joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4250ac
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
push 0xa
push 0x42511c
push ebx
call sub.kernel32.dll_FindResourceW
test eax, eax
je 0x425113
push eax
push ebx
call sub.kernel32.dll_LoadResource
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x425113
xor eax, eax
push ebp
push 0x42510c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_LockResource
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x425113
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FreeResource
ret
mov eax, dword [ebp - 4]
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x4252c4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x20], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x425410
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00407014
mov byte [ebp - 9], 1
mov dl, 1
mov eax, ebx
call fcn.0040a0c4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x425363
push ebx
call sub.kernel32.dll_GetModuleHandleW_1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x42531e
push 2
push 0
push ebx
call sub.kernel32.dll_LoadLibraryExW_1
mov dword [ebp - 4], eax
jmp 0x425322
mov byte [ebp - 9], 0
cmp dword [ebp - 4], 0
jne 0x425363
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x18], 0xa
call sub.kernel32.dll_GetLastError_2
lea edx, [ebp - 0x20]
call fcn.00422474
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0x11
lea eax, [ebp - 0x1c]
push eax
push 1
mov ecx, dword [0x4bdb74]
mov dl, 1
mov eax, dword [0x419fb8]
call fcn.004235a8
call fcn.00406670
xor edx, edx
push ebp
push 0x4253f3
push dword fs:[edx]
mov dword fs:[edx], esp
push 0xa
push 0x425420
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_FindResourceW
test eax, eax
je 0x4253d6
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_LoadResource
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4253d6
xor eax, eax
push ebp
push 0x4253cf
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_LockResource
mov edx, eax
mov eax, esi
call fcn.00407c4c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4253d6
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FreeResource
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4253fa
cmp byte [ebp - 9], 0
je 0x4253f2
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_FreeLibrary_2
ret

Function at 0x425af0
Capabilities:
Get geographical location

Disassembly:
push ebx
add esp, 0xfffff800
mov ebx, ecx
mov word [esp], 0
push 0x400
lea ecx, [esp + 4]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW_1
mov eax, ebx
mov edx, esp
mov ecx, 0x400
call fcn.00407ca0
add esp, 0x800
pop ebx
ret
Function at 0x44cc54
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x44ccf2
push dword fs:[eax]
mov dword fs:[eax], esp
or dl, byte [ebx + 0xc]
je 0x44ccb6
cmp byte [ebx + 0x10], 0
jne 0x44ccb6
cmp byte [ebx + 0x3c], 0
jne 0x44ccb6
mov byte [ebx + 0xe], 0
mov byte [ebx + 0xc], 0
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_ResumeThread
cmp eax, 1
je 0x44ccd7
lea edx, [ebp - 4]
mov eax, dword [0x4bdec0]
call fcn.0040aa88
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x43b5a0]
call fcn.004233a4
call fcn.00406670
jmp 0x44ccd7
lea edx, [ebp - 8]
mov eax, dword [0x4bdec0]
call fcn.0040aa88
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x43b5a0]
call fcn.004233a4
call fcn.00406670
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44ccf9
lea eax, [ebp - 8]
mov edx, 2
call fcn.00407074
ret

Function at 0x44d5f4
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0xe]
mov byte [ebp - 5], al
xor eax, eax
push ebp
push 0x44d642
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0xe], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_SuspendThread
test eax, eax
setge dl
mov eax, dword [ebp - 4]
call fcn.0044cb8c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x44d65b
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x44d664
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.0044cb8c
dec esi
jne 0x44d686
mov byte [ebx + 0xe], 0
pop esi
pop ebx
ret

Function at 0x4523e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x452432
test eax, edx
je 0x452435
movzx ecx, byte [edx]
cmp cl, byte [eax]
je 0x4523f5
movzx eax, byte [eax]
sub eax, ecx
ret
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x45241b
add ecx, 4
js 0x45240b
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 3
add ecx, ebx
jns 0x452418
movzx eax, byte [ecx + eax]
movzx edx, byte [ecx + edx]
sub eax, edx
pop ebx
pop ebx
ret
xor eax, eax
ret
test eax, eax
je 0x452441
test edx, edx
jne 0x4523e8
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret
Function at 0x461c54
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
xor edx, edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x461cbf
push dword fs:[eax]
mov dword fs:[eax], esp
push 6
lea eax, [ebp - 0x14]
push eax
push 0x1004
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetLocaleInfoW_1
lea eax, [ebp - 0x18]
lea edx, [ebp - 0x14]
mov ecx, 7
call fcn.00407ca0
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_GetACP_1
mov edx, eax
pop eax
call fcn.0041cdd4
mov word [ebp - 6], ax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x461cc6
lea eax, [ebp - 0x18]
call fcn.00407014
ret

Function at 0x464420
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
test dl, dl
je 0x464432
add esp, 0xfffffff0
call fcn.004058b0
mov dword [ebp - 0xc], ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00405288
mov eax, dword [ebp - 4]
add eax, 0xc
mov edx, dword [ebp + 8]
call fcn.004073f4
mov eax, dword [ebp + 8]
call fcn.00407bf4
push eax
xor eax, eax
mov al, byte [ebp + 0xc]
push eax
mov eax, dword [ebp - 0xc]
push eax
call fcn.0045a2f4
mov edx, dword [ebp - 4]
mov dword [edx + 8], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 8], 0
jne 0x464491
mov ecx, dword [0x4be014]
mov dl, 1
mov eax, dword [0x463f08]
call fcn.00459d60
call fcn.00406670
call sub.kernel32.dll_GetLastError_2
cmp eax, 0xb7
sete al
mov edx, dword [ebp - 4]
mov byte [edx + 4], al
mov eax, dword [ebp - 4]
cmp byte [ebp - 5], 0
je 0x4644bc
call fcn.00405908
pop dword fs:[0]
add esp, 0xc
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8
Function at 0x467070
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
test dl, dl
je 0x467082
add esp, 0xfffffff0
call fcn.004058b0
mov dword [ebp - 0xc], ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00405288
movzx edx, word [ebp + 8]
mov eax, dword [ebp - 0xc]
call fcn.0041d158
mov edx, dword [ebp - 4]
mov dword [edx + 0x10], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0xffffffff
jne 0x4670b5
call fcn.00425438
mov ax, word [ebp + 8]
and ax, 0xf
cmp ax, 2
jne 0x4670d3
mov dword [ebp - 0x10], 8
mov dword [ebp - 0x14], 1
jmp 0x4670e1
mov dword [ebp - 0x10], 2
mov dword [ebp - 0x14], 4
push 0
push 0
push 0
mov eax, dword [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
push eax
call sub.kernel32.dll_CreateFileMappingW
mov edx, dword [ebp - 4]
mov dword [edx + 0x14], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x14], 0
jne 0x467127
mov eax, dword [ebp - 4]
call fcn.00467210
mov ecx, dword [0x4bdcfc]
mov dl, 1
mov eax, dword [0x466d64]
call fcn.00459d60
call fcn.00406670
push 0
push 0
push 0
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x14]
push eax
call sub.kernel32.dll_MapViewOfFile
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x467165
mov eax, dword [ebp - 4]
call fcn.00467210
mov ecx, dword [0x4be038]
mov dl, 1
mov eax, dword [0x466e1c]
call fcn.00459d60
call fcn.00406670
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
push eax
call sub.kernel32.dll_GetFileSize
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffff
jne 0x4671a4
mov eax, dword [ebp - 0x1c]
push eax
call sub.kernel32.dll_UnmapViewOfFile
mov eax, dword [ebp - 4]
call fcn.00467210
mov ecx, dword [0x4bdf00]
mov dl, 1
mov eax, dword [0x466e1c]
call fcn.00459d60
call fcn.00406670
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.00444850
mov eax, dword [ebp - 4]
cmp byte [ebp - 5], 0
je 0x4671ca
call fcn.00405908
pop dword fs:[0]
add esp, 0xc
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4

Function at 0x46744c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x46747e
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetFileAttributesW
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x467473
test byte [ebp - 0xc], 0x10
je 0x467477
xor eax, eax
jmp 0x467479
mov al, 1
mov byte [ebp - 5], al
jmp 0x467482
mov byte [ebp - 5], 0
mov al, byte [ebp - 5]
mov esp, ebp
pop ebp
ret
Function at 0x467b44
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x467c07
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
xor eax, eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
call fcn.00407bf4
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jbe 0x467bf1
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 0x10]
call fcn.00407d78
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
call fcn.00407bf4
push eax
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x467bf1
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x20]
push eax
push 0x467c18
mov eax, dword [ebp - 0x1c]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x467bf1
cmp dword [ebp - 0x14], 0x34
jne 0x467bf1
mov byte [ebp - 9], 1
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 8]
mov esi, eax
mov edi, edx
mov ecx, 0xd
rep movsd dword es:[edi], dword [esi]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x467c0e
lea eax, [ebp - 0x1c]
call fcn.00407014
ret

Function at 0x467c88
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
test dl, dl
je 0x467c9a
add esp, 0xfffffff0
call fcn.004058b0
mov dword [ebp - 0xc], ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
call fcn.0046744c
test al, al
jne 0x467cd6
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0x11
lea eax, [ebp - 0x1c]
push eax
push 0
mov ecx, dword [0x4bdb78]
mov dl, 1
mov eax, dword [0x465eb4]
call fcn.004235a8
call fcn.00406670
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00407bf4
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x467d0d
mov ecx, dword [0x4bdcbc]
mov dl, 1
mov eax, dword [0x465eb4]
call fcn.004234d8
call fcn.00406670
mov eax, dword [ebp - 4]
add eax, 4
xor ecx, ecx
mov edx, dword [ebp - 0x14]
call fcn.00407910
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
call fcn.004078f8
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00407bf4
push eax
call sub.version.dll_GetFileVersionInfoW
call fcn.004254dc
mov eax, dword [ebp - 4]
call fcn.004686c0
mov eax, dword [ebp - 4]
cmp byte [ebp - 5], 0
je 0x467d64
call fcn.00405908
pop dword fs:[0]
add esp, 0xc
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x46d6c8
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x46d76c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
mov edx, 1
call fcn.00407d78
push 0
mov eax, dword [ebp - 0x10]
call fcn.00407bf4
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00407bf4
push eax
call sub.kernel32.dll_ExpandEnvironmentStringsW
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 0xc]
call fcn.00407d78
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x10]
call fcn.00407bf4
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00407bf4
push eax
call sub.kernel32.dll_ExpandEnvironmentStringsW
test eax, eax
setne byte [ebp - 5]
cmp byte [ebp - 5], 0
je 0x46d756
lea eax, [ebp - 0x10]
call fcn.004627cc
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
call fcn.004073f4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46d773
lea eax, [ebp - 0x10]
call fcn.00407014
ret

Function at 0x46d7b4
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov byte [ebp - 9], cl
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
test eax, eax
je 0x46d7ce
xor edx, edx
mov dword [eax], edx
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00407bf4
push eax
call sub.kernel32.dll_GetEnvironmentVariableW
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
call fcn.00407d78
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.00407bf4
push eax
mov eax, dword [ebp - 4]
call fcn.00407bf4
push eax
call sub.kernel32.dll_GetEnvironmentVariableW
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
setne byte [ebp - 0xa]
cmp byte [ebp - 0xa], 0
jne 0x46d826
mov eax, dword [ebp - 8]
call fcn.00407014
jmp 0x46d83f
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
call fcn.00407d78
cmp byte [ebp - 9], 0
je 0x46d83f
mov eax, dword [ebp - 8]
call fcn.0046d6c8
mov al, byte [ebp - 0xa]
mov esp, ebp
pop ebp
ret

Function at 0x46d848
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00407014
push 0
push 0
call sub.kernel32.dll_GetCurrentDirectoryW
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x46d892
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00407d78
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00407bf4
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GetCurrentDirectoryW
mov eax, dword [ebp - 4]
call fcn.004627cc
pop ecx
pop ecx
pop ebp
ret
Function at 0x46d898
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0x101
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00407d78
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00407bf4
push eax
call sub.advapi32.dll_GetUserNameW
test eax, eax
je 0x46d8d5
mov eax, dword [ebp - 4]
call fcn.004627cc
jmp 0x46d8dd
mov eax, dword [ebp - 4]
call fcn.00407014
pop ecx
pop ecx
pop ebp
ret

Function at 0x46e3a4
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 4], eax
mov byte [ebp - 5], 0
push 0x46e404
call sub.kernel32.dll_GetModuleHandleW_1
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x46e3f3
push 0x46e420
mov eax, dword [ebp - 0xc]
push eax
call fcn.0040c4c8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x46e3e8
mov eax, dword [ebp - 4]
push eax
call dword [ebp - 0x10]
mov byte [ebp - 5], 1
jmp 0x46e3fc
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetSystemInfo_1
jmp 0x46e3fc
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetSystemInfo_1
mov al, byte [ebp - 5]
mov esp, ebp
pop ebp
ret
Function at 0x471594
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x471794
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x28]
mov edx, 0x24
call fcn.00469e68
lea eax, [ebp - 0x28]
push eax
call sub.kernel32.dll_GetSystemInfo_1
mov eax, dword [ebp - 0x14]
mov dword [0x4bd680], eax
mov eax, dword [ebp - 0xc]
mov dword [0x4bd684], eax
mov eax, dword [ebp - 0x24]
mov dword [0x4bd688], eax
mov eax, dword [0x4be1cc]
cmp dword [eax], 2
sete byte [0x4bce25]
push 0x4717a0
call sub.kernel32.dll_GetModuleHandleW_1
lea edx, [ebp - 4]
call fcn.0046748c
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp byte [0x4bce25], 0
jne 0x471623
lea edx, [ebp - 0x5c]
mov eax, dword [ebp - 4]
call fcn.00467b44
test al, al
je 0x471623
mov eax, dword [ebp - 0x4c]
mov dword [0x5478a4], eax
jmp 0x47162a
xor eax, eax
mov dword [0x5478a4], eax
call fcn.0046ded8
and eax, 0x7f
cmp eax, 0x14
ja case.0x47163b.0
jmp dword [eax*4 + 0x471642]
mov byte [0x4bce20], 1
jmp case.0x47163b.0
mov byte [0x4bce21], 1
jmp case.0x47163b.0
mov byte [0x4bce22], 1
jmp case.0x47163b.0
mov byte [0x4bce23], 1
jmp case.0x47163b.0
mov byte [0x4bce24], 1
jmp case.0x47163b.0
mov byte [0x4bce26], 1
mov byte [0x4bce27], 1
jmp case.0x47163b.0
mov byte [0x4bce26], 1
mov byte [0x4bce28], 1
jmp case.0x47163b.0
mov byte [0x4bce26], 1
mov byte [0x4bce28], 1
mov byte [0x4bce29], 1
jmp case.0x47163b.0
mov byte [0x4bce2a], 1
jmp case.0x47163b.0
mov byte [0x4bce2b], 1
jmp case.0x47163b.0
mov byte [0x4bce2c], 1
jmp case.0x47163b.0
mov byte [0x4bce2d], 1
jmp case.0x47163b.0
mov byte [0x4bce2e], 1
jmp case.0x47163b.0
mov byte [0x4bce2f], 1
jmp case.0x47163b.0
mov byte [0x4bce30], 1
jmp case.0x47163b.0
mov byte [0x4bce31], 1
jmp case.0x47163b.0
mov byte [0x4bce32], 1
jmp case.0x47163b.0
mov byte [0x4bce33], 1
jmp case.0x47163b.0
mov byte [0x4bce34], 1
jmp case.0x47163b.0
mov byte [0x4bce35], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47179b
lea eax, [ebp - 4]
call fcn.00407014
ret
Function at 0x4801ac
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4802d7
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xa
push 0x4802e4
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FindResourceW
test eax, eax
setne al
mov edx, dword [ebp - 4]
mov byte [edx + 4], al
mov eax, dword [ebp - 4]
cmp byte [eax + 4], 0
je 0x48025f
push 0x480150
mov eax, dword [ebp - 4]
lea ecx, [eax + 0x14]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.0042516c
mov eax, dword [ebp - 4]
cmp dword [eax + 0xc], 0
jne 0x48023a
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 8]
call fcn.0046748c
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.00467388
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
add eax, 0xc
mov ecx, 0x480308
call fcn.00407e50
mov eax, dword [ebp - 4]
cmp byte [eax + 0x1d], 0
je 0x48025f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov edx, dword [eax]
call dword [edx + 0xa0]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
mov edx, dword [eax]
call dword [edx + 0xa0]
push 0xa
push 0x480314
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FindResourceW
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4802bc
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_LoadResource
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4802bc
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_SizeofResource
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_LockResource
mov edx, dword [ebp - 4]
lea ecx, [edx + 0x18]
pop edx
call fcn.0040881c
mov eax, dword [ebp - 4]
add eax, 0x18
call fcn.004627cc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4802de
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00407074
ret

Function at 0x480f5c
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 8], eax
push 0x40
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_IsBadReadPtr
test eax, eax
jne 0x480fba
mov eax, dword [ebp - 4]
cmp word [eax], 0x5a4d
jne 0x480fba
mov eax, dword [ebp - 4]
cmp dword [eax + 0x3c], 0
je 0x480fba
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
add eax, dword [ebp - 4]
mov dword [ebp - 8], eax
push 0xf8
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_IsBadReadPtr
test eax, eax
jne 0x480fb5
mov eax, dword [ebp - 8]
cmp dword [eax], 0x4550
je 0x480fba
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
pop ecx
pop ecx
pop ebp
ret