joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001243
Capabilities:
Create process on windows
Read file on windows
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x850
and byte [ebp - 0x850], 0
push ebx
push esi
push edi
mov ecx, 0x200
xor eax, eax
lea edi, [ebp - 0x84f]
push 0
rep stosd dword es:[edi], eax
push 0x8000
push dword [0x100048ac]
stosb byte es:[edi], al
call dword [sym.imp.MSVCRT.dll_fseek]
push dword [0x100048ac]
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
lea eax, [ebp - 0x850]
push 0x800
push 1
push eax
call ebx
mov esi, eax
add esp, 0x1c
cmp esi, 1
mov dword [ebp - 0xc], esi
jl 0x100013de
push 0x100041d8
lea ecx, [ebp - 4]
call sub.MFC42.DLL_CString::CString
lea eax, [ebp - 8]
push eax
call fcn.100011bf
pop ecx
push eax
lea ecx, [ebp - 4]
call sub.MFC42.DLL_CString::operator_1
lea ecx, [ebp - 8]
call fcn.10001e12
push str..EXE
lea ecx, [ebp - 4]
call sub.MFC42.DLL_CString::operator
cmp eax, 0x70b
nop
push 0x100041cc
push dword [ebp - 4]
call dword [sym.imp.MSVCRT.dll_fopen]
and byte [ebp - 0x4c], 0
pop ecx
pop ecx
mov dword [ebp - 8], eax
push 0xf
xor eax, eax
pop ecx
lea edi, [ebp - 0x4b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push dword [0x1000441c]
lea eax, [ebp - 0x4c]
push eax
call sub.MSVCRT.dll_strcpy
mov eax, dword [0x1000441c]
pop ecx
pop ecx
xor edi, edi
mov ecx, dword [eax - 8]
or eax, 0xffffffff
test esi, esi
jle 0x10001344
inc eax
cmp eax, ecx
jle 0x10001334
xor eax, eax
mov dl, byte [ebp + eax - 0x4c]
xor byte [ebp + edi - 0x850], dl
inc edi
cmp edi, esi
jl 0x1000132d
push dword [ebp - 8]
lea eax, [ebp - 0x850]
push esi
mov esi, dword [sym.imp.MSVCRT.dll_fwrite]
push 1
push eax
call esi
xor edi, edi
add esp, 0x10
cmp dword [ebp - 0xc], edi
jle 0x10001393
push dword [0x100048ac]
lea eax, [ebp - 0x850]
push 0x800
push 1
push eax
call ebx
push dword [ebp - 8]
mov edi, eax
lea eax, [ebp - 0x850]
push edi
push 1
push eax
call esi
add esp, 0x20
test edi, edi
jg 0x10001363
xor edi, edi
push 0x752
call dword [sym.imp.MSVCRT.dll_isupper]
push dword [ebp - 8]
call dword [sym.imp.MSVCRT.dll_fclose]
pop ecx
pop ecx
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push eax
xor eax, 0x52c
pop eax
push 0x948
call dword [sym.imp.MSVCRT.dll_isdigit]
pop ecx
push edi
push edi
push edi
push dword [ebp - 4]
push str.open
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [ebp - 4]
call fcn.10001e12
pop edi
pop esi
pop ebx
leave
ret

Function at 0x100013e3
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
call dword [sym.imp.MSVCRT.dll_clock]
lea eax, [ebp - 4]
push eax
push 0x20006
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExtSettings
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1000142e
push eax
sub eax, 0x800
pop eax
push 0xafa
call dword [sym.imp.MSVCRT.dll_isupper]
mov dword [esp], str.F4BAEFBE_7CF3_0EA8_3E22_080C5180AC1F
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push eax
mov eax, 0x575
pop eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
leave
ret
Function at 0x10036bd
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x1005264]
xor eax, ebp
mov dword [ebp - 4], eax
test esi, esi
je 0x1003752
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x10036db
sub eax, edx
sar eax, 1
mov ecx, 0x104
cmp eax, ecx
ja 0x1003752
push esi
push ecx
lea eax, [ebp - 0x20c]
push eax
call sub.msvcrt.dll_wcscpy_s
lea eax, [ebp - 0x20c]
add esp, 0xc
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x100370c
sub eax, edx
sar eax, 1
lea eax, [ebp + eax*2 - 0x20c]
dec eax
dec eax
movzx ecx, word [eax]
cmp cx, 0x5c
je 0x1003732
cmp cx, 0x2f
jne 0x1003739
xor ecx, ecx
mov word [eax], cx
jmp 0x1003721
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
jmp 0x1003754
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01004103
leave
ret
Function at 0x1003765
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x768
mov eax, dword [0x1005264]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push dword [edi + 4]
mov dword [ebp - 0x768], eax
mov ebx, 0x104
lea eax, [ebp - 0x20c]
push ebx
push eax
call sub.msvcrt.dll_wcscpy_s
mov ecx, dword [edi + 4]
mov eax, ecx
add esp, 0xc
lea edx, [eax + 2]
mov si, word [eax]
inc eax
inc eax
test si, si
jne 0x10037a5
sub eax, edx
sar eax, 1
sub ebx, eax
mov eax, ecx
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x10037ba
sub eax, ecx
sar eax, 1
push 0x1001d50
lea eax, [ebp + eax*2 - 0x20c]
push ebx
push eax
mov dword [ebp - 0x764], eax
call sub.msvcrt.dll_wcscpy_s
add esp, 0xc
lea eax, [ebp - 0x75c]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x760], eax
cmp eax, 0xffffffff
jne 0x1003815
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 0x12
neg eax
sbb eax, eax
jmp 0x10039a0
mov ecx, 0x1001d4c
lea eax, [ebp - 0x730]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1003846
test dx, dx
je 0x1003842
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1003846
add eax, 4
add ecx, 4
test dx, dx
jne 0x1003820
xor eax, eax
jmp 0x100384b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1003966
mov ecx, 0x1001d44
lea eax, [ebp - 0x730]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1003884
test dx, dx
je 0x1003880
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1003884
add eax, 4
add ecx, 4
test dx, dx
jne 0x100385e
xor eax, eax
jmp 0x1003889
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1003966
lea eax, [ebp - 0x730]
push eax
call dword [sym.imp.msvcrt.dll__wcslwr]
push eax
push ebx
push dword [ebp - 0x764]
call sub.msvcrt.dll_wcscpy_s
mov eax, dword [edi + 0xc]
add esp, 0x10
test eax, eax
je 0x10038ca
push eax
lea eax, [ebp - 0x20c]
push 0x104
push eax
call sub.msvcrt.dll_wcscat_s
add esp, 0xc
push 0x104
lea eax, [ebp - 0x730]
push eax
push dword [edi + 8]
call fcn.01003c24
test eax, eax
je 0x1003966
cmp dword [edi + 0xc], 0
je 0x1003943
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0x50c]
push eax
lea eax, [ebp - 0x30c]
push eax
lea edx, [ebp - 0x20c]
call fcn.010035ea
test eax, eax
je 0x1003943
test byte [ebp - 0x75c], 0x10
je 0x1003966
lea esi, [ebp - 0x30c]
call fcn.010036bd
test eax, eax
je 0x1003966
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0x50c]
push eax
mov eax, esi
push eax
mov eax, dword [ebp + 8]
call fcn.0100342f
jmp 0x1003966
lea esi, [ebp - 0x20c]
call fcn.010036bd
test eax, eax
je 0x1003966
mov eax, esi
push eax
mov eax, dword [ebp - 0x768]
call fcn.01003508
mov esi, eax
test esi, esi
jne 0x1003983
lea eax, [ebp - 0x75c]
push eax
push dword [ebp - 0x760]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov esi, eax
test esi, esi
jne 0x1003815
push dword [ebp - 0x760]
call dword [sym.imp.KERNEL32.dll_FindClose]
test esi, esi
jne 0x100399e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x100399e
mov eax, esi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.01004103
leave
ret 8
Function at 0x10040e9
Capabilities:
Terminate process

Disassembly:
push 0x10
push 0x10045a8
call fcn.010042d4
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x1c], ebx
mov edi, 0x100698c
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x1003efe
cmp eax, esi
jne 0x1003ef1
xor esi, esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x1003f01
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1003ed8
xor esi, esi
inc esi
mov eax, dword [0x1006988]
cmp eax, esi
jne 0x1003f14
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x1003f4f
mov eax, dword [0x1006988]
test eax, eax
jne 0x1003f49
mov dword [0x1006988], esi
push 0x1001168
push 0x100115c
call fcn.01003e55
pop ecx
pop ecx
test eax, eax
je 0x1003f4f
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x1004019
mov dword [0x1005318], esi
mov eax, dword [0x1006988]
cmp eax, esi
jne 0x1003f73
push 0x1001158
push 0x1001150
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x1006988], 2
cmp dword [ebp - 0x1c], ebx
jne 0x1003f80
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x1006990], ebx
je 0x1003fa1
push 0x1006990
call fcn.01004249
pop ecx
test eax, eax
je 0x1003fa1
push ebx
push 2
push ebx
call dword [0x1006990]
push dword [0x1005300]
push dword [0x1005304]
push dword [0x10052fc]
call fcn.01001f57
add esp, 0xc
mov dword [0x1005314], eax
cmp dword [0x1005308], ebx
jne 0x1003fff
push eax
call dword [sym.imp.msvcrt.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x20], ecx
push eax
push ecx
call sub.msvcrt.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x1005318], ebx
jne 0x100400d
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x1005314]
call fcn.01004319
ret
call fcn.01004421
jmp 0x1003eb6
Function at 0x8003b3f
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov dword [0x80043b4], 0x30
mov dword [0x80043bc], 0x8003351
mov dword [0x80043b8], 2
mov dword [0x80043c0], 0
mov dword [0x80043c4], 0
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
jmp 0x8003b82
mov dword [0x80043c8], eax
mov dword [0x80043dc], 0x80041e0
mov dword [0x80043d4], 0xf
mov dword [0x8004102], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x80043cc], eax
mov dword [0x80043e0], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x800410a], ebp
mov dword [0x80043d0], eax
push 0x80043b4
call dword [sym.imp.user32.dll_RegisterClassExA]
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x8004434], eax
push 0
push dword [0x8004102]
push 0
push 0
push 0x1ef
push 0x21c
push 0xffffe688
push 0xfffff524
push 0xcf0000
push str.uno_momento
push str.verba
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x800442c], eax
push 1
push dword [0x800442c]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x800442c]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x8003c40
xor edi, edi
lea ebx, [0x80043e4]
jmp 0x8003c58
push ebx
call dword [sym.imp.user32.dll_TranslateMessage]
push ebx
call dword [sym.imp.user32.dll_DispatchMessageA]
push edi
push edi
push edi
push ebx
call dword [sym.imp.user32.dll_GetMessageA]
test al, al
jne 0x8003c4a
jmp 0x8003c6c
mov eax, dword [0x80043ec]
call fcn.08002ae4
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
pop eax
nop
nop
nop
nop
add eax, 0x403d6f
nop
nop
sub eax, 0x403d15
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
popal
jmp loc.00401219
Function at 0x4011e0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
xor esi, esi
lea edx, [edi + 4]
nop word [eax + eax]
mov ax, word [edx]
lea edx, [edx + 2]
mov ecx, dword [edi]
add ecx, esi
movzx eax, ax
xor ecx, eax
inc esi
mov word [edx - 2], cx
cmp esi, 0xe
jb 0x4011f0
xor eax, eax
mov word [edi + 0x20], ax
lea eax, [edi + 4]
pop edi
pop esi
pop ebx
ret

Function at 0x401220
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov ebx, 0x11
lea edx, [edi + 4]
nop dword [eax]
mov ax, word [edx]
lea edx, [edx + 2]
movzx ecx, word [edi]
movzx esi, ax
xor esi, ecx
mov word [edx - 2], si
sub ebx, 1
jne 0x401230
xor eax, eax
mov word [edi + 0x26], ax
lea eax, [edi + 4]
pop edi
pop esi
pop ebx
ret

Function at 0x401260
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
xor esi, esi
lea edx, [edi + 4]
nop word [eax + eax]
mov ax, word [edx]
lea edx, [edx + 2]
mov ecx, dword [edi]
add ecx, esi
movzx eax, ax
xor ecx, eax
inc esi
mov word [edx - 2], cx
cmp esi, 0x1e1
jb 0x401270
xor eax, eax
mov word [edi + 0x3c6], ax
lea eax, [edi + 4]
pop edi
pop esi
pop ebx
ret

Function at 0x405907
Capabilities:
Terminate process

Disassembly:
push 0x17
call sub.KERNEL32.dll_IsProcessorFeaturePresent
test eax, eax
jmp 0x405917
push esi
push 1
mov esi, 0xc0000417
push esi
push 2
call fcn.00405710
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
ret
Function at 0x40e086
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x7a7], 0x55
mov byte [ebp - 0x7a6], 0x56
mov byte [ebp - 0x7a5], 0x7e
mov byte [ebp - 0x7a4], 0x21
mov byte [ebp - 0x7a3], 0x20
mov byte [ebp - 0x7a2], 0x3c
mov byte [ebp - 0x7a1], 0x76
mov byte [ebp - 0x7a0], 0x7e
mov byte [ebp - 0x79f], 0x7e
mov byte [ebp - 0x79e], 0x12
push 0xb
lea eax, [ebp - 0x7ac]
push eax
call fcn.004089e6
pop ecx
push eax
mov eax, dword [ebp - 0x338]
lea eax, [ebp + eax - 0x230]
push eax
call fcn.00408947
inc dword [ebx - 0x1116f33c]
add dword [eax], eax
invalid
call [ecx - 0x7af7a3a]
invalid
mov eax, dword [ebp - 0x6fc]
inc eax
mov dword [ebp - 0x6fc], eax
and dword [ebp - 0x37c], 0
call fcn.004089d6
invalid
cmp byte [ecx + 0x2e], 0
je 0x40df6f
mov al, 1
ret
mov eax, dword [ecx + 0x10]
sub eax, dword [ecx + 8]
push 0
push 0
push eax
call fcn.0040f284
ret
mov eax, dword [ecx + 0x40]
cmp eax, 9
ja case.default.0x40dfa4
jmp dword [eax*4 + 0x40dfe8]
push 0
call fcn.0040e2dd
ret
push 1
jmp 0x40dfad
push 8
jmp 0x40dfad
push 1
push 0
call fcn.0040e0e4
ret
push 1
push 0xa
jmp 0x40dfbf
push 0
push 8
jmp 0x40dfbf
push 0
jmp 0x40dfc7
push 0
push 0x10
jmp 0x40dfbf
jmp 0x40e084
jmp 0x40df66
xor al, al
ret
mov edi, edi
push esi
mov esi, ecx
call fcn.0040e36d
lea ecx, [esi + 0x18]
call fcn.0040ddba
cmp eax, 4
je 0x40e0ac
cmp eax, 8
je 0x40e0a4
xor al, al
pop esi
ret
mov ecx, esi
pop esi
jmp 0x40a7bf
mov ecx, esi
pop esi
jmp 0x40a6ef

Function at 0x41a680
Capabilities:
Query environment variable
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x429004]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.00403270
mov eax, dword [0x42a940]
add esp, 0xc
test eax, eax
jne 0x41a6f7
push 0x208
lea eax, [ebp - 0x20c]
push eax
push str.96B2E24D_6EFA_4535_923A_05A6B677FB4D
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x41a6f2
push 0x10
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.00407e53
add esp, 0xc
mov dword [0x42a940], eax
push 0
push 0x429b18
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov eax, dword [0x42a940]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401c37
mov esp, ebp
pop ebp
ret
Function at 0x41a8b0
Capabilities:
Query environment variable
Set environment variable

Disassembly:
push esi
mov esi, dword [0x42a944]
test esi, esi
je 0x41a8c5
cmp word [esi], 0
jne 0x41a97b
push 0
push 0
push str.7C74C363_0E21_4fe8_842F_11D107ECBF75
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, eax
test esi, esi
je 0x41a97f
push esi
call fcn.0040593a
add esp, 4
mov dword [0x42a944], eax
test eax, eax
je 0x41a97f
push esi
push eax
push 0x429c08
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push 0
push 0x429bb8
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov esi, dword [0x42a944]
cmp word [esi], 0x22
jne 0x41a97b
mov ecx, esi
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41a920
sub ecx, edx
sar ecx, 1
cmp word [esi + ecx*2 - 2], 0x22
jne 0x41a97b
mov ecx, esi
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41a940
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [esi + 2]
push eax
push esi
call fcn.004049b0
mov ecx, esi
add esp, 0xc
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41a965
sub ecx, edx
sar ecx, 1
xor eax, eax
mov word [esi + ecx*2 - 2], ax
mov eax, esi
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x41e390
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x429004]
xor eax, ebp
mov dword [ebp - 4], eax
movzx eax, word [ebp + 0xc]
push ebx
push esi
push edi
push str.RT_TEXT
push eax
push 0
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x41e57c
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x41e57c
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x41e57c
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
test esi, esi
je 0x41e57c
cmp esi, 3
jl 0x41e41a
cmp byte [edi], 0xef
jne 0x41e41a
cmp byte [edi + 1], 0xbb
jne 0x41e41a
cmp byte [edi + 2], 0xbf
jne 0x41e41a
add edi, 3
sub esi, 3
test esi, esi
je 0x41e57c
cmp esi, 0xffffffff
je 0x41e57c
push esi
call fcn.0040593a
mov ebx, eax
add esp, 4
mov dword [ebp - 0x10], ebx
test ebx, ebx
je 0x41e57c
push esi
test edi, edi
je 0x41e452
push edi
push ebx
call fcn.00405070
add esp, 0xc
jmp 0x41e46d
push 0
push ebx
call fcn.00403270
add esp, 0xc
call fcn.0040f4d9
mov dword [eax], 0x16
call fcn.004058da
push 0x429cb0
push dword [ebp - 0x10]
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], ebx
call fcn.00402d30
mov ecx, dword [ebp + 8]
mov esi, eax
add esp, 8
test esi, esi
je 0x41e54a
mov edi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov byte [esi], 0
add esi, 2
lea eax, [ebp - 0xc]
push eax
push 0x429cac
push ebx
call fcn.00401a60
add esp, 0xc
test esi, esi
je 0x41e4d5
push 0x429ca8
mov ebx, esi
push esi
mov dword [ebp - 8], ebx
call fcn.00402d30
mov esi, eax
add esp, 8
test esi, esi
je 0x41e547
mov byte [esi], 0
add esi, 2
push 0
push 0
push 0xffffffffffffffff
push ebx
push 0
push 0xfde9
call edi
mov edi, eax
lea eax, [edi + edi]
call fcn.00419d80
mov ebx, esp
push edi
mov edi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push ebx
push 0xffffffffffffffff
push dword [ebp - 8]
push 0
push 0xfde9
call edi
push ecx
push ebx
push ecx
mov ecx, dword [ebp - 0x18]
call fcn.0041e7b0
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 8]
cmp eax, ecx
je 0x41e55a
ja 0x41e54d
test esi, esi
je 0x41e54d
push 0x429b14
push esi
mov ebx, esi
mov dword [ebp - 8], esi
call fcn.00402d30
mov esi, eax
add esp, 8
test esi, esi
je 0x41e547
mov byte [esi], 0
add esi, 2
jne 0x41e4a0
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0xc]
xor edx, edx
or esi, 0xffffffff
cmp eax, ecx
cmovne edx, esi
mov dword [ebp - 0x14], edx
push dword [ebp - 0x10]
call fcn.004056da
mov eax, dword [ebp - 0x14]
add esp, 4
lea esp, [ebp - 0x24]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401c37
mov esp, ebp
pop ebp
ret
or eax, 0xffffffff
lea esp, [ebp - 0x24]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401c37
mov esp, ebp
pop ebp
ret
Function at 0x4206cb
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
movzx ecx, word [eax]
push 0x20
pop ebx
push 2
pop edx
push 0x22
pop esi
cmp cx, si
jne 0x4206f5
add eax, edx
movzx ecx, word [eax]
cmp cx, si
je 0x420708
test cx, cx
jne 0x4206e4
jmp 0x420712
cmp cx, bx
jbe 0x42070a
add eax, edx
cmp word [eax], bx
ja 0x4206fa
jmp 0x42070a
cmp cx, bx
ja 0x420712
add eax, edx
movzx ecx, word [eax]
test cx, cx
jne 0x420703
xor esi, esi
push eax
mov dword [0x4aaf10], esi
call fcn.004322c5
mov edx, eax
and eax, 0x60
jne 0x420775
test dl, 8
je 0x420731
push 8
pop eax
jmp 0x420775
test edx, 0x1eee
jne 0x42073d
xor eax, eax
jmp 0x420775
push edi
xor edi, edi
inc edi
mov ecx, esi
shl edi, cl
test edi, 0x1eee
je 0x42075c
test edx, edi
je 0x42075c
mov eax, edx
sub eax, edi
test eax, 0x1eee
jne 0x42076e
inc esi
cmp esi, ebx
jb 0x42073e
test dl, 4
je 0x420772
test edx, 0x100
jne 0x420772
xor eax, eax
jmp 0x420774
mov eax, edx
pop edi
pop esi
pop ebx
ret

Function at 0x424331
Capabilities:
Read file via mapping

Disassembly:
mov eax, dword [0x4aaf10]
xor ecx, ecx
push ecx
push ecx
push ecx
push 6
push eax
mov dword [0x4b4fec], eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [0x4b4fe8], eax
test eax, eax
jne 0x424355
xor eax, eax
ret
mov edx, 0x9c9c
cmp dword [eax], edx
jne 0x424352
mov ecx, dword [eax + 4]
push esi
push edi
mov edi, 0x20001
lea esi, [edi - 1]
cmp ecx, esi
je 0x424377
cmp ecx, edi
jne 0x4243d2
cmp ecx, esi
jne 0x42437b
cmp dword [eax], edx
jne 0x4243d2
cmp ecx, edi
jne 0x424383
cmp dword [eax], edx
jne 0x4243d2
cmp ecx, esi
jne 0x42438b
cmp dword [eax], edx
jne 0x4243d2
push edx
push eax
push 0x4b4ff4
call fcn.0045cdc1
add esp, 0xc
cmp dword [0x4b5018], 0
mov dword [0x4b4ff8], esi
je 0x4243d2
cmp dword [0x4b500c], 0
je 0x4243d2
cmp dword [0x4b5014], 0
je 0x4243d2
cmp dword [0x4aaf04], 0
jne 0x4243cd
cmp dword [0x4b501c], 0
je 0x4243d2
xor eax, eax
inc eax
jmp 0x4243d4
xor eax, eax
pop edi
pop esi
ret
Function at 0x4244d1
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x4a95d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
push esi
mov dword [0x4bf85c], ebx
mov dword [0x4b0fbc], ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0x2cd8
push ebx
push 0x4b2310
mov dword [0x4b0fb4], eax
mov dword [0x4aaf0c], ebx
mov dword [0x4b230c], ebx
call fcn.0045d10c
mov esi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
add esp, 0xc
push 0x4b2354
call esi
call fcn.00424457
test eax, eax
jne 0x424543
push 0x30303030
call fcn.0044a6b6
jmp 0x424701
push edi
push 0xa5a8
push ebx
push 0x4b4fe8
call fcn.0045d10c
push 0x60
push ebx
push 0x4bf7b8
call fcn.0045d10c
push 0x224
push ebx
push 0x4bf590
call fcn.0045d10c
add esp, 0x24
push 0x4bf7c0
call esi
push 0x4bf860
call esi
push 0x4bf878
call esi
push 0x4aaeb0
call esi
mov esi, 0x800
push esi
push ebx
push 0x4b0fc8
call fcn.0045d10c
push esi
push ebx
push 0x4b17c8
call fcn.0045d10c
push 0x70
push ebx
push 0x4b1fc8
call fcn.0045d10c
push 0x70
push ebx
push 0x4b2038
call fcn.0045d10c
add esp, 0x30
push 0x4bf148
call fcn.00438c0c
push 0x4bf158
call fcn.00438c0c
push 0x100
push 0x10
push 4
push 0x4b2308
call fcn.0043e509
push ebx
push 0x4b22b0
push ebx
push 0x30
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
push 0x402a04
call fcn.0043a3c0
mov edi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4784b0], eax
test eax, eax
je 0x424643
cmp eax, 0xffffffff
je 0x424643
push 0x402a10
push eax
call esi
mov dword [0x4bf894], eax
test eax, eax
jne 0x424643
push dword [0x4784b0]
call edi
mov dword [0x4784b0], ebx
push 0x402a20
call fcn.0043a3c0
mov dword [0x4784ac], eax
test eax, eax
je 0x4246c8
cmp eax, 0xffffffff
je 0x4246c8
push 0x402a2c
push eax
call esi
push 0x402a44
push dword [0x4784ac]
mov dword [0x4bf9b4], eax
call esi
push 0x402a58
push dword [0x4784ac]
mov dword [0x4bf9b8], eax
call esi
push 0x402a68
push dword [0x4784ac]
mov dword [0x4bf9bc], eax
call esi
mov dword [0x4bf9c0], eax
cmp dword [0x4bf9b4], ebx
je 0x4246ba
cmp dword [0x4bf9b8], ebx
je 0x4246ba
cmp dword [0x4bf9bc], ebx
je 0x4246ba
test eax, eax
jne 0x4246c8
push dword [0x4784ac]
call edi
mov dword [0x4784ac], ebx
xor eax, eax
mov esi, 0x4aaec8
mov edi, esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x104
lea eax, [ebp - 0x20c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
pop edi
test eax, eax
je 0x424701
lea eax, [ebp - 0x210]
push eax
push 4
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.0043915e
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0045cd7f
leave
ret