joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a1474
Capabilities:
Create process on windows
Create process suspended
Self delete

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdc4
xor eax, eax
mov dword [ebp - 0x238], eax
mov dword [ebp - 0x23c], eax
mov dword [ebp - 0x230], eax
mov dword [ebp - 0x234], eax
mov dword [ebp - 0x22c], eax
mov dword [ebp - 0x228], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4a16a2
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 0x4a16b0
mov edx, 0x4a16bc
mov eax, 0x80000001
call fcn.004589ec
lea edx, [ebp - 0x228]
xor eax, eax
call fcn.00402b9c
mov eax, dword [ebp - 0x228]
xor edx, edx
call fcn.0040963c
lea eax, [ebp - 0x22c]
call fcn.0049fd3c
mov edx, dword [ebp - 0x22c]
lea eax, [ebp - 4]
mov ecx, 0x4a1704
call fcn.00404ca8
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x1d0]
call fcn.00402f50
lea eax, [ebp - 0x1d0]
call fcn.00402cec
call fcn.004028cc
mov edx, 0x4a171c
lea eax, [ebp - 0x1d0]
call fcn.00405078
call fcn.0040366c
call fcn.004028cc
push 0x4a172c
lea edx, [ebp - 0x234]
xor eax, eax
call fcn.00402b9c
push dword [ebp - 0x234]
push 0x4a173c
lea eax, [ebp - 0x230]
mov edx, 3
call fcn.00404d1c
mov edx, dword [ebp - 0x230]
lea eax, [ebp - 0x1d0]
call fcn.00405078
call fcn.0040366c
call fcn.004028cc
push 0x4a1748
lea edx, [ebp - 0x23c]
xor eax, eax
call fcn.00402b9c
push dword [ebp - 0x23c]
push 0x4a173c
push 0x4a175c
lea eax, [ebp - 0x238]
mov edx, 4
call fcn.00404d1c
mov edx, dword [ebp - 0x238]
lea eax, [ebp - 0x1d0]
call fcn.00405078
call fcn.0040366c
call fcn.004028cc
mov edx, 0x4a1770
lea eax, [ebp - 0x1d0]
call fcn.00405078
call fcn.0040366c
call fcn.004028cc
mov edx, 0x4a1780
lea eax, [ebp - 0x1d0]
call fcn.00405078
call fcn.0040366c
call fcn.004028cc
lea eax, [ebp - 0x1d0]
call fcn.004030f4
call fcn.004028cc
lea eax, [ebp - 0x224]
xor ecx, ecx
mov edx, 0x44
call fcn.004032e4
mov dword [ebp - 0x1f8], 1
mov word [ebp - 0x1f4], 0
lea eax, [ebp - 0x1e0]
push eax
lea eax, [ebp - 0x224]
push eax
push 0
push 0
push 0x40
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404e5c
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x4a167c
mov eax, dword [ebp - 0x1dc]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x1e0]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a16a9
lea eax, [ebp - 0x23c]
mov edx, 6
call fcn.004049c0
lea eax, [ebp - 4]
call fcn.0040499c
ret
Function at 0x4039c7
Capabilities:
Terminate process

Disassembly:
jmp 0x46c504
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x46c515
push 5
pop ecx
int 0x29
push esi
push 1
mov esi, 0xc0000417
push esi
push 2
call fcn.00406113
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
ret

Function at 0x403b1b
Capabilities:
Query environment variable

Disassembly:
jmp 0x4bace4
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x4bacf5
pop esi
ret
push ebx
push edi
push esi
call fcn.004babcb
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.0040451b
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x4bad1d
push ebx
push esi
push edi
call fcn.00405ed9
add esp, 0xc
push 0
call fcn.00406b77
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x405fa6
Capabilities:
Parse pe header

Disassembly:
jmp 0x45b166
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x45b1a5
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x45b1a5
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x45b1a5
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x45b1a5
cmp dword [ecx + 0x74], 0xe
jbe 0x45b1a5
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x458b3e
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
call fcn.00403b7f
mov eax, dword [eax + 0x14]
test eax, eax
je 0x458b81
and dword [ebp - 4], 0
lea ecx, [ebp - 4]
push 2
push ecx
push 0x22
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
movzx eax, word [ebp - 4]
sub eax, 0x30
je 0x458b81
sub eax, 1
je 0x458b7c
sub eax, 1
je 0x458b78
xor eax, eax
leave
ret
push 3
jmp 0x458b83
xor eax, eax
inc eax
leave
ret
push 2
pop eax
leave
ret

Function at 0x46d5d7
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x46d616
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x46d616
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x46d616
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x46d616
cmp dword [ecx + 0x74], 0xe
jbe 0x46d616
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x4b0654
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1020
call fcn.00401ee2
mov eax, dword [0x4f4140]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.00406703
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x4b0696
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x4b080d
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.0040687a
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1014], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x4f7f78]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.00403602
mov ecx, dword [esi*4 + 0x4f7f78]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x1020], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x4b0806
cmp eax, dword [edi + ecx + 0x24]
jne 0x4b0806
xor esi, esi
lea eax, [ebp - 0x101c]
push esi
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4b0806
push dword [ebp - 0x100c]
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00403602
add esp, 0x14
cmp edx, esi
jl 0x4b0806
jg 0x4b0761
cmp eax, esi
jb 0x4b0806
mov ebx, dword [ebp - 0x1014]
mov eax, dword [ebp - 0x101c]
cmp ebx, esi
jg 0x4b0806
jl 0x4b0783
cmp dword [ebp - 0x1008], eax
ja 0x4b0806
lea edi, [ebp - 0x1004]
xorps xmm0, xmm0
add edi, eax
movlpd qword [ebp - 0x1018], xmm0
lea ecx, [ebp - 0x1004]
cmp dword [ebp - 0x1008], esi
jne 0x4b07a8
cmp ebx, esi
je 0x4b07ed
mov edx, dword [ebp - 0x1014]
mov esi, dword [ebp - 0x1018]
cmp ecx, edi
jae 0x4b07ed
mov al, byte [ecx]
cmp al, 0xd
jne 0x4b07ce
lea eax, [edi - 1]
cmp ecx, eax
jae 0x4b07da
cmp byte [ecx + 1], 0xa
jne 0x4b07da
inc ecx
jmp 0x4b07da
movzx eax, al
movsx eax, byte [eax + 0x4f44a8]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x4b07b4
cmp edx, ebx
jne 0x4b07b4
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x1020]
jmp 0x4b080b
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0040339b
leave
ret
Function at 0x4b0f7d
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov edx, dword [ebp + 8]
mov ecx, edx
push ebx
mov ebx, dword [ebp + 0xc]
mov eax, edx
sar ecx, 6
and eax, 0x3f
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x4f7f78]
mov dword [ebp - 0x18], ecx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x4b0fbf
cmp byte [ebx], 0xa
jne 0x4b0fbf
or byte [edi + eax + 0x28], 4
jmp 0x4b0fc4
and byte [edi + eax + 0x28], 0xfb
add ecx, ebx
mov eax, ebx
mov dword [ebp - 0x10], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x4b10c7
mov cl, byte [eax]
cmp cl, 0x1a
je 0x4b10a2
lea ebx, [eax + 1]
mov dword [ebp - 8], ebx
mov ebx, dword [ebp + 0xc]
cmp cl, 0xd
je 0x4b0ff3
mov eax, dword [ebp - 8]
jmp 0x4b1013
mov edx, dword [ebp - 0x10]
cmp dword [ebp - 8], edx
mov edx, dword [ebp + 8]
jae 0x4b102f
mov ebx, dword [ebp - 8]
cmp byte [ebx], 0xa
jne 0x4b100d
add eax, 2
mov cl, 0xa
jmp 0x4b1010
mov eax, dword [ebp - 8]
mov ebx, dword [ebp + 0xc]
mov byte [esi], cl
mov dword [ebp - 0xc], 1
mov dword [ebp - 8], esi
mov esi, dword [ebp - 0xc]
add esi, dword [ebp - 8]
cmp eax, dword [ebp - 0x10]
jb 0x4b0fd5
jmp 0x4b10c7
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4b109d
cmp dword [ebp - 0x10], 0
je 0x4b109d
mov edx, dword [ebp - 0x18]
mov eax, dword [edx*4 + 0x4f7f78]
test byte [eax + edi + 0x28], 0x48
je 0x4b107c
mov cl, byte [ebp - 1]
cmp cl, 0xa
jne 0x4b106c
mov byte [esi], 0xa
jmp 0x4b10c6
mov byte [esi], 0xd
mov eax, dword [edx*4 + 0x4f7f78]
mov byte [eax + edi + 0x2a], cl
jmp 0x4b10c6
cmp byte [ebp - 1], 0xa
jne 0x4b1086
cmp esi, ebx
je 0x4b1067
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.00401a00
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x4b10c7
mov byte [esi], 0xd
jmp 0x4b10c6
mov eax, edx
and edx, 0x3f
sar eax, 6
imul edx, edx, 0x38
mov edi, dword [eax*4 + 0x4f7f78]
mov al, byte [edi + edx + 0x28]
test al, 0x40
jne 0x4b10c4
or al, 2
mov byte [edi + edx + 0x28], al
jmp 0x4b10c7
mov byte [esi], cl
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x4b1124
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 8]
and eax, 0x3f
push ebx
mov ebx, dword [ebp + 0xc]
sar edx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [edx*4 + 0x4f7f78]
mov dword [ebp - 8], edx
mov edx, dword [eax + edi + 0x18]
mov dword [ebp - 0x18], edx
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x4b1168
push 0xa
pop esi
cmp word [ebx], si
jne 0x4b1168
or byte [eax + edi + 0x28], 4
jmp 0x4b116d
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + edx*2]
mov eax, ebx
mov dword [ebp - 0x10], edx
mov esi, ebx
cmp ebx, edx
jae 0x4b12d8
movzx edx, word [eax]
mov ecx, edx
mov dword [ebp - 0xc], ecx
movzx ecx, cx
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 8]
cmp edx, 0x1a
je 0x4b12b0
lea ebx, [eax + 2]
mov dword [ebp - 4], ebx
push 0xd
pop ebx
cmp dx, bx
mov ebx, dword [ebp + 0xc]
je 0x4b11ba
mov ebx, dword [ebp - 0x14]
mov edx, esi
mov eax, dword [ebp - 4]
movzx ebx, bx
mov dword [ebp - 4], ebx
jmp 0x4b11e4
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 0x10]
jae 0x4b1203
push 0xa
pop ebx
cmp word [edx], bx
jne 0x4b11d1
push ebx
add eax, 4
pop edx
jmp 0x4b11d9
mov eax, edx
mov edx, dword [ebp - 0xc]
movzx edx, dx
movzx edx, dx
mov dword [ebp - 4], edx
mov edx, esi
mov dword [ebp - 0x14], esi
mov ecx, dword [ebp - 4]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0xc], 2
mov word [esi], cx
mov esi, dword [ebp - 0xc]
add esi, edx
cmp eax, dword [ebp - 0x10]
jb 0x4b117f
jmp 0x4b12d8
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4b12ab
cmp dword [ebp - 0x14], 0
je 0x4b12ab
mov eax, dword [ebp - 8]
push 0xa
mov eax, dword [eax*4 + 0x4f7f78]
test byte [eax + edi + 0x28], 0x48
pop eax
je 0x4b1287
mov dx, word [ebp - 4]
cmp dx, ax
jne 0x4b124f
mov word [esi], ax
jmp 0x4b12d5
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebp - 8]
movzx ecx, dx
shr ecx, 8
push 0xa
mov eax, dword [eax*4 + 0x4f7f78]
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x4f7f78]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x4f7f78]
pop ecx
mov byte [eax + edi + 0x2c], cl
jmp 0x4b12d5
cmp word [ebp - 4], ax
jne 0x4b1291
cmp esi, ebx
je 0x4b1247
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.00401a00
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x4b12d8
push 0xd
pop eax
jmp 0x4b1247
mov eax, ecx
and ecx, 0x3f
sar eax, 6
imul ecx, ecx, 0x38
mov edi, dword [eax*4 + 0x4f7f78]
mov al, byte [edi + ecx + 0x28]
test al, 0x40
jne 0x4b12d2
or al, 2
mov byte [edi + ecx + 0x28], al
jmp 0x4b12d8
mov word [esi], dx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x4b9222
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x4f4140]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0x4b926d
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.004b9695
test al, al
jne 0x4b9267
sub edx, 2
cmp edx, edi
jne 0x4b924d
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0x4b928f
lea eax, [edi + 2]
cmp edx, eax
je 0x4b928f
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.004b8e12
add esp, 0x10
jmp 0x4b9387
push esi
lea ecx, [ebp - 0x255]
call fcn.004b9695
sub edx, edi
xor ecx, ecx
sar edx, 1
inc edx
test al, al
lea eax, [ebp - 0x254]
cmovne ecx, edx
xor ebx, ebx
push ebx
push ebx
push ebx
push eax
push ebx
push edi
mov dword [ebp - 0x260], ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4b92d0
push dword [ebp - 0x25c]
jmp 0x4b927f
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0x4b930d
cmp word [ebp - 0x226], 0
je 0x4b932e
cmp word [ebp - 0x226], ax
jne 0x4b930d
cmp word [ebp - 0x224], 0
je 0x4b932e
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.004b8e12
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x4b937a
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x4b92e7
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0x4b9362
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x4b9387
push 0x4b87fa
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.00405d0d
add esp, 0x10
jmp 0x4b9357
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040339b
leave
ret

Function at 0x4bf03e
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.004048a4
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x4bf0ad
cmp esi, dword [ebp - 4]
je 0x4bf0a8
cmp dword [ebp + 0xc], 0
je 0x4bf0a8
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x4bf085
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.004bea69
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x4bf0af
xor eax, eax
inc eax
jmp 0x4bf0af
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43000c
pop eax
nop
nop
nop
nop
nop
add eax, 0x403d7a
nop
nop
sub eax, 0x403d20
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
jmp loc.00401219
Function at 0x4010bd
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4010d2
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x4010e4
xor eax, eax
jmp 0x401116
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
add eax, esi
and ecx, 0xf
jbe 0x401108
cmp esi, eax
jae 0x4010e0
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x4010fa
cmp esi, eax
jae 0x4010e0
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop ebp
ret
Function at 0x40288f
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
push edi
mov esi, ecx
call fcn.0043318a
mov ebx, dword [eax + 4]
mov ecx, esi
call fcn.0042f008
xor edi, edi
cmp dword [esi + 0xd4], edi
mov dword [ebp - 4], eax
jne 0x4029df
push 0x2c
pop ebx
push ebx
lea eax, [ebp - 0x30]
push edi
push eax
call fcn.004150a0
add esp, 0xc
lea eax, [ebp - 0x30]
push eax
mov ecx, esi
mov dword [ebp - 0x30], ebx
call fcn.004224f2
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_IsZoomed]
mov ecx, esi
mov dword [esi + 0x274], eax
call fcn.00425f72
and eax, 8
mov ecx, esi
mov dword [esi + 0x278], eax
call fcn.00425f58
and eax, 0x40000
mov dword [esi + 0x27c], eax
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 5
jae 0x40291c
push edi
mov ecx, esi
call fcn.0042603f
push edi
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_SetMenu]
cmp dword [esi + 0xf4], edi
je 0x40293e
push edi
push edi
lea eax, [esi + 0xd8]
push eax
mov ecx, esi
call fcn.0042fb61
cmp dword [esi + 0x1fc], edi
je 0x402956
push edi
push edi
lea eax, [esi + 0x1e0]
push eax
mov ecx, esi
call fcn.0042fb61
mov eax, dword [esi]
xor ebx, ebx
inc ebx
push ebx
mov ecx, esi
call dword [eax + 0x144]
push edi
push 8
push 0x100
mov ecx, esi
call fcn.00425fb6
mov ecx, dword [ebp - 4]
cmp ecx, edi
je 0x402994
push edi
push edi
push 0x200
call fcn.00425fb6
mov ecx, dword [ebp - 4]
push 0x20
push edi
add ecx, 0x54
call fcn.004020c4
push edi
push 0x80000000
push 0x1cc0000
mov ecx, esi
call fcn.00425f8c
push ebx
mov ecx, esi
call fcn.004021c4
push 0x27
push edi
push edi
push edi
push edi
push edi
mov ecx, esi
call fcn.004260e2
lea eax, [ebp - 0x30]
push eax
mov ecx, esi
mov dword [ebp - 0x28], 3
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], edi
call fcn.00422509
mov dword [esi + 0xd4], ebx
jmp 0x402acd
cmp dword [ebx + 0xbc], edi
mov ecx, esi
push edi
je 0x4029f6
push 0xc80000
push 0x80000000
jmp 0x4029fc
push 0x80480000
push edi
call fcn.00425f8c
cmp dword [esi + 0x27c], edi
je 0x402a17
push edi
push 0x40000
push edi
mov ecx, esi
call fcn.00425f8c
cmp dword [esi + 0x278], edi
jne 0x402a27
push edi
mov ecx, esi
call fcn.004021c4
mov ebx, dword [ebp - 4]
cmp ebx, edi
je 0x402a47
push edi
push 0x200
push edi
mov ecx, ebx
call fcn.00425fb6
push edi
push 0x20
lea ecx, [ebx + 0x54]
call fcn.004020c4
push edi
push 0x100
push edi
mov ecx, esi
call fcn.00425fb6
xor ebx, ebx
inc ebx
cmp dword [esi + 0x1fc], edi
je 0x402a70
push edi
push ebx
lea eax, [esi + 0x1e0]
push eax
mov ecx, esi
call fcn.0042fb61
cmp dword [esi + 0xf4], edi
je 0x402a88
push edi
push ebx
lea eax, [esi + 0xd8]
push eax
mov ecx, esi
call fcn.0042fb61
mov eax, dword [esi]
push ebx
mov ecx, esi
call dword [eax + 0x144]
cmp dword [esi + 0x274], edi
mov ecx, esi
je 0x402aaf
push 0x27
push edi
push edi
push edi
push edi
push edi
call fcn.004260e2
push 3
mov ecx, esi
jmp 0x402ab1
push 9
call fcn.0042603f
mov eax, dword [esi + 0x58]
cmp eax, edi
je 0x402ac7
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_SetMenu]
mov dword [esi + 0xd4], edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x402fd9
Capabilities:
Capture webcam image

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
lea eax, [ebp - 0x14]
push eax
push 0
mov esi, ecx
push 0x41a
push dword [esi + 0x1a8]
call edi
lea eax, [ebp - 0x24]
push eax
push 0
push 0x419
push dword [esi + 0x1a8]
call edi
fild dword [esi + 0x288]
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x1c]
pop edi
sub eax, dword [ebp - 0x14]
pop esi
add eax, dword [ebp - 0x24]
mov dword [ebp - 4], eax
fidiv dword [ebp - 4]
leave
ret

Function at 0x404c85
Capabilities:
Delete file

Disassembly:
mov eax, 0x4352f7
call fcn.00414da8
push ecx
push ebx
push esi
push edi
mov esi, ecx
xor edi, edi
lea ecx, [esi + 0x54]
push edi
call fcn.004094a0
call fcn.0043318a
mov eax, dword [eax + 4]
lea ebx, [eax + 0xe4]
cmp dword [ebx], edi
je 0x404cc6
mov eax, dword [esi + 0x18f4]
cmp dword [eax - 0xc], edi
je 0x404cc6
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [ebx], edi
push edi
mov ecx, esi
call fcn.0040413a
lea ecx, [esi + 0x18f4]
call fcn.004011c8
push edi
lea ecx, [esi + 0x54]
call fcn.0042603f
mov ecx, esi
call fcn.00424621
mov ebx, eax
cmp ebx, edi
je 0x404d3f
push 0xffffffffffffffff
mov ecx, ebx
call fcn.00402202
call fcn.00422167
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
push 0xe000
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], edi
call fcn.00401745
push dword [ebp - 0x10]
mov ecx, ebx
call fcn.00425fe0
push edi
mov ecx, ebx
call fcn.00402f90
push edi
mov ecx, ebx
call fcn.00402fb7
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00401148
push 1
push edi
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_InvalidateRect]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x4051a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
ret
Function at 0x40b7a0
Capabilities:
Capture microphone audio

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x435620
push eax
mov dword fs:[0], esp
push esi
mov esi, ecx
mov eax, dword [esi + 0x3c]
test eax, eax
jne 0x40b7cf
mov eax, dword [esi]
call dword [eax + 0x18]
test eax, eax
mov dword [esi + 0x3c], eax
je 0x40b877
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x40b88b
mov cl, byte [esp + 0x14]
test cl, cl
push 1
push 0
push 0
push eax
push 0xffffffffffffffff
push 0
je 0x40b825
call dword [sym.imp.WINMM.dll_waveInOpen]
test eax, eax
mov dword [esi + 4], eax
je 0x40b88b
cmp eax, 0x20
jne 0x40b877
call fcn.00422167
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x14], eax
mov dword [esp + 0xc], 0
push 0x27d8
jmp 0x40b857
call dword [sym.imp.WINMM.dll_waveOutOpen]
test eax, eax
mov dword [esi + 4], eax
je 0x40b88b
cmp eax, 0x20
jne 0x40b877
call fcn.00422167
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x14], eax
mov dword [esp + 0xc], 1
push 0x27d9
lea ecx, [esp + 0x18]
call fcn.00401745
mov eax, dword [esp + 0x14]
push 0
push 0
push eax
call fcn.0042d30c
lea ecx, [esp + 0x14]
call fcn.00401330
xor al, al
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
pop esi
add esp, 0xc
ret 4
mov ecx, dword [esp + 4]
mov al, 1
mov dword fs:[0], ecx
pop esi
add esp, 0xc
ret 4