joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b6c0
Capabilities:
Get graphical window text
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x423b1c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push esi
push edi
push 0x208
push 0
push eax
call fcn.00401027
add esp, 0xc
lea ecx, [ebp - 0x210]
call fcn.00403290
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
jle 0x40b75a
push 0x41f7ac
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x214]
call fcn.004032c0
push eax
push 0x41f7a8
lea ecx, [ebp - 0x210]
call fcn.00403780
mov ecx, eax
call fcn.004039f0
mov ecx, eax
call fcn.00403780
lea ecx, [ebp - 0x214]
call fcn.00403ca0
jmp 0x40b76a
push 0x41f7b0
lea ecx, [ebp - 0x210]
call fcn.00403b90
mov eax, dword [0x424dbc]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 0x210
push eax
call edi
test eax, eax
je 0x40b7c5
mov eax, dword [0x424dbc]
lea ecx, [ebp - 0x214]
add eax, 0x210
push eax
call fcn.004032c0
push eax
lea ecx, [ebp - 0x210]
call fcn.004034d0
lea ecx, [ebp - 0x214]
mov esi, eax
call fcn.00403ca0
test esi, esi
je 0x40b7c5
mov eax, dword [0x424dbc]
mov dword [eax + 0xa10], 1
jmp 0x40b7f1
lea ecx, [ebp - 0x210]
call fcn.00403320
push eax
mov eax, dword [0x424dbc]
add eax, 0x210
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, dword [0x424dbc]
mov dword [eax + 0xa10], 0
mov ecx, dword [0x424dbc]
push 0
push 0x80
push 4
push 0
push 1
push 4
lea ecx, [ecx + 0xc]
call fcn.00403320
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ecx, dword [0x424dbc]
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ecx + 4], eax
mov eax, dword [0x424dbc]
cmp dword [eax + 0xa10], 0
jne 0x40b8a5
push 0
add eax, 8
push eax
push 0x41f7a0
call edi
push eax
mov eax, dword [0x424dbc]
push 0x41f7a0
push dword [eax + 4]
call esi
mov eax, dword [0x424dbc]
lea ecx, [ebp - 0x210]
push 0
add eax, 8
push eax
call fcn.00403390
add eax, eax
lea ecx, [ebp - 0x210]
push eax
call fcn.00403320
push eax
mov eax, dword [0x424dbc]
push dword [eax + 4]
call esi
mov eax, dword [0x424dbc]
push 0
add eax, 8
push eax
push 0x41f7a0
call edi
push eax
mov eax, dword [0x424dbc]
push 0x41f7a0
push dword [eax + 4]
call esi
mov eax, dword [0x424dbc]
push 0
add eax, 8
push eax
push ebx
call edi
add eax, eax
push eax
mov eax, dword [0x424dbc]
push ebx
push dword [eax + 4]
call esi
mov eax, dword [0x424dbc]
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x210]
call fcn.00403ca0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401000
mov esp, ebp
pop ebp
ret

Function at 0x40c5d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
call fcn.00410bb0
push 0xc
call fcn.00407e80
mov ecx, dword [ebp + 8]
add esp, 4
mov edx, dword [ebp + 0xc]
mov dword [eax + 8], ecx
lea ecx, [esi + 0x20]
push ecx
push 0
push eax
push 0x410170
push 0
push 0
mov dword [eax + 4], edx
mov dword [eax], esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x1c], eax
pop esi
pop ebp
ret 8
Function at 0x40f940
Capabilities:
Decode data using base64 via winapi

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1fc4
call fcn.004010b0
mov eax, dword [0x423b1c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
push edi
mov dword [ebp - 0x1fb8], eax
mov dword [ebp - 0x1fa8], 0x1fa0
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push 0x1fa0
mov esi, eax
lea eax, [ebp - 0x1fa4]
push 0
push eax
call fcn.00401027
add esp, 0xc
lea eax, [ebp - 0x1fa8]
push 0
push 0
push eax
lea eax, [ebp - 0x1fa4]
push eax
push 1
push esi
push edi
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
lea eax, [ebp - 0x1fa4]
mov dword [ebp - 0x1fc4], 0
mov dword [ebp - 0x1fc0], eax
mov eax, dword [ebp - 0x1fa8]
mov dword [ebp - 0x1fbc], eax
lea eax, [ebp - 0x1fb4]
push 0
push eax
lea eax, [ebp - 0x1fc4]
mov dword [ebp - 0x1fb0], 0
push eax
mov eax, dword [ebx + 0x68]
mov dword [ebp - 0x1fac], 0
mov dword [ebp - 0x1fb4], 0
call eax
mov eax, dword [ebp - 0x1fb0]
mov ecx, dword [ebp - 0x1fac]
push 0x3000
mov byte [ecx + eax], 0
mov eax, dword [ebp - 0x1fac]
inc eax
push eax
call fcn.00407d40
mov ecx, dword [ebp - 0x1fb8]
add esp, 0x14
push dword [ebp - 0x1fb0]
mov dword [ecx], eax
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401000
mov esp, ebp
pop ebp
ret 8
Function at 0x4105d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x423b1c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push edi
mov edi, dword [ebp + 0xc]
push 0x104
push 0
push eax
mov dword [ebp - 0x214], 1
call fcn.00401027
add esp, 0xc
lea eax, [ebp - 0x20c]
push str.SoftwareMicrosoftWindowsCurrentVersionApp_Paths_
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push esi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x210]
push eax
push 1
push 0
lea eax, [ebp - 0x20c]
push eax
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41068c
lea eax, [ebp + 0x10]
push eax
push edi
lea eax, [ebp - 0x214]
push eax
push 0
push str.Path
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401000
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.00401000
mov esp, ebp
pop ebp
ret

Function at 0x4106d0
Capabilities:
Encrypt data using dpapi

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2018
call fcn.004010b0
mov eax, dword [0x423b1c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
push edi
lea edi, [esi - 1]
push edi
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ecx, 1
mov dword [ebp - 0x2008], eax
cmp esi, ecx
jle 0x410725
mov edx, dword [ebp + 8]
mov edi, eax
mov al, byte [ecx + edx]
mov byte [edi + ecx - 1], al
inc ecx
cmp ecx, esi
jl 0x410710
mov eax, dword [ebp - 0x2008]
lea edi, [esi - 1]
mov dword [ebp - 0x200c], eax
lea eax, [ebp - 0x2018]
push eax
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x2010]
mov dword [ebp - 0x2010], edi
push eax
call sub.CRYPT32.dll_CryptUnprotectData
test eax, eax
je 0x41077f
xor ecx, ecx
test esi, esi
jle 0x410776
mov edi, dword [ebp - 0x2014]
lea edx, [ebp - 0x2004]
movzx eax, byte [edi + ecx]
lea edx, [edx + 2]
add ecx, 2
mov word [edx - 2], ax
cmp ecx, esi
jl 0x410764
lea eax, [ebp - 0x2004]
push eax
jmp 0x410784
push str.Could_not_decrypt
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401000
mov esp, ebp
pop ebp
ret
Function at 0x410d10
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
push esi
push edi
mov edi, ecx
push 0x14
mov dword [edi + 0x3d4], eax
call fcn.00407e80
add esp, 4
mov dword [ebp - 8], 0
mov esi, eax
mov dword [ebp - 4], 0
lea eax, [ebp + 0x14]
mov ecx, esi
push eax
call fcn.004031f0
mov ecx, dword [ebp + 0x18]
lea eax, [ebp + 0xc]
mov dword [esi + 4], ecx
lea ecx, [esi + 8]
push eax
call fcn.004031f0
mov eax, dword [ebp + 0x10]
mov dword [esi + 0xc], eax
lea eax, [ebp - 4]
push eax
push 0
push esi
push 0x410da0
push 0
push 0
mov dword [esi + 0x10], edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 8], eax
pop edi
pop esi
test eax, eax
je 0x410d89
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp + 0xc]
call fcn.00403280
lea ecx, [ebp + 0x14]
call fcn.00403280
mov esp, ebp
pop ebp
ret 0x14

Function at 0x4111d0
Capabilities:
Terminate thread

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [esi + 0x3d8]
call fcn.00414dd0
mov eax, dword [esi + 0x3c4]
mov edi, dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x411203
push 0
push eax
call edi
push dword [esi + 0x3c4]
call ebx
mov dword [esi + 0x3c4], 0
mov eax, dword [esi + 0x3cc]
test eax, eax
je 0x411224
push 0
push eax
call edi
push dword [esi + 0x3cc]
call ebx
lea ecx, [esi + 4]
mov dword [esi + 0x3cc], 0
call fcn.00406cd0
lea ecx, [esi + 0x1e4]
call fcn.00406cd0
pop edi
lea ecx, [esi + 0x3d8]
pop esi
pop ebx
jmp fcn.00414de0
Function at 0x4129b0
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
push esi
push 1
push str.ServicesActive
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
jne 0x4129ce
pop esi
pop ebp
ret 4
mov ecx, dword [ebp + 8]
push edi
push 0x10
call fcn.00403320
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
test edi, edi
jne 0x4129f6
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
xor eax, eax
pop esi
pop ebp
ret 4
push 0
push 0
push edi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x412a40
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x420
jne 0x412a2c
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
push edi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x412a40
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
pop edi
xor eax, eax
pop esi
pop ebp
ret 4
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
pop edi
mov eax, 1
pop esi
pop ebp
ret 4

Function at 0x412a60
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
push esi
push 1
push str.ServicesActive
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
jne 0x412a7e
pop esi
pop ebp
ret 8
mov ecx, dword [ebp + 8]
push edi
push 2
call fcn.00403320
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
test edi, edi
jne 0x412aa6
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
xor eax, eax
pop esi
pop ebp
ret 8
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push dword [ebp + 0xc]
push 0xffffffffffffffff
push edi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test eax, eax
jne 0x412ada
call esi
push edi
call esi
pop edi
xor eax, eax
pop esi
pop ebp
ret 8
call esi
push edi
call esi
pop edi
mov eax, 1
pop esi
pop ebp
ret 8
Function at 0x412f60
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp dword [esi + 0xc], 0
jne 0x412f80
lea ecx, [ebp + 8]
xor esi, esi
call fcn.00403280
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
push 0x41f9bc
lea ecx, [ebp + 8]
call fcn.00402f70
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp + 8]
call fcn.00402c00
push eax
lea ecx, [ebp + 8]
call fcn.00402bf0
push eax
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea ecx, [ebp + 8]
mov esi, eax
call fcn.00403280
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x413130
Capabilities:
Read file on windows
Read pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0
mov edi, ecx
push 0
push 0
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
je 0x41322d
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp - 4]
test eax, eax
je 0x413248
inc eax
push eax
call fcn.00407fa0
add esp, 4
mov dword [ebp - 8], 0
mov esi, eax
lea eax, [ebp - 8]
push 0
push eax
push dword [ebp - 4]
push esi
push dword [edi + 8]
call ebx
test eax, eax
je 0x41322d
mov eax, dword [ebp - 8]
lea ecx, [ebp - 0x18]
mov byte [eax + esi], 0
call fcn.00402710
push dword [ebp - 8]
lea ecx, [ebp - 0x18]
push esi
call fcn.004028e0
push esi
call fcn.00407fc0
add esp, 4
lea eax, [ebp - 0x10]
lea ecx, [ebp - 0x18]
push eax
call fcn.00402ae0
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x18]
call fcn.00402aa0
lea ecx, [ebp - 0xc]
call fcn.00402c00
push ecx
lea eax, [ebp - 0xc]
mov ecx, esp
push eax
call fcn.00403240
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 4]
lea ecx, [ebp - 0xc]
call fcn.00403280
lea ecx, [ebp - 0x10]
call fcn.00403ca0
lea ecx, [ebp - 0x18]
call fcn.00402b50
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0
push 0
push 0
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
jne 0x413165
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
je 0x413254
sub eax, 0xe8
neg eax
sbb eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4133e0
Capabilities:
Terminate thread

Disassembly:
mov dword [ecx + 0x24], 0
jmp fcn.00412fd0

Function at 0x4134f0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
push pe_nt_image_headers32
call fcn.0040105a
mov esi, eax
add esp, 4
test esi, esi
je 0x41353b
mov eax, dword [ebp + 8]
test eax, eax
je 0x41353b
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [ebp + 0xc]
push 0
push 0
push esi
push 0x413750
push 0
push 0
mov dword [esi + 0x104], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
pop esi
pop ebp
ret
push esi
call fcn.0040106e
add esp, 4
xor eax, eax
pop esi
pop ebp
ret
Function at 0x4137f0
Capabilities:
Connect socket
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov eax, dword [0x423b1c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x1a4]
push eax
push 0x202
call sub.WS2_32.dll_WSAStartup
test eax, eax
jne 0x413884
push eax
push 1
push 2
call sub.WS2_32.dll_socket
mov esi, eax
cmp esi, 0xffffffff
je 0x413884
push edi
call sub.WS2_32.dll_gethostbyname
movsx ecx, word [eax + 0xa]
push ecx
mov ecx, dword [eax + 0xc]
lea eax, [ebp - 0x10]
push dword [ecx]
push eax
call fcn.00401001
add esp, 0xc
mov eax, 2
mov word [ebp - 0x14], ax
push dword [ebp + 0xc]
call sub.WS2_32.dll_htons
mov word [ebp - 0x12], ax
lea eax, [ebp - 0x14]
push 0x10
push eax
push esi
call sub.WS2_32.dll_connect
xor ecx, ecx
test eax, eax
pop edi
cmove ecx, esi
mov eax, ecx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401000
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.00401000
mov esp, ebp
pop ebp
ret

Function at 0x4138a0
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x423b1c]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x808]
mov dword [ebp - 0x808], 0
push eax
push 0x4004667f
push dword [ebp + 8]
call sub.WS2_32.dll_ioctlsocket
cmp eax, 0xffffffff
je 0x41392b
cmp dword [ebp - 0x808], 0
je 0x41393b
push 0x800
lea eax, [ebp - 0x804]
push 0
push eax
call fcn.00401027
add esp, 0xc
lea eax, [ebp - 0x804]
push 0
push 0x800
push eax
push dword [ebp + 8]
call sub.WS2_32.dll_recv
mov dword [ebp - 0x808], eax
test eax, eax
je 0x41392b
push 0
push eax
lea eax, [ebp - 0x804]
push eax
push dword [ebp + 0xc]
call sub.WS2_32.dll_send
test eax, eax
jg 0x413943
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401000
mov esp, ebp
pop ebp
ret
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
call fcn.00401000
mov esp, ebp
pop ebp
ret

Function at 0x413b70
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x423b1c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push 0x208
push 0
push eax
call fcn.00401027
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0
push dword [ebp + 0xc]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.004032c0
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00401000
mov esp, ebp
pop ebp
ret

Function at 0x413bd0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
call fcn.00403320
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x413bf2
test al, 0x10
je 0x413bf2
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x413d10
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push esi
push edi
push 2
push 0
call fcn.00403320
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
cmp esi, 0xffffffff
je 0x413da0
push 0x10
push 1
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x413da0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x413da0
mov edx, dword [ebp + 0xc]
mov ecx, dword [edi + 0x14]
push esi
mov dword [edx], ecx
mov cx, word [edi + 0x1a]
mov word [edx + 4], cx
mov ax, word [edi + 0x18]
mov word [edx + 6], ax
mov eax, dword [edi + 0x28]
and eax, 1
mov dword [edx + 8], eax
mov eax, dword [edi + 0x28]
shr eax, 1
and eax, 1
mov dword [edx + 0xc], eax
mov eax, dword [edi + 0x28]
shr eax, 3
and eax, 1
mov dword [edx + 0x10], eax
mov eax, dword [edi + 0x28]
shr eax, 5
and eax, 1
mov dword [edx + 0x14], eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, 1
pop esi
pop ebp
ret
pop edi
xor eax, eax
pop esi
pop ebp
ret

Function at 0x4145a0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push 0
push 0
push 1
push 0
push dword [ebp + 0xc]
mov esi, ecx
push dword [ebp + 8]
lea ecx, [esi + 4]
call fcn.00403320
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 8], eax
cmp eax, 0xffffffff
jne 0x414629
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x50
jne 0x414629
push 0
push 0
push 3
push 0
push dword [ebp + 0xc]
lea ecx, [esi + 4]
mov dword [esi + 8], 0
push dword [ebp + 8]
call fcn.00403320
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 8], eax
cmp eax, 0xffffffff
je 0x41461a
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esi + 0x14], eax
mov eax, 1
pop edi
pop esi
pop ebp
ret 8
pop edi
mov dword [esi + 8], 0
xor eax, eax
pop esi
pop ebp
ret 8
xor eax, eax
cmp dword [esi + 8], 0xffffffff
pop edi
setne al
pop esi
pop ebp
ret 8

Function at 0x414640
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push esi
push 0
push 0
push 3
push 0
push dword [ebp + 0xc]
mov esi, ecx
push dword [ebp + 8]
lea ecx, [esi + 4]
call fcn.00403320
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 8], eax
cmp eax, 0xffffffff
je 0x414681
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esi + 0x14], eax
mov eax, 1
pop esi
pop ebp
ret 8
mov dword [esi + 8], 0
xor eax, eax
pop esi
pop ebp
ret 8

Function at 0x414690
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push dword [ebp + 8]
mov edi, ecx
lea ecx, [edi + 4]
call fcn.00403b40
push 0
push 0
push 3
push 0
push dword [ebp + 0x10]
lea ecx, [edi + 4]
push dword [ebp + 0xc]
call fcn.00403320
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [edi + 8], eax
cmp eax, 0xffffffff
je 0x4146de
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [edi + 0x14], eax
mov eax, 1
pop edi
pop esi
pop ebp
ret 0xc
mov dword [edi + 8], 0
xor eax, eax
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x4146f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
cmp dword [esi], 0
je 0x414706
lea ecx, [esi + 0xc]
call fcn.00414eb0
push dword [ebp + 0xc]
mov dword [ebp - 4], 0
push 0
push 0
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, dword [ebp + 8]
lea eax, [ebp - 4]
push 0
push eax
push dword [ecx + 4]
call fcn.00402a00
push eax
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [esi], 0
mov ebx, eax
je 0x414747
lea ecx, [esi + 0xc]
call fcn.00414ed0
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x414760
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, ecx
cmp dword [ebx], 0
je 0x414774
lea ecx, [ebx + 0xc]
call fcn.00414eb0
push esi
mov esi, dword [ebp + 0xc]
push edi
push 0x3000
push esi
mov dword [ebp - 4], 0
call fcn.00407d60
add esp, 8
mov edi, eax
push dword [ebp + 0x10]
push 0
push 0
push dword [ebx + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 4]
push eax
push esi
push edi
push dword [ebx + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp + 8]
push esi
push edi
mov dword [ebp + 0xc], eax
call fcn.004028e0
push edi
call fcn.00407e60
add esp, 4
cmp dword [ebx], 0
pop edi
pop esi
je 0x4147d6
lea ecx, [ebx + 0xc]
call fcn.00414ed0
mov eax, dword [ebp + 0xc]
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4150e0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov eax, 0x5a4d
mov dword [esi + 0x20], edi
cmp word [edi], ax
jne 0x41520e
mov eax, dword [edi + 0x3c]
add eax, edi
cmp dword [eax], 0x4550
jne 0x41520e
movzx ecx, word [eax + 4]
mov edx, 0x14c
cmp cx, dx
jne 0x41518e
mov dword [esi + 0x40], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x24], eax
push dword [eax + 0x54]
push edi
call fcn.004028e0
mov ecx, dword [esi + 0x24]
mov dword [ebp + 8], 0
movzx eax, word [ecx + 0x14]
lea ebx, [ecx + 0x18]
add ebx, eax
xor eax, eax
cmp ax, word [ecx + 6]
jae 0x4151fb
sub esp, 0x30
mov ecx, esp
push 1
push ebx
push edi
call fcn.004164e0
lea ecx, [esi + 0x2c]
call fcn.00415490
mov eax, dword [esi + 0x24]
add ebx, 0x28
mov ecx, dword [ebp + 8]
inc ecx
mov dword [ebp + 8], ecx
movzx eax, word [eax + 6]
cmp ecx, eax
jl 0x415150
mov dword [esi + 0x3c], 1
mov eax, 1
pop edi
pop esi
pop ebx
pop ebp
ret 4
mov edx, 0x8664
cmp cx, dx
jne 0x4151fb
mov dword [esi + 0x40], 0
lea ecx, [esi + 0x18]
mov dword [esi + 0x28], eax
push dword [eax + 0x54]
push edi
call fcn.004028e0
mov ecx, dword [esi + 0x28]
mov dword [ebp + 8], 0
movzx eax, word [ecx + 0x14]
lea ebx, [ecx + 0x18]
add ebx, eax
xor eax, eax
cmp ax, word [ecx + 6]
jae 0x4151fb
nop dword [eax]
sub esp, 0x30
mov ecx, esp
push 1
push ebx
push edi
call fcn.004164e0
lea ecx, [esi + 0x2c]
call fcn.00415490
mov eax, dword [esi + 0x28]
add ebx, 0x28
mov ecx, dword [ebp + 8]
inc ecx
mov dword [ebp + 8], ecx
movzx eax, word [eax + 6]
cmp ecx, eax
jl 0x4151d0
mov dword [esi + 0x3c], 1
mov eax, 1
pop edi
pop esi
pop ebx
pop ebp
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 4

Function at 0x415620
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
xorps xmm0, xmm0
movlpd qword [ebp - 8], xmm0
cmp word [ecx], ax
jne 0x415677
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x415677
movzx ecx, word [eax + 4]
mov edx, 0x8664
cmp cx, dx
jne 0x415662
mov ecx, dword [eax + 0x30]
mov edx, dword [eax + 0x34]
mov eax, ecx
mov esp, ebp
pop ebp
ret
mov edx, 0x14c
cmp cx, dx
jne 0x415677
mov ecx, dword [eax + 0x34]
xor edx, edx
mov eax, ecx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 8]
mov eax, ecx
mov edx, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x415690
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4156b2
mov ecx, dword [eax + 0x3c]
add ecx, eax
xor eax, eax
cmp dword [ecx], 0x4550
cmove eax, ecx
pop ebp
ret
xor eax, eax
pop ebp
ret