esi, eax
call fcn.00401eb2
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x401be0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x540024]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, edx
mov dword [ebp - 0x214], eax
push edi
mov edi, ecx
test esi, esi
je 0x401cff
xor eax, eax
cmp word [esi], ax
je 0x401cff
push 4
push 0x485d64
push esi
call fcn.0046bab1
add esp, 0xc
test eax, eax
jne 0x401c30
add esi, 8
push 2
push 0x485d70
push esi
call fcn.0046bab1
add esp, 0xc
test eax, eax
jne 0x401c47
add esi, 4
push 0x20a
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.00469a60
push 0x104
push esi
lea eax, [ebp - 0x210]
push 0x105
push eax
call fcn.0046bbb9
lea eax, [ebp - 0x210]
push 0x2e
push eax
call fcn.00469289
mov esi, eax
add esp, 0x24
test esi, esi
je 0x401cb8
xor eax, eax
mov word [esi], ax
inc esi
add esi, 1
je 0x401cb8
push str.HTML
push esi
call fcn.0046b594
pop ecx
pop ecx
test eax, eax
je 0x401cb8
push 0x485d84
push esi
call fcn.0046b594
pop ecx
pop ecx
test eax, eax
je 0x401cb8
push esi
jmp 0x401cba
push 0x17
lea eax, [ebp - 0x210]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x401cff
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x401cff
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [ebp - 0x214]
mov dword [ecx], eax
test eax, eax
je 0x401cff
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebx], eax
test eax, eax
je 0x401cff
mov al, 1
jmp 0x401d01
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00467b12
leave
ret

Function at 0x402178
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
mov eax, dword [0x540024]
xor eax, esp
mov dword [esp + 0x20], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], esi
cmp dword [ebp + 0xc], ebx
jbe 0x4021ec
mov esi, eax
test ebx, ebx
je 0x4021b7
push 0x485dd4
call edi
push 1
lea eax, [esp + 0x18]
mov ecx, esi
push eax
call fcn.00401620
cmp dword [esp + 0x28], 8
lea eax, [esp + 0x14]
cmovae eax, dword [esp + 0x14]
push eax
call edi
lea ecx, [esp + 0x14]
call fcn.00402a8b
inc ebx
add esi, 0x10
cmp ebx, dword [ebp + 0xc]
jb 0x4021ac
mov esi, dword [esp + 0x10]
push 0x485dd8
call edi
call fcn.00401ade
push esi
mov ecx, dword [eax + 0x204]
call ecx
mov ecx, dword [esp + 0x2c]
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00467b12
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4059cb
Capabilities:
Get graphical window text

Disassembly:
push 0x30
mov eax, 0x47dbf6
call fcn.0046864a
mov edi, ecx
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x3c], ecx
mov eax, dword [ecx]
sub eax, 0xfd
je 0x405a21
sub eax, 1
je 0x4059f4
xor al, al
jmp 0x405a94
push 0
lea eax, [ebp - 0x28]
add ecx, 8
push eax
call fcn.00401620
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push dword [edi + 0x10]
call dword [sym.imp.USER32.dll_SetWindowTextW]
lea ecx, [ebp - 0x28]
call fcn.00402a8b
jmp 0x405a92
push dword [edi + 0x10]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
xor ecx, ecx
mov esi, eax
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00467e81
pop ecx
push esi
mov ebx, eax
push ebx
push dword [edi + 0x10]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push esi
push ebx
lea ecx, [ebp - 0x38]
call fcn.00405873
mov edi, eax
mov esi, dword [ebp - 0x3c]
and dword [ebp - 4], 0
add esi, 8
call fcn.00401ade
push edi
push esi
mov ecx, dword [eax + 0x210]
call ecx
mov dword [ebp - 4], 1
call fcn.00401ade
lea edx, [ebp - 0x38]
push edx
mov ecx, dword [eax + 0x208]
call ecx
push ebx
call fcn.00467b20
pop ecx
mov al, 1
call fcn.004685f9
ret 8

Function at 0x40759d
Capabilities:
Create thread

Disassembly:
push 8
mov eax, 0x47e13e
call fcn.00468617
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, dword [ebp + 8]
push 8
call fcn.00467d2e
mov esi, eax
pop ecx
mov dword [ebp - 0x10], esi
mov byte [ebp - 4], 1
mov dword [esi], 0x40731c
mov dword [esi + 4], ebx
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x4075e2
mov dword [esi + 4], ecx
xor eax, eax
lea ecx, [edi + 4]
mov eax, dword [ecx]
push ecx
mov eax, dword [eax]
call eax
pop ecx
lea eax, [ebp - 0x14]
push eax
push ebx
push esi
push 0x40761a
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 2
mov eax, dword [ebp + 8]
test eax, eax
je 0x407614
lea ecx, [eax + 4]
mov eax, dword [ecx]
push ecx
call dword [eax + 4]
pop ecx
call fcn.004685e5
ret

Function at 0x407aec
Capabilities:
Create thread

Disassembly:
push 4
mov eax, 0x47e20b
call fcn.00468617
mov ebx, ecx
push 8
call fcn.00467d2e
mov esi, eax
pop ecx
mov dword [ebp - 0x10], esi
xor edx, edx
mov dword [ebp - 4], edx
mov ecx, dword [ebp + 0xc]
mov dword [esi], edx
mov ecx, dword [ecx]
test ecx, ecx
je 0x407b26
mov dword [esi], ecx
add ecx, 4
push ecx
mov eax, dword [ecx]
mov eax, dword [eax]
call eax
pop ecx
xor edx, edx
mov eax, dword [ebp + 8]
mov dword [esi + 4], eax
mov dword [ebp + 0xc], esi
lea edi, [ebx + 4]
mov dword [ebp - 4], 1
push edi
push edx
push esi
push 0x407bd2
push edx
push edx
call fcn.0046dc49
add esp, 0x18
mov dword [ebx], eax
test eax, eax
je 0x407b65
and dword [ebp + 0xc], 0
lea ecx, [ebp + 0xc]
call fcn.00407b70
call fcn.004685e5
ret 8
and dword [edi], 0
push 6
call fcn.0046744d
int3