joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403a50
Capabilities:
Hash data with md5
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x496d50]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, ecx
push esi
push edi
xor edi, edi
cmp dword [ebp + 0x1c], 8
mov dword [ebx + 0x14], edi
mov dword [ebx + 0x10], edi
mov dword [ebx], 0x67452301
mov dword [ebx + 4], 0xefcdab89
mov dword [ebx + 8], 0x98badcfe
mov dword [ebx + 0xc], 0x10325476
jae 0x403a97
lea eax, [ebp + 8]
push 0x473130
push eax
lea eax, [ebp - 0x408]
push eax
call fcn.0044fd24
add esp, 0xc
test eax, eax
je 0x403ace
sub esp, 0x1c
mov edi, esp
mov ecx, 7
lea esi, [ebp + 8]
push 0x473138
rep movsd dword es:[edi], dword [esi]
call fcn.0044fd6b
add esp, 0x20
jmp 0x403b35
mov ecx, dword [ebp - 0x408]
push ecx
push 0x400
lea edx, [ebp - 0x404]
push 1
push edx
call fcn.00450072
add esp, 0x10
cmp eax, edi
je 0x403b1f
nop
lea ecx, [ebp - 0x404]
push ecx
mov esi, ebx
call fcn.004038b0
mov edx, dword [ebp - 0x408]
push edx
push 0x400
lea eax, [ebp - 0x404]
push 1
push eax
call fcn.00450072
add esp, 0x10
cmp eax, edi
jne 0x403af0
mov ecx, ebx
call fcn.00403960
mov ecx, dword [ebp - 0x408]
push ecx
call fcn.004500fc
add esp, 4
cmp dword [ebp + 0x1c], 8
jb 0x403b47
mov edx, dword [ebp + 8]
push edx
call fcn.0044e60d
add esp, 4
mov ecx, dword [ebp - 4]
pop edi
pop esi
lea eax, [ebx + 0x68]
xor ecx, ebp
pop ebx
call fcn.0044e488
mov esp, ebp
pop ebp
ret 0x1c

Function at 0x410c30
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46b338
mov eax, dword fs:[0]
push eax
push edi
mov eax, dword [0x496d50]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [esi + 0x54], 0
jne 0x410d23
mov eax, dword [ebp + 8]
push 0x40
push eax
push ecx
call fcn.0043e00c
add esp, 0xc
test eax, eax
je 0x410d23
lea edx, [esi + 8]
mov dword [esi + 0x10], edx
lea edx, [esi + 0x18]
mov dword [esi + 0x20], edx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov byte [esi + 0x50], 1
mov byte [esi + 0x4a], 0
lea edx, [esi + 0x28]
mov dword [esi + 0x30], edx
lea ecx, [esi + 0xc]
mov dword [esi + 0x14], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [ecx], 0
mov ecx, dword [esi + 0x24]
mov dword [ecx], 0
mov edx, dword [esi + 0x34]
mov dword [edx], 0
mov ecx, dword [esi + 0x10]
mov dword [ecx], 0
mov edx, dword [esi + 0x20]
mov dword [edx], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov dword [esi + 0x54], eax
mov edx, dword [0x49becc]
lea edi, [ebp + 8]
mov eax, esi
mov dword [esi + 0x4c], edx
mov dword [esi + 0x44], 0
call fcn.00411ec0
push eax
mov dword [ebp - 4], 0
call fcn.004155b0
add esp, 4
push eax
mov ecx, esi
call fcn.00410f20
mov ecx, edi
call fcn.00401f70
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
mov esp, ebp
pop ebp
ret 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
mov esp, ebp
pop ebp
ret 4
Function at 0x411dd0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46abfb
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x496d50]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
lea ecx, [esi + 4]
mov dword [esi], 0x46f604
call fcn.0043df02
push 4
mov dword [ebp - 4], 0
call fcn.0044e9d2
mov edi, eax
add esp, 4
test edi, edi
je 0x411e50
call fcn.0043a1b1
mov dword [edi], eax
call fcn.0043a06b
push 0
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.00439fa0
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x411e46
inc eax
mov dword [ebx + 4], eax
lea ecx, [ebp - 0x10]
call fcn.00439fc8
jmp 0x411e52
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42fac0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46bd12
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x496d50]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [edi], 0x48d370
mov dword [edi + 0x10], 0x48d380
mov dword [edi + 0x70], 0x48d2cc
lea esi, [edi + 0x18]
push esi
mov dword [ebp - 4], ebx
push edi
mov dword [ebp - 0x10], 1
call fcn.004310e0
mov dword [ebp - 4], 1
mov eax, dword [edi]
mov ecx, dword [eax + 4]
push esi
mov dword [edi + ecx], 0x48d36c
call fcn.00431b50
lea edx, [esi + 8]
mov dword [esi + 0x10], edx
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi], 0x48d32c
mov byte [esi + 0x50], bl
mov byte [esi + 0x49], bl
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], ebx
mov eax, dword [esi + 0x24]
mov dword [eax], ebx
mov ecx, dword [esi + 0x34]
mov dword [ecx], ebx
mov edx, dword [esi + 0x10]
mov dword [edx], ebx
mov eax, dword [esi + 0x20]
mov edx, dword [0x49df00]
mov dword [eax], ebx
mov ecx, dword [esi + 0x30]
mov dword [ecx], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x4c], edx
mov dword [esi + 0x44], ebx
mov eax, dword [ebp + 0xc]
mov byte [ebp - 4], 2
cmp dword [eax + 0x14], 8
jb 0x42fb98
mov eax, dword [eax]
push eax
mov ecx, esi
call fcn.00431190
test eax, eax
jne 0x42fbc1
mov eax, dword [edi]
mov ecx, dword [eax + 4]
mov eax, dword [ecx + edi + 0xc]
add ecx, edi
or eax, 2
cmp dword [ecx + 0x38], ebx
jne 0x42fbba
or eax, 4
push ebx
push eax
call fcn.00402d10
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x431b50
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46aa9b
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x496d50]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea ecx, [esi + 4]
mov dword [esi], 0x48d2d4
call fcn.0043df02
push 4
mov dword [ebp - 4], 0
call fcn.0044e9d2
mov edi, eax
add esp, 4
test edi, edi
je 0x431bcc
call fcn.0043a1b1
mov dword [edi], eax
call fcn.0043a06b
push 0
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.00439fa0
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x431bc2
inc eax
mov dword [ebx + 4], eax
lea ecx, [ebp - 0x10]
call fcn.00439fc8
jmp 0x431bce
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4661bb
Capabilities:
Encode data using xor

Disassembly:
div dword [ebx]
add dword [edx - 0x340e9cd5], 0x81b8d54e
jmp 0xfa45174b
lea esi, [esi + 5]
invalid
cmp eax, 0xab5a2e1f
cwde
push edi
lodsd eax, dword [esi]
mov eax, 0x228ff713
out 0x2f, eax
add eax, 0x47cee17e
pop ecx
in al, dx
push 0x31
dec esp
xor dh, byte [edi + 0xc105627]
adc ebp, dword [edi + 0x61320ca7]
fnstenv [edi - 0x6f]
je 0x4661b0
jo 0x46618f
sti
enter 0xfffffffffffffeb8, 0xffffffffffffff87
popfd
cmp byte fs:[ecx + 0x35], bh
xchg edx, eax
jp 0x8ea8cce1
mov dword [edi], ebx
jb 0x466218
invalid
aam 0xfd
xor dh, bh
cmc
cmp ecx, dword [ecx + ebp + 0x64]
xchg edi, eax
call 0x734d69db
test eax, 0x17d1de3e
jae 0x466227
jp 0x4662a3
test eax, ecx
invalid
ljmp 0x7298:0xae284d5e

Function at 0x46664f
Capabilities:
Encode data using xor

Disassembly:
rol byte [esi - 0x3e], 1
in al, 0x5f
rcl byte [ecx + ebx + 0x46], 0xd3
dec edx
iretd
loopne 0x4665f7
adc byte [eax - 0x58], bl
scasb al, byte es:[edi]
test al, 0xae
cwde
fistp word [ecx + 0x5a]
push esp
test eax, 0x91d6f3e1
mov eax, edx
mov esi, edi
cdq
jp 0x4665d8
invalid
pushal
xchg dword [ecx - 0x3f], esp
test eax, 0xd2686cf3
invalid
adc dword [ebp - 0x35], eax
in eax, 0x4c
dec ecx
cld
ja 0x4665af
int 0x59
jns 0x466632
dec edi
and byte [ebp + 0x31], ch
xchg ebp, eax
xchg esp, eax
jp 0x4665aa
test al, 0xe2
jns 0x466612
scasd eax, dword es:[edi]
jnp 0x4665d4
sar edx, 0xbd
aaa
adc esp, esi
mov edi, 0xb15bd1e1
inc ecx
cli
mov ebp, 0xbfe61337
loope 0x4665ec
pop ebx
mov cl, 0x41
inc edx
or ebx, eax
inc ebp
out 0x3f, eax
invalid
insb byte es:[edi], dx
int3
pop ss
test al, 0xe9
and eax, 0xf6bb77c4
dec ecx
push ebp
ja 0x46663d
test byte [ecx + 0x55], 0x77
hlt
add byte [edi + 0x3fa2428b], 0x8d
mov ecx, 0x99a34a2e
mov ecx, 0x33b81cd5
js 0x46660c
lea esp, [ebp - 0x47]
dec edx
mov dword [0x1cd5b999], eax
mov eax, 0x70af7833
in eax, 0x34
mov dword [ebx - 0xa], ecx
in al, dx
jo 0x466644
xor al, 0x89
dec ebx
imul ah
fcomp qword [esi]
lcall 0x737, 0x510ae498
aad 0x41
adc al, 0x77
je 0x46663e
call 0x62604d33
int1
fidivr dword [edx]
xor eax, 0x3fb3f49e
xor bl, byte [ebx*2 + 0x510b35cd]
test al, 0xb1
pop ebx
mov ebp, 0x589a9c24
imul ecx, dword [edi + 0x67], 0x4c
mov ch, 0x18
jb 0x4666af
daa
pop ss
xchg edx, eax
jle 0x4666c4
cmpsd dword [esi], dword es:[edi]
sal byte [ecx - 0x59518db8], 0xb2
lodsd eax, dword [esi]
cmp al, 0xf7
sbb dword [esi], edi
mov byte [0xf72eada9], al
sub byte [ebp + 0x48], 0x85
and al, 0x2d
das
adc byte gs:[ebp - 0x6a], al
test dword [edx + 0x2485486d], 0x10652f2d
inc ebp
xchg esi, eax
popfd
and al, 0x6b
xor byte [edi + 0x21], al
xchg esp, eax
pop edi
dec esp
and dword [ecx - 0x2301182a], edi
ljmp 0xfcf1
Function at 0x401494
Capabilities:
Execute command

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x20
call sym.___main
mov dword [esp], str.Digite_o_primeiro_valor:
call sym._printf
lea eax, [esp + 0x18]
mov dword [esp + 4], eax
mov dword [esp], 0x40507e
call sym._scanf
mov dword [esp], str.Digite_o_segundo_valor:
call sym._printf
lea eax, [esp + 0x14]
mov dword [esp + 4], eax
mov dword [esp], 0x40507e
call sym._scanf
mov dword [esp], str.Digite_o_terceiro_valor:
call sym._printf
lea eax, [esp + 0x10]
mov dword [esp + 4], eax
mov dword [esp], 0x40507e
call sym._scanf
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
imul edx, eax
mov eax, dword [esp + 0x10]
imul eax, edx
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 4], eax
mov dword [esp], str.O_volume_vale:__d_n
call sym._printf
call sym._calabreso
mov dword [esp], str.pause
call sym._system
call sym._calabreso
mov eax, 0
leave
ret
Function at 0x401000
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
xor esi, esi
call edi
test ax, ax
jge 0x401018
mov esi, 8
push 2
call edi
test ax, ax
jge 0x401024
or esi, 1
push 1
call edi
test ax, ax
jge 0x401030
or esi, 2
push 0x10
call edi
test ax, ax
jge 0x40103c
or esi, 4
push 0x12
call edi
test ax, ax
jge 0x401048
or esi, 0x20
pop edi
mov eax, esi
pop esi
ret
Function at 0x4018e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [0x814820]
test eax, eax
jne 0x4018ee
mov eax, dword [0x81481c]
movzx ecx, word [esp + 4]
push esi
push 0x7c1f90
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x401957
mov eax, dword [0x814820]
test eax, eax
jne 0x401915
mov eax, dword [0x81481c]
push edi
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x40194f
mov eax, dword [0x814820]
test eax, eax
jne 0x401932
mov eax, dword [0x81481c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
je 0x401956
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
call fcn.00401960
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
pop esi
ret
Function at 0x401ed0
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x20
push ebx
mov ebx, dword [esp + 0x28]
push ebp
mov ebp, dword [esp + 0x30]
push esi
push edi
mov edi, eax
xor esi, esi
cmp dword [edi + 0x1c8], esi
jle 0x401f24
jmp 0x401ef0
mov eax, dword [edi + 0x1c4]
mov byte [esp + 0x38], 0
mov ecx, dword [eax + esi*4]
mov edx, dword [ecx]
mov edx, dword [edx]
lea eax, [esp + 0x38]
push eax
mov eax, dword [esp + 0x40]
push eax
push ebp
push ebx
call edx
cmp byte [esp + 0x38], 0
jne 0x40209c
inc esi
cmp esi, dword [edi + 0x1c8]
jl 0x401ef0
sub ebx, 0x100
je 0x402021
sub ebx, 4
je 0x401fa4
sub ebx, 2
jne 0x402015
xor eax, eax
xor ecx, ecx
push ebp
mov word [esp + 0x3c], ax
mov word [esp + 0x3e], cx
call fcn.0056e722
mov ecx, dword [edi + 0x144]
add esp, 4
mov word [esp + 0x38], ax
mov edx, dword [ecx]
mov edx, dword [edx + 0xfc]
push reloc.WS2_32.dll_ioctlsocket
lea eax, [esp + 0x3c]
push eax
push 0x4058d0
call edx
mov esi, eax
test esi, esi
je 0x402015
mov eax, dword [esi]
mov edx, dword [eax + 0xf0]
mov ecx, esi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x18]
mov ecx, esi
call edx
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 0xc
cmp dword [edi + 0x148], 0
je 0x402015
mov ecx, dword [edi + 0x15c]
xor eax, eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov eax, dword [edi + 0x158]
mov dword [esp + 0x10], 6
mov word [esp + 0x24], bp
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], ecx
call section..text
mov word [esp + 0x26], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [edi + 0x148]
mov dword [esp + 0x18], eax
mov edx, dword [ecx]
mov edx, dword [edx + 0x108]
lea eax, [esp + 0x10]
push eax
call edx
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 0xc
cmp ebp, 9
jne 0x402015
cmp dword [edi + 0x148], 0
je 0x402085
mov ecx, dword [edi + 0x148]
mov eax, dword [ecx]
mov edx, dword [eax + 0xc8]
call edx
test al, al
je 0x402085
mov ecx, dword [edi + 0x148]
mov eax, dword [ecx]
mov edx, dword [eax + 0xd4]
call edx
test al, al
je 0x402085
mov ecx, dword [edi + 0x148]
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
push 0x7c1fe8
call edx
push eax
call fcn.0056e1da
add esp, 8
test eax, eax
je 0x402085
mov eax, dword [edi + 0x148]
cmp byte [eax + 0x10a1], 0
jne 0x402015
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setge cl
movzx edx, cl
push edx
call fcn.00404650
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x20
ret 0xc
Function at 0x4040f0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x20
push ebx
push edi
mov edi, eax
call dword [sym.imp.USER32.dll_GetFocus]
mov ecx, dword [edi]
cmp eax, ecx
je 0x404118
cmp esi, dword [edi + 0x148]
je 0x404118
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [edi + 0x148]
cmp esi, eax
je 0x404227
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
test eax, eax
je 0x404193
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 8], 0x14
mov dword [esp + 0xc], esi
call ebx
mov ecx, dword [edi + 0x148]
mov dword [esp + 0x10], eax
mov eax, dword [ecx]
mov eax, dword [eax + 0x108]
lea edx, [esp + 8]
push edx
call eax
mov ecx, dword [edi + 0x148]
push 0
push 0
push 0x7c203c
call fcn.00404af0
mov dword [edi + 0x148], 0
test esi, esi
je 0x404227
mov edx, dword [esi]
mov eax, dword [edx + 0x1c]
mov ecx, esi
call eax
cmp eax, edi
jne 0x404227
mov edx, dword [esi]
mov eax, dword [edx + 0xc8]
mov ecx, esi
call eax
test al, al
je 0x404227
mov edx, dword [esi]
mov eax, dword [edx + 0xd4]
mov ecx, esi
call eax
test al, al
je 0x404227
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [edi + 0x148], esi
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 8], 0x15
mov dword [esp + 0xc], esi
call ebx
mov ecx, dword [edi + 0x148]
mov dword [esp + 0x10], eax
mov edx, dword [ecx]
mov edx, dword [edx + 0x108]
lea eax, [esp + 8]
push eax
call edx
mov ecx, dword [edi + 0x148]
push 0
push 0
push 0x7c2050
call fcn.00404af0
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x407a60
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x73d9e6
mov eax, dword fs:[0]
push eax
sub esp, 0x1f0
mov eax, dword [0x80100c]
xor eax, esp
mov dword [esp + 0x1e8], eax
push ebx
push esi
push edi
mov eax, dword [0x80100c]
xor eax, esp
push eax
lea eax, [esp + 0x200]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebx + 4]
push 0xfffffffffffffff0
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov ecx, dword [ebx + 4]
and eax, 0xff3fffff
or eax, 0x6000000
push eax
push 0xfffffffffffffff0
push ecx
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov eax, dword [ebx + 4]
lea ecx, [esp + 0x18]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x24]
mov esi, dword [esp + 0x20]
mov eax, dword [ebx + 4]
push 0x20
sub edx, ecx
push edx
mov edx, dword [esp + 0x20]
sub esi, edx
push esi
push ecx
push edx
push 0
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, dword [ebx + 4]
lea esi, [ebx + 0x2c]
mov edi, esi
call fcn.00401820
lea eax, [ebx + 0x24]
push eax
call fcn.004047f0
xor edi, edi
mov dword [esp + 0xac], edi
mov dword [esp + 0xb0], edi
mov dword [esp + 0xb4], edi
mov byte [esp + 0x1e8], 1
mov dword [esp + 0x1ec], edi
mov dword [esp + 0x1f0], edi
mov dword [esp + 0x208], edi
mov eax, dword [ebx]
mov edx, dword [eax + 0x24]
lea ecx, [esp + 0x28]
push ecx
mov ecx, ebx
call edx
push edi
mov byte [esp + 0x20c], 1
mov ecx, dword [eax]
push esi
lea eax, [ebx + 0x28]
push eax
push edi
push ecx
mov eax, esp
mov dword [eax], ecx
lea ecx, [esp + 0xc0]
mov dword [esp + 0x28], esp
call fcn.00417260
mov byte [esp + 0x208], 0
mov ecx, dword [esp + 0x28]
lea edx, [esp + 0x2c]
mov dword [esp + 0x14], eax
cmp ecx, edx
je 0x407b9d
push ecx
call fcn.005654ab
mov eax, dword [esp + 0x18]
add esp, 4
cmp eax, edi
jne 0x407bbc
push 0x10
push 0x7c2130
push 0x7c2140
push edi
call dword [sym.imp.USER32.dll_MessageBoxW]
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push eax
mov edi, esi
call fcn.00403cd0
lea eax, [ebx + 0x20]
push eax
call fcn.00404720
mov eax, dword [ebx]
mov edx, dword [eax + 0x1c]
mov ecx, ebx
call edx
mov eax, dword [esp + 0xac]
test eax, eax
je 0x407bea
push eax
call fcn.005654ab
add esp, 4
mov eax, dword [esp + 0xb0]
test eax, eax
je 0x407bfe
push eax
call fcn.005654ab
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x200]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1e8]
xor ecx, esp
call fcn.005635df
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40b190
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x73d14b
mov eax, dword fs:[0]
push eax
sub esp, 0x8c
mov eax, dword [0x80100c]
xor eax, esp
mov dword [esp + 0x88], eax
push ebx
push esi
mov eax, dword [0x80100c]
xor eax, esp
push eax
lea eax, [esp + 0x98]
mov dword fs:[0], eax
mov edx, dword [0x80d060]
mov ebx, dword [esp + 0xa8]
push 0xffffffffffffffff
lea eax, [esp + 0x18]
xor ecx, ecx
push edx
lea esi, [esp + 0x18]
mov dword [esp + 0x18], eax
mov word [esp + 0x1c], cx
call fcn.00405f80
mov dword [esp + 0xa0], 0
test ebx, ebx
je 0x40b209
push ebx
mov eax, esi
push eax
call fcn.00405e40
mov ecx, dword [esp + 0x10]
push 0
push 0x80
push 3
push 0
push 1
push bind
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x40b285
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [edi], eax
test eax, eax
jne 0x40b248
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x14]
cmp eax, ecx
jmp 0x40b28f
push eax
mov dword [esp + 0x10], 0
call fcn.0049abdb
add esp, 4
push 0
mov ebx, eax
mov eax, dword [edi]
lea edx, [esp + 0x10]
push edx
push eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0xc]
cmp ecx, dword [edi]
je 0x40b29e
push ebx
call fcn.00563af8
add esp, 4
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x14]
cmp eax, edx
je 0x40b29a
push eax
call fcn.005654ab
add esp, 4
xor eax, eax
jmp 0x40b2b5
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x14]
cmp eax, ecx
je 0x40b2b3
push eax
call fcn.005654ab
add esp, 4
mov eax, ebx
mov ecx, dword [esp + 0x98]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x88]
xor ecx, esp
call fcn.005635df
add esp, 0x98
ret

Function at 0x40b470
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [0x814820]
push ebp
mov ebp, dword [esp + 8]
push esi
test eax, eax
jne 0x40b484
mov eax, dword [0x81481c]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x40b496
pop esi
pop ebp
ret
mov eax, dword [0x814820]
test eax, eax
jne 0x40b4a4
mov eax, dword [0x81481c]
push ebx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
jne 0x40b4c0
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop ebx
pop esi
xor eax, eax
pop ebp
ret
mov eax, dword [0x814820]
test eax, eax
jne 0x40b4ce
mov eax, dword [0x81481c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp], eax
test eax, eax
je 0x40b4ba
push edi
push eax
call fcn.0049abdb
add esp, 4
mov edi, eax
mov eax, dword [ebp]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
push edi
call fcn.005645b0
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, edi
pop edi
pop ebx
pop esi
pop ebp
ret
Function at 0x40b510
Capabilities:
Get file size
Read file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push 0
push 0x80
push 3
push 0
push 1
push bind
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40b53d
pop esi
xor eax, eax
pop ebx
pop ecx
ret
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebx], eax
test eax, eax
je 0x40b537
push edi
push eax
mov dword [esp + 0x10], 0
call fcn.0049abdb
mov edx, dword [ebx]
add esp, 4
push 0
lea ecx, [esp + 0x10]
push ecx
push edx
mov edi, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0xc]
cmp eax, dword [ebx]
je 0x40b58c
push edi
call fcn.00563af8
add esp, 4
xor edi, edi
mov eax, edi
pop edi
pop esi
pop ebx
pop ecx
ret