joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403206
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
test ebx, 0xffff0000
push esi
push edi
mov edi, ecx
mov dword [edi + 0x58], ebx
jne 0x403226
cmp dword [edi + 0x54], 0
jne 0x403226
movzx eax, bx
mov dword [edi + 0x54], eax
call fcn.0040511d
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [esp + 0x18]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.004031cd
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
ret 8

Function at 0x40a1f7
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push esi
push edi
xor edi, edi
xor ebx, ebx
cmp dword [esp + 0x14], edi
mov ebp, ecx
je 0x40a23a
call fcn.0040511d
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x40a23a
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x40a255
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
push ebx
mov ecx, ebp
call fcn.00409dae
test ebx, ebx
mov esi, eax
je 0x40a253
test edi, edi
je 0x40a253
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x41153c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
and al, 0x10
mov al, 0x24
adc byte [ebx - 0x2aefdb10], dh
xor dword [eax + edx], esp
or esp, dword [eax + 0x24]
adc byte [ecx], cl
mov al, byte [0xe0ca1024]
and al, 0x10
fsub qword [ecx]
and al, 0x10
adc esp, dword [eax + 0x24]
adc byte [ecx], dl
mov al, byte [0xe0d11024]
and al, 0x10
jecxz 0x41152b
and al, 0x10
sub dl, byte [eax + 0x24]
adc byte [eax], ch
nop
and al, 0x10
call 0xfa5139e9
adc dword [eax + edx], esp
xor dword [eax + 0x24], edx
adc byte [edi], bh
and byte [eax + edx], 0xff
shl byte [eax + edx], 1
adc dword [eax + edx], esp
or byte [eax + 0x24], al
adc byte [esi - 0x80], al
and al, 0x10
push es
adc byte [eax], cl
inc eax
and al, 0x10
inc esi
and byte [eax + edx], 6
shl byte [eax + edx], 8
add byte [eax + edx], ah
xchg esi, eax
sbb ah, byte [ecx + 0x24]
adc byte [esi + 0xf], dl
arpl word [eax], dx
adc byte [eax], dl
adc al, cl
push esp
push edx
adc dword [eax - 0x17eead2a], ebp
salc
push edx
adc edx, eax
push ds
inc ebp
jne 0x4114de
sub bl, byte [edi + 0x231034cd]
fild word fs:[ebx + 0x6c]
adc eax, 0xf9e66a8
lahf
enter 0xffffffffffffdf64, 0xffffffffffffff8c
invalid
Function at 0x412521
Capabilities:
Encode data using xor

Disassembly:
dec ebp
test al, 0x78
lahf
and byte [eax], dl
adc byte [esi + 0x1034e652], dl
packuswb mm3, qword [esi + 0xf]
dec ebp
test al, 0x78
fbld tbyte [eax]
adc byte [eax], dl
test al, 0xf7
pop ss
jl 0x41253c
pushfd
adc byte [eax], dl
adc byte [esp + edi*2 + 0x78], al
les esp, [eax]
adc byte [eax], dl
inc esp
wait
sbb al, 0x2e
xor al, 0x10
test al, 0x74
xchg esi, eax
adc eax, 0x25d3610f
xor al, 0x10
mov dh, 0xd0
sahf
in eax, dx
and dl, byte [eax]
adc byte [ebp + 0x10df6648], ah
enter 0xffffffffffffd064, 0xffffffffffffffa8
je 0x4124c7
push 0x2a90671c
pushfd
invalid
jne 0x4124a8
punpcklwd mm3, dword [edi + 0x25]
xor al, 0x10
enter 0xffffffffffff9e9f, 0x7d
dec dword [edi]
invalid
punpcklwd mm2, dword [esi + 0x25]
xor al, 0x10
invalid

Function at 0xae8a14
Capabilities:
Encode data using xor

Disassembly:
xor al, al
mov al, byte [edi]
xor al, bl
mov byte [edi], al
inc edi
cmp edi, ecx
jne fcn.00ae8a14
ret
Function at 0x401a10
Capabilities:
Shutdown system

Disassembly:
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
je 0x401a95
lea ecx, [esp]
push ecx
push 0x28
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x401a95
lea edx, [esp + 4]
push edx
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x401a95
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
push 0
push 0
lea edx, [esp + 0x14]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 8]
push 0x10
push edx
push 0
push eax
mov dword [esp + 0x24], 1
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push 0
push 5
call dword [sym.imp.USER32.dll_ExitWindowsEx]
add esp, 0x1c
ret
Function at 0x402fa0
Capabilities:
Create thread
Print debug messages

Disassembly:
sub esp, 0x74
push esi
mov esi, dword [esp + 0x7c]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 2
je 0x402fc8
push str.File_handle_is_not_a_comm_handle._n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
xor eax, eax
pop esi
add esp, 0x74
ret
mov eax, dword [0x41be1c]
xor edi, edi
cmp eax, edi
je 0x402fe6
push str.Already_have_a_comm_file_open_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
xor eax, eax
pop esi
add esp, 0x74
ret
mov ecx, dword [esp + 0x88]
mov eax, dword [esp + 0x84]
mov edx, dword [esp + 0x8c]
mov dword [0x41be0c], ecx
lea ecx, [esp + 0x20]
mov dword [0x41be18], eax
mov eax, dword [esp + 0x90]
push ecx
push esi
mov dword [0x41be1c], esi
mov dword [0x41be14], edx
mov dword [0x41be10], eax
call dword [sym.imp.KERNEL32.dll_GetCommState]
lea edx, [esp + 0x3c]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetCommProperties]
mov ecx, dword [0x41be1c]
lea eax, [esp + 8]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetCommMask]
mov eax, dword [0x41be1c]
lea edx, [esp + 0xc]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetCommTimeouts]
mov edx, dword [0x41be1c]
lea ecx, [esp + 0xc]
push ecx
push edx
mov dword [esp + 0x14], 0x2710
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], edi
call dword [sym.imp.KERNEL32.dll_SetCommTimeouts]
mov edx, dword [esp + 0x28]
lea eax, [esp + 0x20]
and dh, 0xbf
push eax
push esi
mov dword [esp + 0x30], edx
call dword [sym.imp.KERNEL32.dll_SetCommState]
push edi
push edi
push 1
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
cmp eax, edi
mov dword [0x41be30], eax
jne 0x4030ce
push edi
push 0x41be34
push str.Unable_to_CreateEvent:
push edi
call dword [sym.imp.USER32.dll_MessageBoxA]
mov dword [0x41be1c], edi
pop edi
xor eax, eax
pop esi
add esp, 0x74
ret
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x41be20
push edi
push edi
push 0x403580
push edi
push edi
call esi
cmp eax, edi
mov dword [0x41be28], eax
jne 0x403113
push edi
push 0x41be34
push str.Unable_to_create_Read_thread
push edi
call dword [sym.imp.USER32.dll_MessageBoxA]
mov dword [0x41be20], edi
mov dword [0x41be1c], edi
pop edi
xor eax, eax
pop esi
add esp, 0x74
ret
push 0x41be24
push edi
push edi
push 0x4032e0
push edi
push edi
call esi
cmp eax, edi
mov dword [0x41be2c], eax
jne 0x403157
push edi
push 0x41be34
push str.Unable_to_create_Write_thread
push edi
call dword [sym.imp.USER32.dll_MessageBoxA]
call fcn.004031c0
mov dword [0x41be24], edi
mov dword [0x41be1c], edi
pop edi
xor eax, eax
pop esi
add esp, 0x74
ret
pop edi
mov eax, 1
pop esi
add esp, 0x74
ret
Function at 0x4031c0
Capabilities:
Print debug messages
Terminate thread

Disassembly:
mov eax, dword [0x41be28]
push esi
test eax, eax
je 0x403241
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.Closing_Read_Thread_n
call esi
mov eax, dword [0x41be30]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [0x41be1c]
push 0xa
push ecx
call dword [sym.imp.KERNEL32.dll_PurgeComm]
mov edx, dword [0x41be28]
push 0x2710
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x403241
push str.Read_thread_not_exiting.__Terminating_it._n
call esi
mov eax, dword [0x41be28]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [0x41be28]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x41be28], 0
mov dword [0x41be20], 0
pop esi
ret

Function at 0x403250
Capabilities:
Print debug messages
Terminate thread

Disassembly:
mov eax, dword [0x41be2c]
push esi
test eax, eax
je 0x4032d1
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.Closing_Write_Thread_n
call esi
mov eax, dword [0x41be30]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [0x41be1c]
push 5
push ecx
call dword [sym.imp.KERNEL32.dll_PurgeComm]
mov edx, dword [0x41be2c]
push 0x2710
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x4032d1
push str.Write_thread_not_exiting.__Terminating_it._n
call esi
mov eax, dword [0x41be2c]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [0x41be2c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x41be2c], 0
mov dword [0x41be24], 0
pop esi
ret
Function at 0x4033e0
Capabilities:
Print debug messages
Write file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [0x41be30]
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x1c]
push esi
mov ecx, dword [ebx + 0x10]
mov esi, dword [esp + 0x24]
push edi
xor edi, edi
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ecx
mov ecx, dword [0x41be1c]
lea edx, [esp + 0x10]
push ebx
push edx
lea eax, [edi + ebp]
push esi
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x403471
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 6
je 0x403483
cmp eax, 0x3e5
jne 0x403498
push 0xffffffffffffffff
lea edx, [esp + 0x18]
push 0
push edx
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
test eax, eax
je 0x403563
cmp eax, 1
jne 0x4034a9
mov ecx, dword [0x41be1c]
push eax
lea eax, [esp + 0x14]
push eax
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
je 0x40350e
mov eax, dword [esp + 0x10]
sub esi, eax
add edi, eax
test esi, esi
jbe 0x40356d
jmp 0x403409
push str.ERROR_INVALID_HANDLE__Likely_that_the_Service_Provider_has_closed_the_port._n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
push 0
push 0x41be34
push str.Error_to_writing_to_CommFile
jmp 0x40353a
cmp eax, 0xffffffff
push 0
push 0x41be34
je 0x4034e1
push str.Unexpected_Wait_return_value
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [0x41be18]
push 0
push 1
push 0x400
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
push str.Write_WAIT_FAILED
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [0x41be18]
push 0
push 1
push 0x400
push ecx
call dword [sym.imp.USER32.dll_PostMessageA]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 6
jne 0x40352e
push str.ERROR_INVALID_HANDLE__Likely_that_the_Service_Provider_has_closed_the_port._n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
push 0
push 0x41be34
push str.Error_writing_to_CommFile_while_waiting
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push str.Closing_TAPI_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [0x41be18]
push 0
push 1
push 0x400
push edx
call dword [sym.imp.USER32.dll_PostMessageA]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xc
ret
Function at 0x4037e0
Capabilities:
Print debug messages
Read file on windows

Disassembly:
mov eax, dword [0x41be30]
push ebx
push ebp
push esi
push edi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x4038a5
mov esi, dword [esp + 0x20]
mov edi, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
mov ebp, dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [0x41be1c]
push ebx
push esi
push 1
push edi
push ecx
call ebp
test eax, eax
je 0x40384d
mov edx, dword [esi]
push edx
push edi
call fcn.00403930
add esp, 8
test eax, eax
je 0x4038a5
mov eax, dword [0x41be30]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x40380f
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x403864
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret
cmp eax, 6
jne 0x40387b
push str.ERROR_INVALID_HANDLE__Likely_that_the_Service_Provider_has_closed_the_port._n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
push 0
push 0x41be34
push str.Unexpected_ReadFile_error:
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [0x41be18]
push 0
push 1
push 0x400
push ecx
call dword [sym.imp.USER32.dll_PostMessageA]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret

Function at 0x4038b0
Capabilities:
Print debug messages

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [0x41be1c]
push esi
mov esi, dword [esp + 0x14]
push 0
push esi
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
je 0x4038e0
mov edx, dword [esi]
mov eax, dword [esp + 0xc]
push edx
push eax
call fcn.00403930
add esp, 8
pop esi
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 6
jne 0x4038fa
push str.ERROR_INVALID_HANDLE__Likely_that_the_Service_Provider_has_closed_the_port._n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
pop esi
ret
push 0
push 0x41be34
push str.Unexpected_GetOverlappedResult_Read_Error:
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [0x41be18]
push 0
push 1
push 0x400
push ecx
call dword [sym.imp.USER32.dll_PostMessageA]
xor eax, eax
pop esi
ret

Function at 0x403930
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 8]
push esi
test eax, eax
je 0x403998
mov esi, dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 1
je 0x403954
push 0
push 0x41be34
push str.Oh_no__
push 0
call esi
mov ecx, dword [esp + 8]
mov edx, dword [0x41be10]
lea eax, [esp + 0xc]
push 0
push eax
push 1
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x403981
push eax
push 0x41be34
push str.Internal_error:_write_failed
push eax
call esi
cmp dword [esp + 0xc], 1
je 0x403998
push 0
push 0x41be34
push str.Internal_error:_write_failed
push 0
call esi
mov eax, 1
pop esi
ret
Function at 0x4039a0
Capabilities:
Print debug messages

Disassembly:
mov eax, dword [0x41be30]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ebp
push esi
push edi
push 0
push eax
call ebx
cmp eax, 0x102
jne 0x403a4f
mov esi, dword [esp + 0x18]
mov ebp, dword [esp + 0x14]
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [0x41be1c]
push ebp
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_WaitCommEvent]
test eax, eax
je 0x403a11
push str.Event__Error__waiting_before_WaitCommEvent._n
call edi
push 0
push esi
push 0
call fcn.00403a60
add esp, 0xc
test eax, eax
je 0x403a4f
mov edx, dword [0x41be30]
push 0
push edx
call ebx
cmp eax, 0x102
je 0x4039cd
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x403a28
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret
cmp eax, 6
jne 0x403a3b
push str.ERROR_INVALID_HANDLE__Likely_that_the_Service_Provider_has_closed_the_port._n
call edi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
push 0
push 0x41be34
push str.Unexpected_WaitCommEvent_error:
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
Function at 0x407160
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 0xc]
mov eax, dword [esi + 0x14]
mov dword [esi + 0xc], 0
push eax
mov dword [esi + 0x10], 0
call dword [sym.imp.KERNEL32.dll_ResetEvent]
test eax, eax
jne 0x407183
pop esi
ret
mov edx, dword [esi + 0x1c]
mov eax, dword [esi + 0x18]
push ebp
mov ebp, dword [esp + 0xc]
push edi
lea edi, [esi + 4]
lea ecx, [esp + 0x14]
push edi
push ecx
mov ecx, dword [ebp]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov esi, eax
test esi, esi
jne 0x4071dc
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x4071dc
mov al, byte [esp + 0x18]
test al, al
je 0x4071d7
mov eax, dword [ebp]
lea edx, [esp + 0x14]
push 1
push edx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov esi, eax
pop edi
pop ebp
pop esi
ret
mov esi, 1
pop edi
mov eax, esi
pop ebp
pop esi
ret

Function at 0x407370
Capabilities:
Query service status
Start service

Disassembly:
sub esp, 0x20
push ebp
push esi
push edi
xor ebp, ebp
push 0xf003f
push ebp
push ebp
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
test eax, eax
mov dword [esp + 0xc], eax
jne 0x4073a8
push eax
push str.PACKET32
push str.Could_not_open_SC
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
pop edi
mov eax, ebp
pop esi
pop ebp
add esp, 0x20
ret
mov ecx, dword [esp + 0x30]
push ebx
push 0x10
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
push 0
test esi, esi
jne 0x4073d3
push str.PACKET32
push str.Could_not_open_service
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x407443
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
mov ebp, eax
test ebp, ebp
jne 0x407403
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x420
je 0x40743e
push ebp
push str.PACKET32
push str.Could_not_start_service
push ebp
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x407443
mov edi, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
lea edx, [esp + 0x14]
push edx
push esi
call edi
test eax, eax
je 0x407443
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esp + 0x18]
sub eax, 2
jne 0x407439
push 0x7d0
call ebx
lea eax, [esp + 0x14]
push eax
push esi
call edi
test eax, eax
je 0x407443
jmp 0x40741b
sub eax, 2
jne 0x407443
mov ebp, 1
mov ecx, dword [esp + 0x10]
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ecx
call edi
test esi, esi
pop ebx
je 0x407458
push esi
call edi
pop edi
mov eax, ebp
pop esi
pop ebp
add esp, 0x20
ret
Function at 0x407490
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
mov ebx, ecx
call sub.MFC42.DLL_AfxGetModuleState
mov ecx, dword [esp + 0xc]
mov eax, dword [eax + 8]
push 2
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
mov dword [ebx], eax
jne 0x4074b5
pop esi
pop ebx
ret 4
call sub.MFC42.DLL_AfxGetModuleState
mov edx, dword [ebx]
mov eax, dword [eax + 8]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [ebx + 4], eax
jne 0x4074d3
pop esi
pop ebx
ret 4
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x4074e5
pop esi
pop ebx
ret 4
mov eax, dword [esi + 0x14]
mov ecx, dword [esi]
push ebp
push edi
lea ebp, [eax + ecx + 0x400]
push ebp
call sub.MFC42.DLL_operatornew
mov ecx, ebp
mov edi, eax
mov edx, ecx
mov dword [ebx + 8], eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
add esp, 4
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebx + 8]
pop edi
pop ebp
pop esi
mov ecx, dword [eax]
lea edx, [ecx + eax + 0x400]
mov eax, 1
mov dword [ebx + 0xc], edx
pop ebx
ret 4

Function at 0x407530
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
call esi
push 0x4231e0
mov edi, eax
call fcn.0040bb30
add esp, 4
test ax, ax
je 0x40757c
call sub.MFC42.DLL_AfxGetModuleState
mov eax, dword [eax + 4]
push 0
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x68]
call esi
sub eax, edi
cmp eax, 0x3e8
jae 0x4075c1
push 0x4231e0
call fcn.0040bb30
add esp, 4
test ax, ax
jne 0x40754e
mov edi, dword [esp + 0x10]
xor esi, esi
test edi, edi
jle 0x4075a3
push ebx
mov ebx, dword [esp + 0x10]
mov eax, dword [0x4231ec]
mov cl, byte [esi + ebx]
push eax
push ecx
call fcn.0040bef0
add esp, 8
inc esi
cmp esi, edi
jl 0x40758b
pop ebx
push 0x4231e0
call fcn.0040bb10
push 0x4231e0
call fcn.0040bba0
add esp, 8
xor eax, eax
pop edi
pop esi
ret 8
pop edi
or eax, 0xffffffff
pop esi
ret 8
Function at 0x4084e0
Capabilities:
Read .ini file

Disassembly:
mov eax, dword [0x426310]
push esi
cmp eax, 3
ja case.default.0x4084ef
jmp dword [eax*4 + 0x40876c]
call fcn.0040bc00
call fcn.004083d0
mov eax, 0xffffff9d
mov dword [0x426310], 1
mov word [0x419dd0], ax
mov dword [0x419dcc], eax
pop esi
ret
push 0x419db0
push 0x4200d8
push 0x4200f0
push 0x420038
push 0x420060
call fcn.0040b090
add esp, 0x14
cmp word [0x420102], 0x52
jne 0x408555
call fcn.004083d0
mov word [0x420102], 0x4e
push 0x420038
call fcn.0040b410
add esp, 4
test ax, ax
je 0x408572
mov word [0x419dd8], 0x14
jmp 0x4085c2
mov eax, dword [0x420074]
test eax, eax
je 0x4085b7
cmp word [0x419dd8], 0
je 0x408598
add eax, 0x1f4
dec word [0x419dd8]
mov dword [0x420074], eax
jmp 0x4085a7
push 0
call fcn.00408490
add esp, 4
mov dword [0x420074], eax
test eax, eax
jne 0x4085b7
mov dword [0x420074], 0xa
pop esi
ret
cmp eax, 0x1f4
jb case.default.0x4084ef
push 0x419db0
push 0x420038
call fcn.0040b6f0
add esp, 8
mov dword [0x426310], 2
push 0x419db0
call fcn.0040b880
push 1
call fcn.00408490
mov dword [0x420074], 0
call fcn.00408380
push 0x419db0
push 0
call fcn.0040b8c0
add esp, 0x10
mov dword [0x426310], 3
pop esi
ret
mov esi, 1
push 0x419db0
push esi
call fcn.0040b8c0
add esp, 8
test ax, ax
je 0x4086ea
push 0x419db0
push 0x420060
mov dword [0x4262ec], 0
call fcn.0040b440
movsx eax, ax
add esp, 8
cmp eax, 0xffffffa3
je 0x4086b1
test eax, eax
jne 0x408665
mov dword [0x4262ec], esi
jmp 0x408677
mov eax, dword [0x4262ec]
test eax, eax
jne 0x408677
mov word [0x419dd8], 0x14
mov eax, dword [0x419dd4]
mov dword [0x420074], esi
mov cl, byte [eax + 0xa]
mov byte [eax + 1], cl
mov eax, dword [0x419dd4]
mov dl, byte [eax + 0xb]
mov byte [eax + 2], dl
mov eax, dword [0x419dd4]
mov cl, byte [eax + 3]
inc cl
mov byte [eax + 3], cl
mov eax, dword [0x419dd4]
mov byte [eax + 4], 0
mov dword [0x426310], esi
pop esi
ret
push str.FIDIA.INI
push 0
push str.EvitaRotture
push str.LOADER
mov dword [0x420074], 0x1f4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
test eax, eax
jne 0x4086e2
push eax
push eax
push str.AAAARRGGGHHH__N._Frame_error_
call sub.MFC42.DLL_AfxMessageBox
mov dword [0x426310], esi
pop esi
ret
call fcn.004083a0
test eax, eax
je 0x40875e
mov ecx, dword [0x419dd4]
mov al, byte [ecx + 4]
cmp al, 0xa
jae 0x4086a9
inc al
push ebx
mov byte [ecx + 4], al
mov ecx, dword [0x419db8]
mov eax, 2
mov edx, 4
movsx esi, ax
cmp byte [esi + ecx], 0x10
jne 0x408720
inc eax
inc eax
dec edx
jne 0x408716
movsx edx, ax
mov eax, dword [0x419dd4]
push 0x419db0
mov al, byte [eax + 4]
mov byte [edx + ecx], al
mov ebx, dword [0x419dbc]
sub ebx, 2
mov dword [0x419dbc], ebx
call fcn.0040b3b0
push 0x419db0
call fcn.0040b880
add esp, 8
call fcn.00408380
pop ebx
mov dword [0x426310], 3
pop esi
ret