joyce8/EMBER2024-capa huggingface dataset:
Function at 0x421424
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
xor eax, eax
push ebp
push 0x421587
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xa
push 0x421594
push 0
call sub.kernel32.dll_FindResourceW
mov ebx, eax
test ebx, ebx
jne 0x421468
mov ecx, 0x4215b4
mov dl, 1
mov eax, dword [0x412288]
call fcn.00418ef8
call fcn.00406398
push ebx
push 0
call sub.kernel32.dll_SizeofResource
cmp eax, 0x65
je 0x42148b
mov ecx, 0x4215b4
mov dl, 1
mov eax, dword [0x412288]
call fcn.00418ef8
call fcn.00406398
push ebx
push 0
call sub.kernel32.dll_LoadResource
mov ebx, eax
test ebx, ebx
jne 0x4214af
mov ecx, 0x4215b4
mov dl, 1
mov eax, dword [0x412288]
call fcn.00418ef8
call fcn.00406398
push ebx
call sub.kernel32.dll_LockResource
mov edx, dword [0x4265a4]
mov dword [edx], eax
mov eax, dword [0x4265a4]
cmp dword [eax], 0
jne 0x4214dd
mov ecx, 0x4215b4
mov dl, 1
mov eax, dword [0x412288]
call fcn.00418ef8
call fcn.00406398
call fcn.0042141c
mov edx, eax
lea eax, [ebp - 4]
mov ecx, 0xc
call fcn.00406df8
mov ebx, dword [ebp - 4]
cmp ebx, 0x421650
jne 0x421500
mov al, 1
jmp 0x421526
test ebx, ebx
je 0x42150d
mov eax, 0x421650
test eax, eax
jne 0x421511
xor eax, eax
jmp 0x421526
mov edx, 0x421650
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 8]
call fcn.00414d00
test eax, eax
sete al
test al, al
jne 0x421540
mov ecx, 0x4215b4
mov dl, 1
mov eax, dword [0x412288]
call fcn.00418ef8
call fcn.00406398
call fcn.0042141c
mov edx, 0x61
call fcn.0041e26c
mov ebx, eax
call fcn.0042141c
cmp ebx, dword [eax + 0x61]
je 0x421571
mov ecx, 0x4215b4
mov dl, 1
mov eax, dword [0x412288]
call fcn.00418ef8
call fcn.00406398
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42158e
lea eax, [ebp - 4]
call fcn.00406bb8
ret

Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
mov ecx, 0x26452672
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x380f49aa
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40de38
nop
mov ecx, 0x43eb65ba
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x67795127
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x417810
Capabilities:
Get common file path

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x50
test eax, eax
push esi
je 0x417836
mov eax, dword [0x6337d0]
test eax, eax
je 0x41782c
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 1
pop esi
add esp, 0x50
ret
push ebx
push edi
lea eax, [esp + 0xc]
push 0x50
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, str.dsound.dll
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xd]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0xc]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop edi
mov dword [0x6337d0], eax
test eax, eax
pop ebx
je 0x4178d1
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.DirectSoundCreate
push eax
call esi
mov ecx, dword [0x6337d0]
push str.DirectSoundEnumerateA
push ecx
mov dword [0x6337cc], eax
call esi
mov ecx, dword [0x6337cc]
mov dword [0x6337d4], eax
test ecx, ecx
je 0x4178c7
test eax, eax
je 0x4178c7
mov eax, 1
pop esi
add esp, 0x50
ret
mov dword [0x6337d0], 0
xor eax, eax
pop esi
add esp, 0x50
ret

Function at 0x424e69
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
or byte [esi + 0x2c], 0xb3
loop 0x424e5e
jmp 0x767510c9

Function at 0x4acafb
Capabilities:
Encode data using xor

Disassembly:
lodsd eax, dword [esi]
mov al, byte [0xed2d4c7d]
cwde
out 0x25, eax

Function at 0x4b5334
Capabilities:
Encode data using xor

Disassembly:
push 0x3171e091
sbb eax, 0xf5ab0f48
stosd dword es:[edi], eax
cmc
stosd dword es:[edi], eax
cmc
fdivr qword [ebx]
mov eax, 0xc0b0aef4
push ebp
cmp dl, dl
cmp al, byte [edi]
or al, 0x7d
inc edx
push edx
ror cl, 0xf8
pop ebx
pop es
pop ecx
js 0x4b5383
cwde
fstp xword [0x766fd9d5]
scasd eax, dword es:[edi]
inc edx
aaa
push ecx
xor esp, dword [eax]
mov bl, 0xf
add esp, ebp
inc ebx
cmp byte [ecx + edx*2 + 0xa05ca25], ch
pop ebx
push ds
in eax, dx
out 0xa8, al
invalid
jnp 0x4b532c
pop esi
ret
Function at 0x402a70
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57cc8a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x9cc
push esi
push edi
mov edi, ecx
call fcn.00428cef
push 0x409
call dword [sym.imp.KERNEL32.dll_SetThreadLocale]
push 0x409
call dword [sym.imp.KERNEL32.dll_SetThreadUILanguage]
push 0xc
call fcn.0042a957
add esp, 4
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x402ad0
mov ecx, eax
call fcn.0042b768
mov esi, eax
jmp 0x402ad2
xor esi, esi
push 0x58e4e0
mov dword [ebp - 4], 0xffffffff
call fcn.00424f70
push str.Local_AppWizard_Generated_Applications
mov ecx, edi
call fcn.00429cd2
push 0x5c1ca0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x402b60
push 0
lea eax, [edi + 0xcc]
push eax
lea eax, [edi + 0xdc]
push eax
call dword [sym.imp.gdiplus.dll_GdiplusStartup]
lea ecx, [ebp - 0x9d8]
call fcn.00406fc0
lea eax, [ebp - 0x9d8]
mov dword [ebp - 4], 1
mov ecx, eax
mov dword [edi + 0x20], eax
call fcn.0042af7e
test esi, esi
je 0x402b50
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax + 4]
call fcn.0042d656
lea ecx, [ebp - 0x9d8]
call fcn.004073e0
mov ecx, dword [ebp - 0xc]
xor eax, eax
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x402e90
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov eax, edi
shr eax, 4
inc eax
push 6
movzx eax, ax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp + 0xc], eax
test eax, eax
jne 0x402eb9
pop edi
pop ebx
pop ebp
ret
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x402ecf
xor esi, esi
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x402ec6
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [esi + eax]
and edi, 0xf
jbe 0x402f02
nop
cmp esi, ecx
jae 0x402ec6
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edi, 1
jne 0x402ef0
cmp esi, ecx
jae 0x402ec6
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x403190
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
movzx eax, word [ebp + 8]
mov dword [ebp + 8], eax
pop ebp
jmp fcn.0042abe2
Function at 0x4069e0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57cf25
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x240
push esi
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
push 0x11
push dword [0x5f2b30]
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x28], 0
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x40], eax
mov eax, dword [0x5f2c40]
add eax, 0xfffffff0
mov dword [ebp - 0x34], 0x41
push eax
mov dword [ebp - 0x38], 0x5c1e14
call fcn.0040c4e0
add esp, 4
lea esi, [eax + 0x10]
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0
mov dword [ebp - 0x30], 0x4069b0
cmp dword [esi - 4], 1
jle 0x406a7c
push dword [esi - 0xc]
lea ecx, [ebp - 0x14]
call fcn.0040c340
mov esi, dword [ebp - 0x14]
push ebx
push edi
lea eax, [ebp - 0x44]
mov dword [ebp - 0x2c], esi
push eax
call dword [sym.imp.SHELL32.dll_SHBrowseForFolderW]
mov ebx, eax
or edi, 0xffffffff
mov dword [ebp - 0x18], ebx
test ebx, ebx
je 0x406b37
lea eax, [ebp - 0x24c]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
lea edx, [ebp - 0x24c]
lea ecx, [ebp - 0x24]
call fcn.00410840
mov byte [ebp - 4], 1
mov ecx, dword [eax]
mov ebx, dword [0x5f2c40]
add ebx, 0xfffffff0
lea edx, [ecx - 0x10]
cmp edx, ebx
je 0x406b16
cmp dword [ebx + 0xc], 0
jl 0x406b08
mov eax, dword [edx]
cmp eax, dword [ebx]
jne 0x406b08
push edx
call fcn.0040c4e0
add esp, 4
mov dword [ebp - 0x20], eax
mov ecx, edi
lea edx, [ebx + 0xc]
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x406afe
mov ecx, dword [ebx]
push ebx
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x20]
add eax, 0x10
mov dword [0x5f2c40], eax
jmp 0x406b16
push dword [ecx - 0xc]
push ecx
mov ecx, 0x5f2c40
call fcn.0040c620
mov byte [ebp - 4], 0
mov eax, edi
mov edx, dword [ebp - 0x24]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x406b34
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ebx, dword [ebp - 0x18]
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
js 0x406b58
mov eax, dword [ebp - 0x1c]
push ebx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], edi
dec edi
test edi, edi
pop edi
pop ebx
jg 0x406b6f
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x406db0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57cf8d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push esi
push edi
push 0x5f2c44
lea eax, [ebp - 0x18]
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall_
push eax
call fcn.0040b200
push 0x5c35a0
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 0
push eax
call fcn.0040b390
add esp, 0x18
mov byte [ebp - 4], 2
or esi, 0xffffffff
mov edx, dword [ebp - 0x18]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x406e1a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [sym.imp.ADVAPI32.dll_RegGetValueW]
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 1
push str.UninstallString
push dword [ebp - 0x14]
mov dword [ebp - 0x10], 0
push reloc.OLEAUT32.dll_SysReAllocString
call edi
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x406f71
shr eax, 1
mov ecx, 2
mul ecx
push ebx
cmovb eax, esi
push eax
call fcn.00439a1c
add esp, 4
mov ebx, eax
lea eax, [ebp - 0x10]
push eax
push ebx
push 0
push 1
push str.UninstallString
push dword [ebp - 0x14]
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test ebx, ebx
jne 0x406e83
xor ecx, ecx
jmp 0x406e9f
mov ecx, ebx
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x406e90
sub ecx, edx
sar ecx, 1
push ecx
push ebx
mov ecx, 0x5f2c40
call fcn.0040c620
mov edx, dword [0x5f2c40]
lea ecx, [ebp - 0x20]
call fcn.00410cb0
mov byte [ebp - 4], 3
mov ecx, dword [eax]
mov edi, dword [0x5f2c40]
add edi, 0xfffffff0
lea edx, [ecx - 0x10]
cmp edx, edi
je 0x406f18
cmp dword [edi + 0xc], 0
jl 0x406f0a
mov eax, dword [edx]
cmp eax, dword [edi]
jne 0x406f0a
push edx
call fcn.0040c4e0
add esp, 4
mov dword [ebp - 0x1c], eax
mov ecx, esi
lea edx, [edi + 0xc]
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x406f00
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x1c]
add eax, 0x10
mov dword [0x5f2c40], eax
jmp 0x406f18
push dword [ecx - 0xc]
push ecx
mov ecx, 0x5f2c40
call fcn.0040c620
mov byte [ebp - 4], 2
mov eax, esi
mov edx, dword [ebp - 0x20]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x406f36
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push ebx
call fcn.0042ea70
mov eax, dword [0x5f2c40]
add esp, 4
cmp dword [eax - 4], 1
pop ebx
jle 0x406f5d
push dword [eax - 0xc]
mov ecx, 0x5f2c40
call fcn.0040c340
mov eax, dword [0x5f2c40]
push eax
push 0
push 0x1800
push dword [0x5f2b30]
call dword [sym.imp.USER32.dll_SendMessageW]
mov edx, dword [ebp - 0x14]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
pop edi
test esi, esi
pop esi
jg 0x406f8b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x40af50
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57d3db
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov dword [ebp - 0x10], edi
mov eax, dword [esi]
mov edx, dword [esi + 4]
mov dword [edi], eax
mov dword [edi + 4], edx
mov eax, dword [esi + 8]
mov edx, dword [esi + 0xc]
mov dword [edi + 8], eax
mov dword [edi + 0xc], edx
mov eax, dword [esi + 0x10]
mov dword [edi + 0x10], eax
mov eax, dword [esi + 0x14]
mov dword [edi + 0x14], eax
mov eax, dword [esi + 0x18]
sub eax, 0x10
push eax
call fcn.0040c4e0
add eax, 0x10
mov dword [edi + 0x18], eax
mov dword [ebp - 4], 0
mov eax, dword [esi + 0x1c]
sub eax, 0x10
push eax
call fcn.0040c4e0
add eax, 0x10
mov dword [edi + 0x1c], eax
mov byte [ebp - 4], 1
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x24]
mov dword [edi + 0x20], eax
mov dword [edi + 0x24], ecx
mov eax, dword [esi + 0x28]
mov ecx, dword [esi + 0x2c]
mov dword [edi + 0x28], eax
mov dword [edi + 0x2c], ecx
mov eax, dword [esi + 0x30]
mov ecx, dword [esi + 0x34]
mov dword [edi + 0x30], eax
mov dword [edi + 0x34], ecx
mov eax, dword [esi + 0x38]
mov ecx, dword [esi + 0x3c]
mov dword [edi + 0x38], eax
mov dword [edi + 0x3c], ecx
mov eax, dword [esi + 0x40]
mov ecx, dword [esi + 0x44]
mov dword [edi + 0x40], eax
mov dword [edi + 0x44], ecx
mov eax, dword [esi + 0x48]
mov dword [edi + 0x48], eax
mov eax, dword [esi + 0x50]
mov ecx, dword [esi + 0x54]
mov dword [edi + 0x50], eax
mov dword [edi + 0x54], ecx
mov eax, dword [esi + 0x58]
mov ecx, dword [esi + 0x5c]
mov dword [edi + 0x58], eax
mov dword [edi + 0x5c], ecx
mov eax, dword [esi + 0x60]
sub eax, 0x10
push eax
call fcn.0040c4e0
mov ecx, dword [ebp - 0xc]
add esp, 0xc
add eax, 0x10
mov dword [edi + 0x60], eax
mov eax, dword [esi + 0x64]
mov dword [edi + 0x64], eax
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x40b690
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57d460
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push edi
mov dword [ebp - 0x10], ecx
mov edi, dword [ebp + 8]
push edi
mov dword [ebp - 4], 0
call fcn.0043853c
mov ebx, eax
mov dword [ebp - 4], 0xffffffff
test ebx, ebx
jne 0x40b6dd
pop edi
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
mov eax, edi
shr eax, 4
push esi
inc eax
push 6
movzx eax, ax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp + 8], eax
test eax, eax
je 0x40b7b8
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x40b70c
xor esi, esi
jmp 0x40b752
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x40b752
push dword [ebp + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [esi + eax]
and edi, 0xf
jbe 0x40b742
nop dword [eax + eax]
cmp esi, ecx
jae 0x40b746
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edi, 1
jne 0x40b730
cmp esi, ecx
jb 0x40b74a
xor esi, esi
jmp 0x40b752
xor eax, eax
cmp word [esi], ax
cmove esi, eax
test esi, esi
je 0x40b7b8
mov ebx, dword [ebp - 0x10]
mov ecx, 1
movzx edi, word [esi]
mov eax, dword [ebx]
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, edi
or ecx, eax
jge 0x40b777
push edi
mov ecx, ebx
call fcn.0040c5b0
movzx ecx, word [esi]
lea eax, [esi + 2]
push ecx
push eax
push edi
push dword [ebx]
call fcn.0055e12d
push eax
call fcn.00402cb0
mov eax, dword [ebx]
add esp, 0x14
cmp edi, dword [eax - 8]
jg 0x40b7cd
mov dword [eax - 0xc], edi
xor ecx, ecx
mov eax, dword [ebx]
pop esi
mov word [eax + edi*2], cx
lea eax, [ecx + 1]
pop edi
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 0xc]
xor eax, eax
pop esi
pop edi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.004027e0
int3
Function at 0x40c0b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57d460
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [ebp + 8]
xor dl, dl
mov dword [ebp - 0x10], ecx
test eax, eax
je 0x40c1c9
test eax, 0xffff0000
jne 0x40c1c9
push ebx
push edi
movzx edi, ax
push edi
mov dword [ebp - 4], 0
call fcn.0043853c
mov ebx, eax
mov dword [ebp - 4], 0xffffffff
test ebx, ebx
je 0x40c1c5
mov eax, edi
shr eax, 4
push 6
inc eax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp + 8], eax
test eax, eax
je 0x40c1c5
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x40c133
xor esi, esi
jmp 0x40c174
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x40c174
push dword [ebp + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [esi + eax]
and edi, 0xf
jbe 0x40c164
cmp esi, ecx
jae 0x40c168
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edi, 1
jne 0x40c152
cmp esi, ecx
jb 0x40c16c
xor esi, esi
jmp 0x40c174
xor eax, eax
cmp word [esi], ax
cmove esi, eax
test esi, esi
je 0x40c1c4
mov ebx, dword [ebp - 0x10]
mov ecx, 1
movzx edi, word [esi]
mov eax, dword [ebx]
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, edi
or ecx, eax
jge 0x40c199
push edi
mov ecx, ebx
call fcn.0040c5b0
movzx ecx, word [esi]
lea eax, [esi + 2]
push ecx
push eax
push edi
push dword [ebx]
call fcn.0055e12d
push eax
call fcn.00402cb0
mov eax, dword [ebx]
add esp, 0x14
cmp edi, dword [eax - 8]
jg 0x40c1db
mov dword [eax - 0xc], edi
xor ecx, ecx
mov eax, dword [ebx]
mov word [eax + edi*2], cx
pop esi
pop edi
mov dl, 1
pop ebx
mov ecx, dword [ebp - 0xc]
mov al, dl
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.004027e0
int3

Function at 0x40ed60
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x5c3f4c
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x40edf5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test edi, edi
je 0x40edf5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x40edf5
push edi
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x40edf5
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x40edee
push edi
push ebx
push eax
call fcn.0055a7b0
add esp, 0xc
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0
push esi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jne 0x40ede7
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40f880
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57d63d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
push edi
push ecx
mov ebx, esp
mov esi, edx
mov edi, ecx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], 0
call fcn.00437ca1
mov ecx, eax
mov dword [ebp - 4], 0xffffffff
test ecx, ecx
je 0x40f9df
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebx], eax
push esi
mov ecx, ebx
mov dword [ebp - 4], 1
call fcn.0040c0b0
test al, al
jne 0x40f908
test esi, esi
jne 0x40f8ea
xor ecx, ecx
jmp 0x40f8ff
mov ecx, esi
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40f8f0
sub ecx, edx
sar ecx, 1
push ecx
push esi
mov ecx, ebx
call fcn.0040c620
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 0xffffffff
call fcn.0040f3a0
mov dword [ebp - 4], 2
mov esi, esp
mov ebx, dword [eax]
mov dword [ebp - 0x18], esi
mov byte [ebp - 4], 3
call fcn.00437ca1
mov ecx, eax
mov byte [ebp - 4], 2
test ecx, ecx
je 0x40f9e9
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
push edi
mov ecx, esi
mov byte [ebp - 4], 4
call fcn.0040c0b0
test al, al
jne 0x40f97b
test edi, edi
jne 0x40f95e
xor ecx, ecx
jmp 0x40f972
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40f963
sub ecx, edx
sar ecx, 1
push ecx
push edi
mov ecx, esi
call fcn.0040c620
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 2
call fcn.0040f3a0
add esp, 4
push 0
push ebx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov edx, dword [ebp - 0x10]
or esi, 0xffffffff
mov edi, eax
add edx, 0xfffffff0
mov ecx, esi
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x40f9b4
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x14]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x40f9cc
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.004027e0
push 0x80004005
call fcn.004027e0
int3