joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40be00
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov edx, dword [edi + 0x84]
test edx, edx
je 0x40be62
mov ecx, dword [edi + 0x8c]
mov ebx, dword [edi + 0x88]
cmp ecx, ebx
jae 0x40bea9
mov esi, dword [ebp + 8]
lea eax, [ecx + edx]
sub ebx, ecx
cmp ebx, dword [ebp + 0xc]
cmova ebx, dword [ebp + 0xc]
push ebx
push eax
push esi
call sub.VCRUNTIME140.dll_memcpy
add dword [edi + 0x8c], ebx
add dword [edi + 0x74], ebx
push ebx
push esi
push dword [edi + 0x78]
call fcn.004094c0
add esp, 0x18
mov dword [edi + 0x78], eax
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [edi + 0x7c]
test eax, eax
je 0x40bea2
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 4]
push 0
push ecx
push dword [ebp + 0xc]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40bea9
mov esi, dword [ebp - 4]
add dword [edi + 0x74], esi
push esi
push ebx
push dword [edi + 0x78]
call fcn.004094c0
add esp, 0xc
mov dword [edi + 0x78], eax
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov dword [edi + 0x14], 0x1000000
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x40ca50
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
movsx eax, byte [ebp + 0xc]
mov ecx, dword [edx]
xor eax, ecx
movzx eax, al
shr ecx, 8
mov eax, dword [eax*4 + 0x549dd0]
xor eax, ecx
mov ecx, dword [edx + 8]
mov dword [edx], eax
movzx eax, al
add eax, dword [edx + 4]
imul eax, eax, 0x8088405
inc eax
mov dword [edx + 4], eax
shr eax, 0x18
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x549dd0]
mov dword [edx + 8], ecx
pop ebp
ret
Function at 0x40caa0
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Hash data with crc32
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
cmp byte [esi + 0x2d], 0
je 0x40cb78
mov eax, dword [esi + 0x3c]
mov ebx, dword [ebp + 0xc]
test eax, eax
je 0x40cad4
cmp dword [esi + 0x40], ebx
jae 0x40cad4
push eax
call fcn.00546a09
add esp, 4
mov dword [esi + 0x3c], 0
cmp dword [esi + 0x3c], 0
jne 0x40caec
lea eax, [ebx + ebx]
push eax
call fcn.00546a00
add esp, 4
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], ebx
push ebx
push edi
push dword [esi + 0x3c]
call sub.VCRUNTIME140.dll_memcpy
xor edx, edx
add esp, 0xc
mov dword [ebp + 8], edx
test ebx, ebx
je 0x40cb75
mov eax, dword [esi + 0x3c]
mov ecx, dword [esi + 0x30]
shr ecx, 8
mov bl, byte [edx + eax]
mov edx, dword [esi + 0x38]
mov edi, edx
movsx eax, bl
and edi, 0xfffd
xor eax, dword [esi + 0x30]
or edi, 2
movzx eax, al
mov eax, dword [eax*4 + 0x549dd0]
xor eax, ecx
mov ecx, edi
mov dword [esi + 0x30], eax
xor ecx, 1
movzx eax, al
add eax, dword [esi + 0x34]
imul eax, eax, 0x8088405
imul ecx, edi
inc eax
mov dword [esi + 0x34], eax
shr eax, 0x18
xor eax, edx
shr ecx, 8
movzx eax, al
xor cl, bl
shr edx, 8
xor edx, dword [eax*4 + 0x549dd0]
mov dword [esi + 0x38], edx
mov edx, dword [ebp + 8]
mov eax, dword [esi + 0x3c]
mov byte [edx + eax], cl
inc edx
mov dword [ebp + 8], edx
cmp edx, dword [ebp + 0xc]
jb 0x40cb02
mov edi, dword [esi + 0x3c]
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x40cbb6
mov edx, dword [esi + 0x24]
mov ebx, dword [ebp + 0xc]
lea eax, [edx + ebx]
cmp eax, dword [esi + 0x28]
jb 0x40cb9d
pop edi
mov dword [esi + 0x14], 0x30000
xor eax, eax
pop esi
pop ebx
pop ebp
ret 8
push ebx
add ecx, edx
push edi
push ecx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov eax, ebx
add dword [esi + 0x24], ebx
pop edi
pop esi
pop ebx
pop ebp
ret 8
mov eax, dword [esi + 4]
test eax, eax
je 0x40cbd8
push 0
lea ecx, [ebp + 8]
push ecx
push dword [ebp + 0xc]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
pop ebp
ret 8
pop edi
mov dword [esi + 0x14], 0x1000000
xor eax, eax
pop esi
pop ebx
pop ebp
ret 8
Function at 0x40fc10
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push esi
push edi
push dword [ebp + 8]
mov dword [ebp - 4], ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
setne al
xor edi, edi
test al, al
je 0x40fd48
movzx ecx, word [ebp + 0xc]
push 0xa
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
setne al
test al, al
je 0x40fd48
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
setne cl
test cl, cl
je 0x40fd48
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
setne cl
test cl, cl
je 0x40fd47
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
setne cl
test cl, cl
je 0x40fd47
push eax
push ebx
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
call fcn.0040e2d0
mov ecx, dword [ebp - 4]
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x3c], 0
push eax
lea eax, [ebp - 0xc]
mov dword [ebp - 0x38], 0
push eax
add ecx, 0x20
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
call fcn.0042e510
push dword [ebp - 8]
call fcn.00546a09
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x20]
add esp, 4
mov dword [ebp - 8], 0
add eax, eax
push eax
push dword [ebp - 0x24]
call fcn.00420bb0
push dword [ebp - 0x38]
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x24], 0
push dword [ebp - 0x34]
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x2c], 0
call fcn.00420bb0
push dword [ebp - 0x18]
lea ecx, [ebp - 0x10]
push dword [ebp - 0x14]
call fcn.00420bb0
pop ebx
test esi, esi
je 0x40fd53
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x410920
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a62c0
push 0x5481ce
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov ebx, ecx
push dword [ebp + 0xc]
push 0
push 4
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov edi, eax
mov dword [ebp - 0x1c], edi
test edi, edi
setne cl
xor esi, esi
mov dword [ebp + 0xc], esi
test cl, cl
je 0x41097e
push esi
push esi
push esi
push 4
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
mov dword [ebp + 0xc], eax
test esi, esi
setne cl
xor eax, eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
test cl, cl
je 0x4109e1
push 0x1c
lea eax, [ebp - 0x38]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
setne cl
mov eax, dword [ebp - 0x2c]
test cl, cl
je 0x4109e1
mov dword [ebp - 4], 0
push eax
push esi
mov ecx, ebx
call fcn.0040fb00
mov dword [ebp - 4], 0xffffffff
jmp 0x4109e1
test esi, esi
je 0x4109ec
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
test edi, edi
je 0x4109f7
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x413900
Capabilities:
Hijack thread execution
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3f0
push ebx
push esi
push edi
push 0x114
lea eax, [ebp - 0x124]
mov edi, ecx
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x124], 0x114
lea eax, [ebp - 0x124]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
push dword [edi]
mov eax, 5
cmp eax, dword [ebp - 0x120]
push 0
sbb eax, eax
and eax, 0xf000
add eax, 0x1f0fff
push eax
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
mov dword [ebp - 4], eax
setne bl
xor esi, esi
test bl, bl
je 0x4139a5
push dword [edi + 4]
mov eax, 5
cmp eax, dword [ebp - 0x120]
push esi
sbb eax, eax
and eax, 0xfc00
add eax, 0x1f03ff
push eax
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov esi, eax
test esi, esi
setne bl
test bl, bl
je 0x4139a5
push esi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
setne bl
xor edi, edi
test bl, bl
je 0x4139bd
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
setne bl
mov dword [ebp - 8], 0
test bl, bl
je 0x4139dc
push str.DebugBreak
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
mov dword [ebp - 8], eax
setne bl
push 0x2cc
lea eax, [ebp - 0x3f0]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
test bl, bl
je 0x413a87
lea eax, [ebp - 0x3f0]
mov dword [ebp - 0x3f0], 0x1003f
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
cmp eax, 1
sete bl
test bl, bl
je 0x413a87
mov eax, dword [ebp - 0x338]
lea ecx, [ebp - 0xc]
push ecx
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x10]
mov eax, dword [ebp - 0x32c]
push 4
sub eax, 4
mov dword [ebp - 0xc], 0
push ecx
push eax
push dword [ebp - 4]
mov dword [ebp - 0x32c], eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
cmp eax, 1
sete bl
test bl, bl
je 0x413a87
mov eax, dword [ebp - 8]
mov dword [ebp - 0x338], eax
lea eax, [ebp - 0x3f0]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
cmp eax, 1
sete bl
test bl, bl
je 0x413a87
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 1
sete bl
test edi, edi
je 0x413a92
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test bl, bl
mov ebx, dword [ebp - 4]
jne 0x413aa4
test ebx, ebx
je 0x413aa4
push ebx
call dword [sym.imp.KERNEL32.dll_DebugBreakProcess]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x413ab1
push esi
call edi
test ebx, ebx
je 0x413ab8
push ebx
call edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x413b80
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x428
push ebx
push esi
mov ebx, ecx
push edi
push dword [ebx]
mov esi, dword [ebx + 0xb8]
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
je 0x413c3b
push 0x424
lea eax, [ebp - 0x424]
mov dword [ebp - 0x428], 0x428
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x428]
push eax
push edi
call sub.KERNEL32.dll_Module32FirstW
test eax, eax
je 0x413c34
lea esp, [esp]
mov ecx, dword [ebp - 0x414]
cmp esi, ecx
jb 0x413bf6
mov eax, dword [ebp - 0x410]
add eax, ecx
cmp esi, eax
jb 0x413c15
lea eax, [ebp - 0x428]
push eax
push edi
call sub.KERNEL32.dll_Module32NextW
test eax, eax
jne 0x413be0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x208]
push eax
call fcn.00420e00
add esp, 4
lea ecx, [ebx + 0x44]
push eax
lea eax, [ebp - 0x208]
push eax
call fcn.00403040
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4141e0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
lea edi, [ecx + 0x114]
mov dword [ebp - 8], 0
push 0
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], edi
mov dword [ebp - 4], 0
call fcn.00423ac0
mov esi, dword [edi + 8]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], eax
test esi, esi
je 0x41422c
dec esi
imul esi, dword [edi + 4]
add esi, dword [edi]
jmp 0x41422e
xor esi, esi
mov ebx, dword [sym.imp.KERNEL32.dll_ResumeThread]
test eax, eax
jne 0x414240
cmp edx, esi
jne 0x414240
cmp ecx, edi
je 0x414258
push dword [eax + 8]
call ebx
lea ecx, [ebp - 0x18]
call fcn.00423a40
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
jmp 0x414234
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x414260
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push edi
push dword [ebp + 8]
mov edi, ecx
call fcn.00420e00
add esp, 4
lea ecx, [edi + 0x68]
push eax
push dword [ebp + 8]
call fcn.00403040
mov eax, dword [ebp + 0xc]
push 0
push 0
push 1
push 0
mov dword [edi + 0x54], eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [edi + 0x58], eax
test eax, eax
je 0x4142ac
push edi
push 0
push 0x4142c0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthread]
mov eax, dword [edi + 0x58]
add esp, 0xc
pop edi
pop ebp
ret 8
Function at 0x4145d0
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
lea edi, [ecx + 0x114]
mov dword [ebp - 8], 0
push 0
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], edi
mov dword [ebp - 4], 0
call fcn.00423ac0
mov esi, dword [edi + 8]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], eax
test esi, esi
je 0x41461c
dec esi
imul esi, dword [edi + 4]
add esi, dword [edi]
jmp 0x41461e
xor esi, esi
mov ebx, dword [sym.imp.KERNEL32.dll_SuspendThread]
test eax, eax
jne 0x414630
cmp edx, esi
jne 0x414630
cmp ecx, edi
je 0x414648
push dword [eax + 8]
call ebx
lea ecx, [ebp - 0x18]
call fcn.00423a40
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
jmp 0x414624
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4157b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
push esi
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x10], 0
push eax
push 0
push 0
push 0x1a
push 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x41585d
lea eax, [ebp - 0x21c]
push eax
call fcn.00420e00
add esp, 4
lea ecx, [ebp - 0x10]
push eax
lea eax, [ebp - 0x21c]
push eax
call fcn.00403040
push str.TroveCrashHandler.cfg
call fcn.00420e00
mov ecx, dword [ebp - 0x10]
mov esi, eax
add esp, 4
lea eax, [esi + ecx]
cmp eax, dword [ebp - 0xc]
jb 0x41582d
push eax
lea ecx, [ebp - 0x10]
call fcn.00403220
mov ecx, dword [ebp - 0x10]
lea eax, [esi + esi]
push eax
mov eax, dword [ebp - 8]
push str.TroveCrashHandler.cfg
lea eax, [eax + ecx*2]
push eax
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [ebp - 0x10]
xor edx, edx
mov eax, dword [ebp - 8]
add ecx, esi
add esp, 0xc
mov word [eax + ecx*2], dx
mov eax, dword [ebp - 0x10]
add eax, esi
mov dword [ebp - 0x10], eax
jmp 0x415860
mov eax, dword [ebp - 0x10]
mov esi, dword [ebp + 8]
mov ecx, esi
push eax
push dword [ebp - 8]
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call fcn.0040cc00
mov ecx, dword [ebp - 0xc]
add ecx, ecx
push ecx
push dword [ebp - 8]
lea ecx, [ebp - 4]
call fcn.00420bb0
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x418ad0
Capabilities:
Enumerate process modules
Get process image filename

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x640
push ebx
push esi
mov eax, ecx
push edi
mov dword [ebp - 8], eax
push dword [eax + 8]
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
lea eax, [ebp - 0x640]
push 0x20a
cmp edi, 0xffffffff
mov dword [ebp - 0xc], edi
push 0
push eax
setne bl
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor esi, esi
test bl, bl
je 0x418c50
push 0x105
lea eax, [ebp - 0x640]
push eax
mov eax, dword [ebp - 8]
push dword [eax]
call sub.PSAPI.DLL_GetProcessImageFileNameW
test eax, eax
je 0x418b4c
lea eax, [ebp - 0x640]
push 0x5c
push eax
call dword [sym.imp.VCRUNTIME140.dll_wcsrchr]
lea esi, [eax + 2]
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcslwr]
add esp, 0xc
test esi, esi
setne bl
test bl, bl
je 0x418c50
push 0x424
xor ebx, ebx
mov dword [ebp - 0x434], 0x428
lea eax, [ebp - 0x430]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x434]
push eax
push edi
call sub.KERNEL32.dll_Module32FirstW
test eax, eax
je 0x418c05
nop
push dword [ebp - 0x41c]
mov ecx, dword [ebp - 8]
push dword [ebp - 0x420]
call fcn.00418990
test al, al
je 0x418bf4
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcslwr]
add esp, 4
lea ecx, [ebp - 0x414]
mov eax, esi
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x418be6
test dx, dx
je 0x418be2
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x418be6
add ecx, 4
add eax, 4
test dx, dx
jne 0x418bc0
xor eax, eax
jmp 0x418beb
sbb eax, eax
or eax, 1
test eax, eax
cmove ebx, dword [ebp - 0x420]
lea eax, [ebp - 0x434]
push eax
push edi
call sub.KERNEL32.dll_Module32NextW
test eax, eax
jne 0x418b90
mov eax, dword [ebp - 8]
mov esi, dword [eax + 0x10]
mov ecx, esi
mov edi, dword [eax + 0xc]
sub ecx, edi
mov al, byte [ebp - 4]
mov byte [ebp - 4], al
lea eax, [ebp - 4]
push eax
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
push eax
push esi
push edi
call fcn.00418340
mov eax, dword [ebp - 8]
add esp, 0x10
mov ecx, eax
lea esi, [eax + 0x1c]
push esi
push ebx
call fcn.00419420
cmp dword [esi], 0
mov edi, dword [ebp - 0xc]
setne bl
cmp edi, 0xffffffff
je 0x418c5c
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x419630
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
push esi
push edi
push 0
mov dword [ebp - 0x10], ecx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0xa
mov edi, eax
push 0x66
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edx, eax
test edx, edx
setne al
xor ecx, ecx
test al, al
je 0x41966f
push edx
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ecx, eax
test ecx, ecx
setne al
xor esi, esi
test al, al
je 0x419683
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
setne al
xor ecx, ecx
mov dword [ebp - 0xc], ecx
test al, al
je 0x4196a7
push 0x104
lea eax, [ebp - 0x21c]
mov dword [ebp - 0xc], esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
setne al
mov dword [ebp - 8], 0
test al, al
je 0x4196d1
lea eax, [ebp - 0x21c]
push 0x54b99c
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen]
mov ecx, eax
add esp, 8
test ecx, ecx
mov dword [ebp - 8], ecx
setne al
xor edx, edx
test al, al
je 0x4197e1
mov ecx, dword [edi + 0x3c]
sub esi, edi
push ebx
xor ebx, ebx
movzx eax, word [ecx + edi + 0x14]
add eax, ecx
movzx ecx, word [ecx + edi + 6]
mov dword [ebp - 4], ecx
test ecx, ecx
je 0x419725
lea ecx, [eax + 0x24]
mov eax, dword [ebp - 4]
add ecx, edi
mov edi, edi
test edx, edx
jne 0x419727
mov edi, dword [ecx]
cmp esi, edi
jb 0x41971d
mov eax, dword [ecx - 4]
add eax, edi
cmp esi, eax
mov eax, dword [ebp - 4]
jae 0x41971d
mov edx, dword [ecx + 8]
sub edx, edi
add edx, esi
inc ebx
add ecx, 0x28
cmp ebx, eax
jb 0x419700
test edx, edx
setne al
test al, al
je 0x4197e0
mov esi, dword [ebp - 8]
lea eax, [edx + 0x14]
push 0
push eax
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
sete al
test al, al
je 0x4197e0
push 0x54b9a4
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fileno]
add esp, 4
push eax
call 0x43d687
add esp, 8
mov esi, eax
test esi, esi
setne bl
test bl, bl
je 0x4197d1
mov edi, dword [ebp - 0xc]
push dword [edi + 8]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov ecx, dword [ebp - 0x10]
add esp, 4
test eax, eax
setne bl
mov dword [ecx + 0x20], eax
test bl, bl
je 0x4197d1
push dword [edi + 8]
push eax
push esi
call 0x43db1f
add esp, 0xc
cmp eax, dword [edi + 8]
sete bl
test bl, bl
je 0x4197d1
mov edx, dword [ebp - 0x10]
mov eax, dword [edi + 0xc]
mov ecx, dword [edx + 0x20]
mov dword [edx + 0x28], eax
mov eax, dword [edi + 0x10]
mov dword [edx + 0x34], eax
imul eax, dword [edx + 0x28], 0xd
mov dword [edx + 0x24], ecx
add ecx, eax
mov eax, dword [edx + 0x34]
mov dword [edx + 0x2c], ecx
lea ecx, [ecx + eax*4]
mov dword [edx + 0x30], ecx
test esi, esi
je 0x4197de
push esi
call 0x43dc5b
add esp, 4
mov al, bl
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41a710
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x138
push ebx
push 0x114
lea eax, [ebp - 0x138]
mov dword [ebp - 0x10], 0
push 0
push eax
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x138], 0x114
lea eax, [ebp - 0x138]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x134], 6
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
jb 0x41a773
call fcn.0041d6d0
jmp 0x41a778
call fcn.0041d760
mov bl, al
add esp, 8
test bl, bl
je 0x41a7e6
mov eax, dword [ebp - 8]
test eax, eax
push esi
mov esi, 0x5b3144
mov dword [ebp - 0x24], 0
mov ecx, esi
mov dword [ebp - 0x20], 0
cmovne ecx, eax
mov dword [ebp - 0x1c], 0
lea eax, [ebp + 0x10]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push ecx
lea ecx, [ebp - 0x24]
call fcn.0041aee0
mov eax, dword [ebp - 0x1c]
test eax, eax
cmovne esi, eax
push esi
call fcn.00420e00
mov ecx, dword [ebp + 0xc]
add esp, 4
push eax
push esi
call fcn.00403040
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x18]
add eax, eax
push eax
push dword [ebp - 0x1c]
call fcn.00420bb0
pop esi
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 4]
add eax, eax
push eax
push dword [ebp - 8]
call fcn.00420bb0
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41a800
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
push ebx
push 0x114
lea eax, [ebp - 0x13c]
mov dword [ebp - 0x10], 0
push 0
push eax
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x13c], 0x114
lea eax, [ebp - 0x13c]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x138], 6
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
jb 0x41a863
call fcn.0041d6d0
jmp 0x41a868
call fcn.0041d760
mov bl, al
add esp, 8
test bl, bl
je 0x41a8dc
mov eax, dword [ebp - 8]
test eax, eax
push esi
mov esi, 0x5b3144
mov dword [ebp - 0x20], 0
mov ecx, esi
mov dword [ebp - 0x1c], 0
cmovne ecx, eax
mov dword [ebp - 0x18], 0
lea eax, [ebp + 0x14]
mov dword [ebp - 0x28], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x28]
push eax
push ecx
lea ecx, [ebp - 0x20]
call fcn.0041af90
mov eax, dword [ebp - 0x18]
test eax, eax
cmovne esi, eax
push esi
call fcn.00420e00
mov ecx, dword [ebp + 0xc]
add esp, 4
push eax
push esi
call fcn.00403040
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x14]
add eax, eax
push eax
push dword [ebp - 0x18]
call fcn.00420bb0
pop esi
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 4]
add eax, eax
push eax
push dword [ebp - 8]
call fcn.00420bb0
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41a900
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x138
push ebx
push 0x114
lea eax, [ebp - 0x138]
mov dword [ebp - 0x10], 0
push 0
push eax
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x138], 0x114
lea eax, [ebp - 0x138]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x134], 6
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
jb 0x41a963
call fcn.0041d6d0
jmp 0x41a968
call fcn.0041d760
mov bl, al
add esp, 8
test bl, bl
je 0x41a9d6
mov eax, dword [ebp - 8]
test eax, eax
push esi
mov esi, 0x5b3144
mov dword [ebp - 0x24], 0
mov ecx, esi
mov dword [ebp - 0x20], 0
cmovne ecx, eax
mov dword [ebp - 0x1c], 0
lea eax, [ebp + 0x10]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push ecx
lea ecx, [ebp - 0x24]
call fcn.0041b040
mov eax, dword [ebp - 0x1c]
test eax, eax
cmovne esi, eax
push esi
call fcn.00420e00
mov ecx, dword [ebp + 0xc]
add esp, 4
push eax
push esi
call fcn.00403040
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x18]
add eax, eax
push eax
push dword [ebp - 0x1c]
call fcn.00420bb0
pop esi
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 4]
add eax, eax
push eax
push dword [ebp - 8]
call fcn.00420bb0
mov eax, dword [ebp + 0x14]
lea ecx, [ebp + 0x1c]
add eax, eax
mov dword [ebp - 8], 0
push eax
push dword [ebp + 0x18]
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
call fcn.00420bb0
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret