joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4bace6
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov dword [ebp - 4], ecx
test esi, esi
jne 0x4bad00
call fcn.0047a7f9
mov esi, dword [eax + 0xc]
push dword [0x607618]
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.DLL_FindResourceW]
mov edi, eax
test edi, edi
jne 0x4bad1e
xor eax, eax
pop edi
pop esi
leave
ret 8
push edi
push esi
call dword [sym.imp.KERNEL32.DLL_LoadResource]
mov dword [ebp + 0xc], eax
test eax, eax
je 0x4bad16
push ebx
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov ebx, eax
test ebx, ebx
jne 0x4bad4b
xor esi, esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.DLL_FreeResource]
mov eax, esi
pop ebx
jmp 0x4bad18
push edi
push esi
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
mov ecx, dword [ebp - 4]
push eax
push ebx
call fcn.004bac14
mov esi, eax
jmp 0x4bad3d

Function at 0x535f51
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
test byte [esi + 4], 1
push edi
mov ebx, ecx
je 0x535f69
mov edi, dword [esi + 0xc]
jmp 0x535fa9
push 5
push dword [esi + 0xc]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.DLL_FindResourceW]
mov edi, eax
test edi, edi
jne 0x535f82
call fcn.0047b745
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.DLL_LoadResource]
mov edi, eax
test edi, edi
jne 0x535f97
call fcn.0047b745
push edi
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov edi, eax
test edi, edi
jne 0x535fa9
call fcn.0047b745
call fcn.0047a7f9
cmp dword [eax + 0x3c], 0
je 0x535fbe
push edi
mov ecx, ebx
call fcn.00534e05
mov edi, eax
push dword [ebp + 0xc]
push edi
call fcn.00535e6b
mov dword [ebp + 8], eax
mov eax, dword [ebx + 0x7c]
test eax, eax
je 0x535fdc
push eax
call dword [sym.imp.KERNEL32.DLL_GlobalFree]
and dword [ebx + 0x7c], 0
mov eax, dword [ebp + 8]
test eax, eax
je 0x535fe8
mov edi, eax
mov dword [ebx + 0x7c], eax
or dword [esi + 4], 1
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x55f89e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x602c90]
jne 0x55f8a8
repz ret
jmp fcn.00568741

Function at 0x56c3e2
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x56c409
call fcn.00561fc3
mov dword [eax], esi
call fcn.00561fb0
push 0x16
pop esi
mov dword [eax], esi
call fcn.005689d1
mov eax, esi
jmp 0x56c45e
test dword [ebp + 0xc], 0xfffffff9
jne 0x56c3ef
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x56c436
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
call fcn.00561fd6
pop ecx
call fcn.00561fb0
mov eax, dword [eax]
jmp 0x56c45e
test al, 0x10
jne 0x56c45c
test al, 1
je 0x56c45c
test byte [ebp + 0xc], 2
je 0x56c45c
call fcn.00561fc3
mov dword [eax], 5
call fcn.00561fb0
mov dword [eax], 0xd
jmp 0x56c42d
xor eax, eax
pop esi
pop ebp
ret
Function at 0x576008
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x602c90]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00568169
and dword [ebp - 0x14], 0
cmp dword [0x60aa20], 0
mov dword [ebp - 0x18], eax
jne 0x5760bb
push str.USER32.DLL
call dword [sym.imp.KERNEL32.DLL_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x576163
mov edi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push 0x5bf6e8
push ebx
call edi
test eax, eax
je 0x576163
mov esi, dword [sym.imp.KERNEL32.DLL_EncodePointer]
push eax
call esi
push 0x5bf6d8
push ebx
mov dword [0x60aa20], eax
call edi
push eax
call esi
push 0x5bf6c4
push ebx
mov dword [0x60aa24], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x60aa28], eax
call edi
push eax
call esi
mov dword [0x60aa30], eax
test eax, eax
je 0x5760bb
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x60aa2c], eax
mov eax, dword [0x60aa2c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.DLL_DecodePointer]
cmp eax, ecx
je 0x576114
cmp dword [0x60aa30], ecx
je 0x576114
push eax
call esi
push dword [0x60aa30]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x576114
test ebx, ebx
je 0x576114
call edi
test eax, eax
je 0x57610b
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x57610b
test byte [ebp - 8], 1
jne 0x576114
or dword [ebp + 0x10], 0x200000
jmp 0x576147
mov eax, dword [0x60aa24]
cmp eax, dword [ebp - 0x18]
je 0x576147
push eax
call esi
test eax, eax
je 0x576147
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x576147
mov eax, dword [0x60aa28]
cmp eax, dword [ebp - 0x18]
je 0x576147
push eax
call esi
test eax, eax
je 0x576147
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x60aa20]
call esi
test eax, eax
je 0x576163
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x576165
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0055f89e
leave
ret
Function at 0x4017c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4017db
pop edi
pop ebx
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x401812
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
add eax, esi
and ecx, 0xf
jbe 0x40180e
jmp 0x401800
cmp esi, eax
jae 0x401812
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x401800
cmp esi, eax
jb 0x401819
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4020c0
Capabilities:
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x60d110]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebx + 0x24], 0x10
lea eax, [ebx + 0x10]
jb 0x4020db
mov eax, dword [eax]
push esi
push edi
push eax
mov eax, dword [ebx + 4]
push 0x2712
push eax
call fcn.0055d870
add esp, 0xc
mov edi, 0x53
mov eax, str.Mozilla_5.0__Macintosh__Intel_Mac_OS_X_10.6__rv:2.0.1__Gecko_20100101_Firefox_4.0.1
lea esi, [ebp - 0x20]
mov dword [ebp - 0xc], 0xf
mov dword [ebp - 0x10], 0
mov byte [ebp - 0x20], 0
call fcn.00402400
mov eax, dword [ebp - 0x20]
mov esi, 0x10
cmp dword [ebp - 0xc], esi
jae 0x402123
lea eax, [ebp - 0x20]
mov ecx, dword [ebx + 4]
push eax
push 0x2722
push ecx
call fcn.0055d870
mov edx, dword [ebx + 4]
push 5
push 0x44
push edx
call fcn.0055d870
mov eax, dword [ebx + 4]
push 1
push 0x34
push eax
call fcn.0055d870
mov ecx, dword [ebx + 4]
push 1
push 0x63
push ecx
call fcn.0055d870
mov edx, dword [ebx + 4]
push 0
push 0x2f
push edx
call fcn.0055d870
mov eax, dword [ebx + 4]
push 0x4022c0
push 0x4e2b
push eax
call fcn.0055d870
mov ecx, dword [ebx + 4]
add esp, 0x48
push ebx
push 0x2711
push ecx
call fcn.0055d870
mov edx, dword [ebx + 4]
push 0
push 0x40
push edx
call fcn.0055d870
mov eax, dword [ebx + 4]
push 0
push 0x51
push eax
call fcn.0055d870
add esp, 0x24
cmp dword [ebp - 0xc], esi
pop edi
pop esi
jb 0x4021bb
mov ecx, dword [ebp - 0x20]
push ecx
call fcn.0040b731
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00542b84
mov esp, ebp
pop ebp
ret
Function at 0x404940
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
xor esi, esi
push esi
push str.D___Vtfst__Qvcmjd__fo_ebu
call fcn.005962b8
mov eax, dword [ebp + 8]
add esp, 8
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x404960
sub eax, edx
push 0x5e43b4
push str.D___Vtfst__Qvcmjd__fo_ebu
mov dword [ebp - 8], eax
call fcn.005435ae
push 0x5e3c64
push str.D___Vtfst__Qvcmjd__ef_ebu
mov edi, eax
call fcn.005435ae
push edi
mov ebx, eax
call fcn.005439f6
add esp, 0x14
test eax, eax
jne 0x4049e9
jmp 0x4049a0
push edi
push 1
lea eax, [ebp - 1]
push 1
push eax
call fcn.00543c90
push edi
call fcn.005439f6
add esp, 0x14
test eax, eax
jne 0x4049dc
mov eax, esi
cdq
idiv dword [ebp - 8]
mov ecx, dword [ebp + 8]
push ebx
push 1
lea eax, [ebp - 1]
push 1
push eax
mov dl, byte [edx + ecx]
xor byte [ebp - 1], dl
call fcn.0054371c
add esp, 0x10
inc esi
push edi
call fcn.005439f6
add esp, 4
test eax, eax
je 0x4049a0
push edi
call fcn.0054347e
push ebx
call fcn.0054347e
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x404a00
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
mov eax, dword [0x60d110]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
call fcn.0040b500
mov ebx, eax
xor edi, edi
cmp ebx, edi
je 0x404a6d
call fcn.0040b630
test eax, eax
je 0x404a80
cmp dword [ebx], 1
je 0x404a4e
mov dword [0x615154], 0x80000
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00542b84
mov esp, ebp
pop ebp
ret
mov esi, dword [ebx + 4]
call fcn.0040b4a0
mov dword [0x615154], eax
cmp esi, edi
je 0x404a64
call fcn.0040b5e0
push ebx
call fcn.0040b731
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00542b84
mov esp, ebp
pop ebp
ret
xor eax, eax
mov dword [ebp - 0x138], eax
mov byte [ebp - 0x134], al
mov dword [ebp - 0x10], edi
cmp dword [ebx], 1
je 0x404aba
mov edi, ebx
mov dword [0x615154], 0x80000
call fcn.0040b6a0
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00542b84
mov esp, ebp
pop ebp
ret
mov esi, dword [ebx + 4]
mov ecx, dword [esi]
or edx, 0xffffffff
cmp dword [ecx + 4], edx
jg 0x404ace
mov ecx, 0x10000
jmp 0x404b11
cmp dword [esi + 4], edx
je 0x404adf
mov edi, ecx
call fcn.0040a840
xor edi, edi
or edx, 0xffffffff
mov eax, dword [esi]
mov dword [esi + 4], edx
mov eax, dword [eax + 4]
mov dword [ebp - 0x138], eax
mov byte [ebp - 0x134], 0
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], edi
xor ecx, ecx
mov dword [0x615154], ecx
cmp ecx, edi
je 0x404b35
mov edi, ebx
call fcn.0040b6a0
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00542b84
mov esp, ebp
pop ebp
ret
xor esi, esi
mov dword [ebp - 0x13c], eax
cmp eax, edi
jle 0x404bb3
jmp 0x404b50
mov dword [ebp - 0x138], edi
mov byte [ebp - 0x134], 0
mov dword [ebp - 0x10], edi
cmp dword [ebx], 1
je 0x404b71
mov dword [0x615154], 0x80000
jmp 0x404b85
mov ecx, dword [ebx + 4]
push esi
lea edx, [ebp - 0x138]
call fcn.0040aa30
mov dword [0x615154], eax
cmp dword [ebx], 1
je 0x404b96
mov dword [0x615154], 0x80000
jmp 0x404baa
mov ecx, dword [ebx + 4]
push esi
lea edx, [ebp - 0x134]
call fcn.0040b160
mov dword [0x615154], eax
inc esi
cmp esi, dword [ebp - 0x13c]
jl 0x404b50
cmp dword [ebx], 1
je 0x404bc4
mov dword [0x615154], 0x80000
jmp 0x404be3
mov esi, dword [ebx + 4]
call fcn.0040b4a0
mov dword [0x615154], eax
cmp esi, edi
je 0x404bda
call fcn.0040b5e0
push ebx
call fcn.0040b731
add esp, 4
push str.D___Vtfst__Qvcmjd__ef_ebu
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.00542b84
mov esp, ebp
pop ebp
ret
Function at 0x408ef0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
test ecx, ecx
jne 0x408ef7
xor eax, eax
ret
push esi
not eax
cmp edx, 8
jb 0x408fcd
mov esi, edx
shr esi, 3
push edi
lea esp, [esp]
movzx edi, byte [ecx]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x5e6278]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x5e6278]
movzx edi, byte [ecx + 2]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x5e6278]
movzx edi, byte [ecx + 3]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x5e6278]
movzx edi, byte [ecx + 4]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x5e6278]
movzx edi, byte [ecx + 5]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x5e6278]
movzx edi, byte [ecx + 6]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x5e6278]
movzx edi, byte [ecx + 7]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x5e6278]
add ecx, 8
sub edx, 8
dec esi
jne 0x408f10
pop edi
test edx, edx
je 0x408fea
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x5e6278]
inc ecx
dec edx
jne 0x408fd1
not eax
pop esi
ret

Function at 0x408ff0
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov eax, dword [edx]
movsx ecx, cl
xor ecx, eax
shr eax, 8
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x5e6278]
xor ecx, eax
movzx eax, cl
add eax, dword [edx + 4]
mov dword [edx], ecx
mov ecx, dword [edx + 8]
imul eax, eax, 0x8088405
inc eax
mov dword [edx + 4], eax
shr eax, 0x18
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x5e6278]
mov dword [edx + 8], ecx
ret

Function at 0x409040
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov ecx, dword [esi + 8]
push ebx
mov edx, ecx
and edx, 0xfffd
or edx, 2
mov ebx, edx
xor ebx, 1
imul ebx, edx
mov edx, dword [esi]
shr ebx, 8
push edi
xor al, bl
movsx edi, al
xor edi, edx
shr edx, 8
and edi, 0xff
mov ebx, dword [edi*4 + 0x5e6278]
xor ebx, edx
movzx edx, bl
add edx, dword [esi + 4]
mov dword [esi], ebx
imul edx, edx, 0x8088405
inc edx
mov dword [esi + 4], edx
shr edx, 0x18
xor edx, ecx
and edx, 0xff
shr ecx, 8
xor ecx, dword [edx*4 + 0x5e6278]
pop edi
mov dword [esi + 8], ecx
pop ebx
ret

Function at 0x4097b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ebx
imul esi, dword [ebp + 0xc]
cmp byte [edi], 0
je 0x4097e6
mov ecx, dword [ebp + 8]
mov edx, dword [edi + 4]
push 0
lea eax, [ebp + 0xc]
push eax
push esi
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4097dc
mov byte [edi + 8], 1
mov eax, dword [ebp + 0xc]
xor edx, edx
div ebx
pop esi
pop ebp
ret
mov ecx, dword [edi + 0x1c]
mov eax, dword [edi + 0x18]
lea edx, [ecx + esi]
cmp edx, eax
jbe 0x4097f7
sub eax, ecx
mov esi, eax
mov eax, dword [edi + 0x14]
add eax, ecx
mov ecx, dword [ebp + 8]
push esi
push eax
push ecx
call fcn.005456c0
add dword [edi + 0x1c], esi
add esp, 0xc
mov eax, esi
xor edx, edx
div ebx
pop esi
pop ebp
ret
Function at 0x409820
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp byte [esi], 0
push edi
mov edi, 1
je 0x409853
mov edx, dword [esi + 4]
push 0
lea eax, [ebp - 8]
push eax
push edi
lea ecx, [ebp - 1]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40984e
mov byte [esi + 8], 1
mov edi, dword [ebp - 8]
jmp 0x40987e
mov eax, dword [esi + 0x18]
push ebx
mov ebx, dword [esi + 0x1c]
lea ecx, [ebx + 1]
cmp ecx, eax
jbe 0x409865
sub eax, ebx
mov edi, eax
mov edx, dword [esi + 0x14]
push edi
add edx, ebx
push edx
lea eax, [ebp - 1]
push eax
call fcn.005456c0
add esp, 0xc
add ebx, edi
mov dword [esi + 0x1c], ebx
pop ebx
cmp edi, 1
pop edi
jne 0x409893
movzx ecx, byte [ebp - 1]
mov edx, dword [ebp + 8]
mov dword [edx], ecx
xor eax, eax
mov esp, ebp
pop ebp
ret
cmp byte [esi], 0
je 0x40988d
cmp byte [esi + 8], 0
je 0x40988d
or eax, 0xffffffff
mov esp, ebp
pop ebp
ret
Function at 0x409930
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
cmp byte [esi], 0
je 0x409977
cmp byte [esi + 1], 0
je 0x40997f
mov eax, dword [esi + 4]
push 2
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp byte [esi], 0
push ebx
je 0x409992
cmp byte [esi + 1], 0
je 0x409986
mov edx, dword [esi + 4]
push 1
push 0
push 0
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ebx, eax
sub ebx, dword [esi + 0xc]
mov dword [ebp - 4], ebx
jmp 0x40999a
mov ecx, dword [esi + 0x18]
mov dword [esi + 0x1c], ecx
jmp 0x409951
or eax, 0xffffffff
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0
mov ebx, dword [ebp - 4]
jmp 0x40999a
mov eax, dword [esi + 0x1c]
mov dword [ebp - 4], eax
mov ebx, eax
push edi
mov edi, 0xffff
mov dword [ebp - 8], edi
cmp ebx, edi
jae 0x4099ac
mov dword [ebp - 8], ebx
mov edi, ebx
push 0x404
call fcn.00543eee
add esp, 4
mov dword [ebp - 0x10], eax
test eax, eax
jne 0x4099c9
pop edi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 4
mov dword [ebp - 0x14], 0xffffffff
cmp edi, eax
jbe 0x409add
jmp 0x4099e9
mov edi, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov ebx, dword [ebp - 4]
add eax, 0x400
mov dword [ebp - 0xc], edi
cmp eax, edi
ja 0x4099f8
mov dword [ebp - 0xc], eax
mov eax, ebx
sub eax, dword [ebp - 0xc]
sub ebx, eax
mov dword [ebp - 0x1c], eax
cmp ebx, 0x404
jbe 0x409a0f
mov ebx, 0x404
cmp byte [esi], 0
je 0x409a34
cmp byte [esi + 1], 0
je 0x409add
mov ecx, dword [esi + 0xc]
mov edx, dword [esi + 4]
push 0
push 0
add ecx, eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x409a37
mov dword [esi + 0x1c], eax
cmp byte [esi], 0
mov edi, ebx
je 0x409a60
mov ecx, dword [ebp - 0x10]
mov edx, dword [esi + 4]
push 0
lea eax, [ebp - 0x18]
push eax
push ebx
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x409a5b
mov byte [esi + 8], 1
mov eax, dword [ebp - 0x18]
jmp 0x409a89
mov eax, dword [esi + 0x1c]
mov ecx, dword [esi + 0x18]
lea edx, [eax + ebx]
cmp edx, ecx
jbe 0x409a71
sub ecx, eax
mov edi, ecx
mov ecx, dword [esi + 0x14]
mov edx, dword [ebp - 0x10]
push edi
add ecx, eax
push ecx
push edx
call fcn.005456c0
add esp, 0xc
add dword [esi + 0x1c], edi
mov eax, edi
xor edx, edx
div ebx
cmp eax, 1
jne 0x409add
lea eax, [ebx - 3]
test eax, eax
js 0x409acb
lea esp, [esp]
mov ecx, dword [ebp - 0x10]
dec eax
cmp byte [eax + ecx], 0x50
jne 0x409abf
cmp byte [eax + ecx + 1], 0x4b
jne 0x409abf
cmp byte [eax + ecx + 2], 5
jne 0x409abf
cmp byte [eax + ecx + 3], 6
je 0x409ac5
test eax, eax
jns 0x409aa0
jmp 0x409acb
add eax, dword [ebp - 0x1c]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x409add
mov edx, dword [ebp - 8]
cmp dword [ebp - 0xc], edx
jb 0x4099e0
mov eax, dword [ebp - 0x10]
push eax
call fcn.00543eb4
mov eax, dword [ebp - 0x14]
add esp, 4
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40a9a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [esi], 0
push edi
jne 0x40aa23
cmp dword [esi + 4], 0xffffffff
jne 0x40aa23
lea edi, [esi + 0x140]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40a9c7
sub eax, edx
mov al, byte [eax + esi + 0x13f]
cmp al, 0x5c
je 0x40a9f1
cmp al, 0x2f
je 0x40a9f1
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40a9e0
mov ax, word [0x5e4840]
mov word [edi], ax
lea ecx, [ebp - 4]
push ecx
call fcn.00409710
add esp, 4
test eax, eax
jne 0x40aa09
mov eax, dword [ebp - 4]
pop edi
mov esp, ebp
pop ebp
ret
call fcn.00409b00
mov dword [esi], eax
neg eax
sbb eax, eax
and eax, 0xfffffe00
add eax, 0x200
pop edi
mov esp, ebp
pop ebp
ret
mov eax, 0x1000000
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x40b060
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x60d110]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x40b094
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x40b094
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov al, byte [ebx]
test al, al
je 0x40b14e
push esi
mov esi, ebx
mov ecx, ebx
cmp al, 0x2f
je 0x40b0ab
cmp al, 0x5c
jne 0x40b0ad
mov esi, ecx
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x40b0a3
cmp esi, ebx
je 0x40b0e1
sub esi, ebx
push esi
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.005456c0
lea ecx, [ebp - 0x20c]
push ecx
push edi
mov byte [ebp + esi - 0x20c], 0
call fcn.0040b060
add esp, 0x14
mov byte [ebp - 0x108], 0
test edi, edi
je 0x40b100
lea edx, [ebp - 0x108]
mov eax, edi
sub edx, edi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x40b0f6
mov eax, ebx
mov edx, ebx
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40b104
lea edi, [ebp - 0x108]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x40b114
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea edx, [ebp - 0x108]
and ecx, 3
push edx
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
pop esi
cmp eax, 0xffffffff
jne 0x40b14e
push 0
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.00542b84
mov esp, ebp
pop ebp
ret
Function at 0x40b7ef
Capabilities:
Connect socket

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ecx + 4]
call dword [sym.imp.WS2_32.dll_connect]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop ebp
ret 8

Function at 0x425362
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov dword [ebp - 4], ecx
test esi, esi
jne 0x42537c
call fcn.004392d0
mov esi, dword [eax + 0xc]
push dword [0x60f618]
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x42539a
xor eax, eax
pop edi
pop esi
leave
ret 8
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp + 0xc], eax
test eax, eax
je 0x425392
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
jne 0x4253c7
xor esi, esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop ebx
jmp 0x425394
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 4]
push eax
push ebx
call fcn.00425290
mov esi, eax
jmp 0x4253b9

Function at 0x42f685
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x59e79c
call fcn.00544734
mov esi, ecx
cmp dword [esi + 0x6c], 0
jne 0x42f6aa
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x42f6fc
call fcn.0040c175
push eax
lea ecx, [ebp - 0x10]
call fcn.00401e10
mov ecx, dword [esi + 0x6c]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00544a5e
push eax
call fcn.0040ca1a
add esp, 0x14
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00401e40
mov eax, esi
call fcn.0054480c
ret 8

Function at 0x46f926
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x46f96d
call fcn.004392d0
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x46f96d
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x46f989
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.0046f42b
mov esi, eax
test edi, edi
je 0x46f987
test ebx, ebx
je 0x46f987
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4