joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401dca
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [0x42e180]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [0x423124]
push edi
mov edi, ecx
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x10]
push str.Py_Initialize
push edi
mov dword [ebp - 0x50], eax
call esi
push str.PySys_SetArgv
push edi
mov ebx, eax
call esi
push str.PyRun_SimpleString
push edi
mov dword [ebp - 0x48], eax
call esi
push str.Py_Finalize
push edi
mov dword [ebp - 0x44], eax
call esi
push str.Py_BuildValue
push edi
mov dword [ebp - 0x40], eax
call esi
push str.PyCFunction_New
push edi
mov dword [ebp - 0x3c], eax
call esi
push str.PyArg_ParseTuple
push edi
mov dword [ebp - 0x4c], eax
call esi
push str.PyErr_Format
push edi
mov dword [ebp - 0x54], eax
call esi
xor esi, esi
cmp ebx, esi
je 0x401fb2
cmp dword [ebp - 0x48], esi
je 0x401fb2
cmp dword [ebp - 0x44], esi
je 0x401fb2
cmp dword [ebp - 0x40], esi
je 0x401fb2
cmp dword [ebp - 0x3c], esi
je 0x401fb2
cmp dword [ebp - 0x54], esi
je 0x401fb2
cmp eax, esi
je 0x401fb2
cmp dword [ebp - 0x4c], esi
je 0x401fb2
mov eax, dword [ebp - 0x38]
cmp eax, esi
je 0x401fab
cmp byte [eax], 0
je 0x401fab
push esi
push eax
call fcn.0041fd3e
pop ecx
pop ecx
mov dword [ebp - 0x3c], eax
cmp eax, 0xffffffff
jne 0x401ed3
push dword [ebp - 0x38]
push str.Could_not_open_postinstall_script__s_n
call fcn.00408d40
add eax, 0x40
push eax
call fcn.00408baa
add esp, 0xc
push 3
pop eax
jmp 0x401fb5
push str.Running_Script...
push 0x3ec
push dword [0x431ab8]
call dword [0x423288]
call ebx
mov eax, edi
call fcn.00401cbb
push 0x400
push esi
mov esi, 0x42f288
push esi
call fcn.00407c60
mov eax, dword [ebp + 0xc]
add esp, 0xc
test eax, eax
jle 0x401f33
mov edi, dword [ebp - 0x50]
mov ebx, esi
sub ebx, edi
mov dword [ebp - 0x38], eax
mov eax, dword [edi]
test eax, eax
je 0x401f26
push eax
call fcn.00401748
pop ecx
jmp 0x401f28
xor eax, eax
mov dword [ebx + edi], eax
add edi, 4
dec dword [ebp - 0x38]
jne 0x401f17
push esi
push dword [ebp + 0xc]
call dword [ebp - 0x48]
xor esi, esi
pop ecx
pop ecx
cmp dword [ebp + 0xc], esi
jle 0x401f5b
mov eax, dword [esi*4 + 0x42f288]
test eax, eax
je 0x401f55
push eax
call fcn.00408499
pop ecx
inc esi
cmp esi, dword [ebp + 0xc]
jl 0x401f43
push 3
pop ebx
lea eax, [ebp - 0x34]
push eax
push dword [ebp - 0x3c]
call fcn.00408858
pop ecx
pop ecx
test eax, eax
jne 0x401f9b
mov edi, dword [ebp - 0x20]
lea eax, [edi + 5]
call fcn.00408f00
mov esi, esp
push edi
push esi
push dword [ebp - 0x3c]
call fcn.0042097e
add esp, 0xc
test eax, eax
jle 0x401f9b
push esi
mov word [eax + esi], 0xa
call dword [ebp - 0x44]
pop ecx
mov ebx, eax
call dword [ebp - 0x40]
push dword [ebp - 0x3c]
call fcn.00414081
pop ecx
mov eax, ebx
jmp 0x401fb5
push 2
jmp 0x401ecd
xor eax, eax
inc eax
lea esp, [ebp - 0x60]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00407e15
leave
ret
Function at 0x402d00
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x561c20
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x5a7074]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x14], ebx
call fcn.0040e640
mov ecx, eax
test ecx, ecx
jne 0x402d42
push 0x80004005
call fcn.0040e1d0
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x402d57
lock inc dword [ecx + 0x14]
lea eax, [ecx + 8]
jmp 0x402d59
call edx
add eax, 0x10
mov dword [ebp - 0x10], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0
push dword [esi]
push str.setLanguage:_s
push eax
call fcn.00408f20
mov edi, dword [ebp - 0x10]
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebx], 0
jne 0x402d95
push dword [ebx + 4]
mov ecx, ebx
call fcn.00402770
add ebx, 0x1c
push esi
mov ecx, ebx
mov dword [ebp - 0x1c], ebx
call fcn.004094e0
mov esi, eax
cmp esi, dword [ebx]
je 0x402db9
lea eax, [esi + 0x10]
push eax
push dword [ebp + 8]
call fcn.004060e0
test al, al
je 0x402dbb
mov esi, dword [ebx]
mov eax, dword [ebp - 0x1c]
or ebx, 0xffffffff
cmp esi, dword [eax]
je 0x402e88
mov eax, dword [ebp - 0x14]
lea ecx, [esi + 0x14]
mov dword [ebp - 0x1c], ecx
mov eax, dword [eax + 0x14]
cmp eax, dword [ecx]
je 0x402e88
push dword [ebp + 8]
mov esi, dword [ebp - 0x14]
mov ecx, esi
call fcn.00404910
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x20]
call fcn.00405240
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x20]
test ecx, ecx
setne al
test al, al
je 0x402e19
cmp dword [ecx + 0x10], 0
jbe 0x402e19
lea eax, [ebp - 0x20]
push eax
lea ecx, [esi + 0x14]
call fcn.00405120
jmp 0x402e5b
lea eax, [ecx + 8]
mov ecx, esi
push 0
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.00403b20
push eax
lea ecx, [esi + 0x14]
call fcn.004051b0
mov ecx, dword [ebp - 0x14]
mov dword [ebp + 8], ecx
test ecx, ecx
je 0x402e5b
mov eax, ebx
lock xadd dword [ecx + 4], eax
jne 0x402e5b
mov eax, dword [ecx]
call dword [eax]
mov ecx, dword [ebp + 8]
mov eax, ebx
lock xadd dword [ecx + 8], eax
jne 0x402e5b
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, esi
call fcn.00404850
mov esi, dword [ebp - 0x1c]
test esi, esi
je 0x402e88
mov eax, ebx
lock xadd dword [esi + 4], eax
jne 0x402e88
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
mov eax, ebx
lock xadd dword [esi + 8], eax
jne 0x402e88
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
add edi, 0xfffffff0
lock xadd dword [edi + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x402ecf
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
mov edx, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x402ecd
mov eax, dword [ecx + 4]
push 0
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
call edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4033f0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ecx + 0x14], 8
push ebx
push esi
mov esi, edx
jb 0x403400
mov ecx, dword [ecx]
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x403428
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
push edi
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [esi + 0x10]
mov edi, eax
cmp edi, ecx
ja 0x403454
mov dword [esi + 0x10], edi
cmp dword [esi + 0x14], 0x10
jb 0x40344c
mov eax, dword [esi]
mov byte [eax + edi], 0
jmp 0x403462
mov eax, esi
mov byte [eax + edi], 0
jmp 0x403462
mov eax, edi
sub eax, ecx
mov ecx, esi
push 0x20
push eax
call fcn.00406be0
cmp dword [esi + 0x14], 0x10
mov dword [ebp - 4], 0
jb 0x403471
mov esi, dword [esi]
push 0
lea eax, [ebp - 4]
push eax
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x40349e
cmp dword [ebp - 4], edi
jne 0x40349e
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x404910
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push dword [ecx + 4]
mov edi, SysReAllocString
push edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
test esi, esi
jne 0x404965
mov eax, dword [ebp + 8]
mov edi, dword [ebp - 4]
mov ecx, dword [eax]
mov eax, dword [ecx - 0xc]
add eax, eax
push eax
push ecx
push 1
push esi
push str.LanguageId
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x404980
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x561f5f
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
mov eax, dword [0x5a7074]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
mov ecx, edi
mov dword [ebp - 4], 0
push 0x580ef0
mov dword [ebp - 0x224], edi
mov dword [ebp - 0x214], 0
call fcn.0040d970
mov dword [ebp - 4], 0
mov ecx, dword [esi + 4]
sub ecx, 0x10
mov dword [ebp - 0x214], 1
call fcn.0040e0c0
add eax, 0x10
mov dword [ebp - 0x21c], eax
lea ebx, [eax - 0x10]
mov dword [ebp - 4], 1
mov ecx, ebx
mov dword [ebp - 0x214], 3
call fcn.0040e0c0
lea esi, [eax + 0x10]
mov dword [ebp - 0x228], esi
mov dword [ebp - 4], 5
or eax, 0xffffffff
mov dword [ebp - 0x214], 1
lock xadd dword [ebx + 0xc], eax
dec eax
test eax, eax
jg 0x404a60
mov ecx, dword [ebx]
push ebx
mov eax, dword [ecx]
mov edx, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x404a5e
mov eax, dword [ecx + 4]
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
push 0
push dword [eax + 4]
call ebx
jmp 0x404a66
call edx
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
lea eax, [ebp - 0x218]
push eax
push 0x20019
push 0
push esi
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x404b10
push 0x200
push eax
lea eax, [ebp - 0x210]
push eax
call fcn.005111c0
add esp, 0xc
mov dword [ebp - 0x21c], 1
lea eax, [ebp - 0x220]
mov dword [ebp - 0x220], 0x200
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x21c]
push eax
push 0
push str.LanguageId
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x404b04
lea ecx, [ebp - 0x210]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x404ae6
sub ecx, edx
lea eax, [ebp - 0x210]
sar ecx, 1
push ecx
push eax
mov ecx, edi
call fcn.0040de20
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 0
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x404b44
mov edx, dword [esi]
push esi
mov ecx, dword [edx]
mov eax, dword [ecx + 4]
cmp ecx, vtable.ATL::CAtlStringMgr.0
jne 0x404b40
mov ecx, dword [edx + 4]
push 0
push dword [ecx + 4]
call ebx
jmp 0x404b44
mov ecx, edx
call eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0050a055
mov esp, ebp
pop ebp
ret 8
Function at 0x40d640
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x40d659
pop edi
pop ebx
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x40d696
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 8]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x40d692
nop word [eax + eax]
cmp esi, edx
jae 0x40d696
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x40d680
cmp esi, edx
jb 0x40d69d
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x416470
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push esi
mov esi, ecx
test edx, edx
jne 0x416485
lea eax, [edx + 0xd]
pop esi
pop ebp
ret 0xc
mov eax, edx
push edi
lea edi, [eax + 2]
nop dword [eax + eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x416490
sub eax, edi
sar eax, 1
lea eax, [eax*2 + 2]
push eax
push edx
push 1
push 0
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x4165a0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
test ebx, ebx
jne 0x4165b9
lea eax, [ebx + 0xd]
pop ebx
mov esp, ebp
pop ebp
ret 8
push esi
push edi
xor esi, esi
mov edx, ebx
nop
mov eax, edx
lea edi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4165c5
sub eax, edi
sar eax, 1
lea ecx, [eax + 1]
lea edx, [edx + ecx*2]
lea esi, [esi + ecx*2]
cmp ecx, 1
jne 0x4165c0
mov eax, dword [ebp - 4]
push esi
push ebx
push 7
push 0
push dword [ebp + 8]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x416d80
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x228
mov eax, dword [0x5a7074]
xor eax, esp
mov dword [esp + 0x224], eax
mov eax, dword [ecx + 4]
mov edx, dword [ebp + 8]
or eax, 0x2001f
push esi
push edi
push eax
push edx
push dword [ecx]
mov dword [esp + 0x28], ecx
lea ecx, [esp + 0x18]
mov dword [esp + 0x24], edx
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
call fcn.00416d10
mov esi, eax
test esi, esi
jne 0x416e77
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea eax, [esp + 0x20]
push eax
push esi
push esi
push esi
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0x100
push eax
lea eax, [esp + 0x3c]
push eax
push esi
push dword [esp + 0x28]
call edi
test eax, eax
jne 0x416e49
nop dword [eax]
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x10]
call fcn.00416d80
mov esi, eax
test esi, esi
jne 0x416e77
lea eax, [esp + 0x20]
mov dword [esp + 8], 0x100
push eax
push esi
push esi
push esi
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x3c]
push eax
push esi
push dword [esp + 0x28]
call edi
test eax, eax
je 0x416e10
mov eax, dword [esp + 0xc]
test eax, eax
je 0x416e60
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0xc], 0
push dword [esp + 0x18]
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x14], 0
call fcn.00416ff0
mov esi, eax
mov eax, dword [esp + 0xc]
test eax, eax
je 0x416e86
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x22c]
mov eax, esi
pop edi
pop esi
xor ecx, esp
call fcn.0050a055
mov esp, ebp
pop ebp
ret 4
Function at 0x417bb0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x562d26
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x5a7074]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x430], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], 0
mov dword [ebp - 0x418], 0
push 0x60
push 0
mov byte [ebp - 4], 1
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push esi
call ebx
mov edi, eax
mov dword [ebp - 0x424], edi
test edi, edi
jne 0x417c5c
push 2
push eax
push esi
call ebx
mov edi, eax
mov dword [ebp - 0x424], eax
test edi, edi
jne 0x417c5c
call fcn.00415a40
mov esi, eax
jmp 0x417d4c
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x417c7f
call fcn.00415a40
jmp 0x417d3f
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [ebp - 0x420], ebx
test ebx, ebx
jne 0x417c9d
call fcn.00415a40
jmp 0x417d3f
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov dword [ebp - 0x41c], esi
lea eax, [esi + 1]
cmp eax, esi
jae 0x417cbe
mov esi, 0x8007000e
jmp 0x417d41
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.004159f0
jmp 0x417ce8
mov dword [ebp - 4], 1
cmp dword [ebp - 0x418], 0
jne 0x417cff
mov esi, 0x8007000e
jmp 0x417d41
push esi
push dword [ebp - 0x418]
push esi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
jne 0x417d1f
call fcn.00415a40
jmp 0x417d3f
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x42c]
push dword [ebp - 0x418]
call fcn.00417a40
mov esi, eax
test edi, edi
je 0x417d4c
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x417d70
lea ecx, [ebp - 0x418]
call fcn.00415970
nop word [eax + eax]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0050a055
mov esp, ebp
pop ebp
ret 0x10
Function at 0x418300
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, ecx
call fcn.00418250
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x4183dd
mov edx, ecx
lea esi, [edx + 2]
nop dword [eax]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x418320
sub edx, esi
sar edx, 1
je 0x4183dd
push edi
mov edi, dword [ebp + 8]
push 0x83e
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
mov dword [ebp + 8], esi
test esi, esi
je 0x41839a
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp + 0xc], eax
test eax, eax
je 0x41839a
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
push edi
push 0x22
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
mov dword [ebx + 0xc], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push dword [ebp + 0xc]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push edi
push eax
push esi
call fcn.0050dc00
add esp, 0xc
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebx + 0xc]
pop edi
test eax, eax
je 0x4183dd
lea ecx, [ebp + 0xc]
mov dword [ebp + 0xc], 0
push ecx
push 1
push eax
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jne 0x4183dd
cmp dword [ebp + 0xc], eax
je 0x4183dd
push 0x10
call dword [sym.imp.gdiplus.dll_GdipAlloc]
test eax, eax
je 0x4183d8
push ecx
push dword [ebp + 0xc]
mov ecx, eax
call fcn.004188f0
jmp 0x4183da
xor eax, eax
mov dword [ebx + 0x14], eax
mov esi, dword [ebx + 0x14]
test esi, esi
je 0x418437
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], 0
push eax
push dword [esi + 4]
call dword [sym.imp.gdiplus.dll_GdipGetImageWidth]
test eax, eax
je 0x4183ff
mov dword [esi + 8], eax
mov eax, dword [ebp + 0xc]
mov esi, dword [ebx + 0x14]
mov dword [ebx + 4], eax
lea eax, [ebp + 0xc]
push eax
mov dword [ebp + 0xc], 0
push dword [esi + 4]
call dword [sym.imp.gdiplus.dll_GdipGetImageHeight]
test eax, eax
je 0x418423
mov dword [esi + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebx + 8], eax
xor eax, eax
cmp dword [ebx + 4], eax
pop esi
setg al
pop ebx
pop ebp
ret 0xc
pop esi
xor eax, eax
pop ebx
pop ebp
ret 0xc

Function at 0x418f00
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push ecx
mov ebx, edx
mov esi, 0xfa000
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x418f38
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push edi
mov edi, dword [ebp + 8]
nop dword [eax]
push 0
cmp edi, 0xfa000
lea ecx, [ebp - 8]
push ecx
cmovb esi, edi
push esi
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x418f82
cmp esi, edi
je 0x418f6d
mov eax, dword [ebp - 4]
sub edi, 0xfa000
add ebx, esi
jmp 0x418f40
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x419730
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
push ebx
xor ebx, ebx
push esi
test eax, eax
jne 0x419746
push 0x83e
jmp 0x419747
push eax
push dword [ebp + 8]
push dword [0x5bf3a4]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x419864
push esi
push dword [0x5bf3a4]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp + 8], eax
test eax, eax
je 0x419864
push edi
push esi
push dword [0x5bf3a4]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
push edi
push 0x22
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
mov dword [ebp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push dword [ebp + 8]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push edi
push eax
push esi
call fcn.0050dc00
add esp, 0xc
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov esi, dword [ebp + 0xc]
pop edi
test esi, esi
je 0x419864
lea eax, [ebp + 8]
mov dword [ebp + 8], ebx
push eax
push 1
push esi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jne 0x419815
cmp dword [ebp + 8], ebx
je 0x419815
push 0x10
call dword [sym.imp.gdiplus.dll_GdipAlloc]
mov ebx, eax
test ebx, ebx
je 0x419813
mov eax, dword [ebp + 8]
lea ecx, [ebp + 0xc]
push ecx
push eax
mov dword [ebx], vtable.Gdiplus::Bitmap.0
mov dword [ebp + 0xc], 0
call dword [sym.imp.gdiplus.dll_GdipCreateBitmapFromStream]
mov dword [ebx + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebx + 4], eax
jmp 0x419815
xor ebx, ebx
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
test ebx, ebx
je 0x419864
mov dword [ebp - 4], 0
mov eax, dword [ebx + 8]
mov dword [ebx + 8], 0
test eax, eax
jne 0x419851
push eax
lea eax, [ebp - 4]
push eax
push dword [ebx + 4]
call dword [sym.imp.gdiplus.dll_GdipCreateHBITMAPFromBitmap]
test eax, eax
je 0x419851
mov dword [ebx + 8], eax
mov eax, dword [ebx]
mov ecx, ebx
push 1
call dword [eax]
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x41a2e0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x18
mov eax, dword [0x5a7074]
xor eax, esp
mov dword [esp + 0x14], eax
push esi
push edi
mov esi, ecx
push 0xfffffffffffffff0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov ecx, eax
or ecx, 0x100
cmp eax, ecx
je 0x41a31b
push ecx
push 0xfffffffffffffff0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetWindowLongW]
push dword [esi + 4]
lea ecx, [esi + 0x28]
mov dword [esi + 0x94], 1
call fcn.0042c260
push ecx
push str.IDB_PNG2
push dword [0x5bf3a4]
lea ecx, [esi + 0x2c]
call fcn.00418300
cmp dword [esi + 0x30], 0
jle 0x41a377
mov eax, dword [esi + 0x30]
mov dword [esi + 0xa4], eax
mov eax, dword [esi + 0x34]
mov dword [esi + 0xa8], eax
mov eax, 0x4ec4ec4f
imul dword [esi + 0xa4]
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [esi + 0xa4], eax
cmp dword [0x5bf5b8], 0
mov eax, dword [0x5d0344]
je 0x41a3b7
cmp dword [eax - 0xc], 0
jne 0x41a3ae
mov edx, dword [esi + 0xdc]
xor eax, eax
test edx, edx
mov ecx, 0x5aa7b0
setne al
add eax, 0xc
test edx, edx
push eax
mov eax, 0x5add50
cmovne eax, ecx
push eax
jmp 0x41a3e7
push 0xb
push 0x5a7a50
jmp 0x41a3e7
cmp dword [eax - 0xc], 0
jne 0x41a3e0
mov ecx, dword [esi + 0xdc]
xor eax, eax
test ecx, ecx
mov edx, 0x5b3c30
setne al
add eax, 0xc
test ecx, ecx
push eax
mov eax, 0x5b71d0
cmovne eax, edx
push eax
jmp 0x41a3e7
push 0xb
push 0x5b0ed0
lea ecx, [esi + 0x28]
call fcn.0042bfb0
push 6
push 0x1b
push eax
push 0
push 0
push 0
push dword [esi + 4]
mov dword [esi + 0xc4], eax
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], 0x1b
call dword [sym.imp.USER32.dll_SetWindowPos]
lea eax, [esp + 0xc]
push eax
lea eax, [esi + 0x80]
push eax
call dword [sym.imp.USER32.dll_CopyRect]
push 0
push dword [esi + 4]
mov dword [esi + 0x90], 1
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esp + 0x1c]
mov eax, 1
pop edi
mov dword [esi + 0xd8], 0
pop esi
xor ecx, esp
call fcn.0050a055
mov esp, ebp
pop ebp
ret 4