joyce8/EMBER2024-capa huggingface dataset:
Function at 0x529770
Capabilities:
Terminate process

Disassembly:
push ecx
mov eax, dword [esp + 8]
mov dword [esp], 1
cmp eax, 4
jbe 0x52979b
push 0x1d3
push 0x40ea7c
call fcn.0052c5c8
add esp, 8
push 0xffffffffffffffff
call fcn.0052c457
lea eax, [eax + eax*4]
push ebx
shl eax, 2
push ebp
push esi
mov ebx, dword [eax + 0x40e8d0]
mov ebp, dword [eax + 0x40e8d4]
push edi
mov eax, dword [0x4185a8]
push 3
push 0x40e504
lea esi, [eax + ebx]
lea ecx, [esi + 2]
push ecx
call fcn.0052c590
add esp, 0xc
test eax, eax
jne 0x529875
mov eax, dword [esi + 7]
cmp eax, 0xffffffff
je 0x529875
xor edx, edx
mov dl, byte [esi]
lea edi, [eax + edx + 3]
mov eax, dword [0x4185bc]
test eax, eax
je 0x5297f2
inc edi
mov ecx, dword [esp + 0x1c]
xor eax, eax
mov ax, word [esi + 0x11]
cmp eax, ecx
je 0x529808
add ebx, edi
cmp ebx, ebp
jae 0x529875
jmp 0x5297b1
push 0x180
push 0x8302
push 0x40eac4
call fcn.00531968
mov esi, eax
mov eax, dword [0x4185bc]
add esp, 0xc
test eax, eax
je 0x52982b
dec edi
mov ecx, dword [0x4185a8]
push edi
add ecx, ebx
push ecx
push esi
call fcn.0052f34a
push esi
call fcn.0052f825
push 0x40eac4
call fcn.0052c080
mov esi, dword [esp + 0x34]
push esi
call fcn.0052c52c
push 0x40eac4
call fcn.0052c52c
push esi
push 0x40eab4
call fcn.0052c561
add esp, 0x24
mov dword [esp + 0x10], 0
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x5298e0
Capabilities:
Terminate process

Disassembly:
push ecx
mov eax, dword [esp + 8]
mov dword [esp], 1
cmp eax, 4
jbe 0x52990b
push 0x222
push 0x40ea7c
call fcn.0052c5c8
add esp, 8
push 0xffffffffffffffff
call fcn.0052c457
lea eax, [eax + eax*4]
push ebx
push ebp
mov ebp, dword [esp + 0x14]
shl eax, 2
push esi
push edi
mov edi, dword [eax + 0x40e8d0]
mov ebx, dword [eax + 0x40e8d4]
mov eax, dword [0x4185a8]
push 3
push 0x40e504
lea esi, [eax + edi]
lea ecx, [esi + 2]
push ecx
call fcn.0052c590
add esp, 0xc
test eax, eax
jne 0x529984
mov eax, dword [esi + 7]
cmp eax, 0xffffffff
je 0x529984
mov ecx, dword [0x4185bc]
xor edx, edx
mov dl, byte [esi]
test ecx, ecx
lea eax, [eax + edx + 3]
je 0x52995f
inc eax
xor ecx, ecx
mov cx, word [esi + 0x11]
cmp ecx, ebp
je 0x529971
add edi, eax
cmp edi, ebx
jae 0x529984
jmp 0x529925
push ebx
push eax
push edi
call fcn.00529990
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x52ba50
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0xc]
push esi
mov esi, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push eax
push edi
push 1
push esi
call fcn.0052d27a
add esp, 0x10
cmp eax, edi
jae 0x52ba7c
push 0x40eb58
call fcn.0052bb20
add esp, 4
dec edi
js 0x52baad
mov ax, word [0x4174e8]
inc edi
mov cl, al
xor edx, edx
mov dl, byte [esi]
and ecx, 0xff
xor ecx, edx
xor edx, edx
mov dl, ah
mov ax, word [ecx*2 + 0x412bac]
xor ax, dx
inc esi
dec edi
mov word [0x4174e8], ax
jne 0x52ba86
pop edi
pop esi
ret
Function at 0x52bab0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
push ebp
push esi
mov esi, dword [esp + 0xc]
push eax
push ecx
push 1
push esi
call fcn.0052d0b9
mov ecx, dword [0x4174e4]
mov ebp, eax
add ecx, ebp
add esp, 0x10
mov dword [0x4174e4], ecx
lea ecx, [ebp - 1]
test ecx, ecx
jl 0x52bb1b
push edi
lea edi, [ecx + 1]
mov cx, word [0x4174e8]
mov dl, cl
xor eax, eax
mov al, byte [esi]
and edx, 0xff
xor edx, eax
xor eax, eax
mov al, ch
mov cx, word [edx*2 + 0x412bac]
xor cx, ax
inc esi
dec edi
mov word [0x4174e8], cx
jne 0x52baed
pop edi
mov eax, ebp
pop esi
pop ebp
ret
mov eax, ebp
pop esi
pop ebp
ret

Function at 0x52bb20
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
push eax
push 0x40e720
call fcn.0052c5c8
add esp, 8
push 1
call fcn.0052c457
nop
nop
nop
nop
nop
nop
nop

Function at 0x5470a5
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
xor ecx, ecx
cmp dword [esp + 8], ecx
push esi
jle 0x5470d2
mov esi, dword [0x41d064]
cmp esi, dword [0x44b328]
jae 0x5470d2
mov al, byte [esi]
mov byte [ecx + edx], al
inc dword [0x41d064]
inc ecx
cmp ecx, dword [esp + 0xc]
jl 0x5470b2
mov eax, ecx
dec ecx
js 0x547106
push ebx
inc ecx
push edi
mov esi, dword [0x421080]
movzx ebx, byte [edx]
mov edi, esi
and edi, 0xff
xor edi, ebx
shr esi, 8
movzx edi, word [edi*2 + 0x4210a0]
xor edi, esi
inc edx
dec ecx
mov dword [0x421080], edi
jne 0x5470da
pop edi
pop ebx
pop esi
ret 8

Function at 0x55e104
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
xor ecx, ecx
cmp dword [esp + 8], ecx
push esi
jle 0x55e131
mov esi, dword [0x41b8e4]
cmp esi, dword [0x447b88]
jae 0x55e131
mov al, byte [esi]
mov byte [ecx + edx], al
inc dword [0x41b8e4]
inc ecx
cmp ecx, dword [esp + 0xc]
jl 0x55e111
mov eax, ecx
dec ecx
js 0x55e165
push ebx
inc ecx
push edi
mov esi, dword [0x41f900]
movzx ebx, byte [edx]
mov edi, esi
and edi, 0xff
xor edi, ebx
shr esi, 8
movzx edi, word [edi*2 + 0x41f920]
xor edi, esi
inc edx
dec ecx
mov dword [0x41f900], edi
jne 0x55e139
pop edi
pop ebx
pop esi
ret 8

Function at 0x57f5b2
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
mov al, byte [ebp + 8]
mov byte [ebp - 4], al
cmp byte [ebp - 4], 1
je 0x57f627
cmp byte [ebp - 4], 0x80
je 0x57f604
cmp byte [ebp - 4], 0xff
je 0x57f5d0
jmp 0x57f64a
push 0x417c9c
call fcn.0057fc1b
add esp, 4
cmp dword [ebp + 0xc], 0
je 0x57f5f4
mov ecx, dword [ebp + 0xc]
push ecx
push 0x4180cc
call fcn.0057fc1b
add esp, 8
push 1
push 0
call fcn.0057343e
push 1
call fcn.00580af6
mov edx, dword [ebp + 0xc]
push edx
push 0x4180c0
call fcn.0057fc1b
add esp, 8
mov ax, word [0x419a2c]
add ax, 1
mov word [0x419a2c], ax
jmp 0x57f64a
mov ecx, dword [ebp + 0xc]
push ecx
push 0x4180b0
call fcn.0057fc1b
add esp, 8
mov dx, word [0x419a2e]
add dx, 1
mov word [0x419a2e], dx
mov esp, ebp
pop ebp
ret 8
Function at 0x599732
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
mov al, byte [ebp + 8]
mov byte [ebp - 4], al
cmp byte [ebp - 4], 1
je 0x5997a7
cmp byte [ebp - 4], 0x80
je 0x599784
cmp byte [ebp - 4], 0xff
je 0x599750
jmp 0x5997ca
push 0x417cac
call fcn.00599d9b
add esp, 4
cmp dword [ebp + 0xc], 0
je 0x599774
mov ecx, dword [ebp + 0xc]
push ecx
push 0x4180dc
call fcn.00599d9b
add esp, 8
push 1
push 0
call fcn.0058d461
push 1
call fcn.0059ac76
mov edx, dword [ebp + 0xc]
push edx
push 0x4180d0
call fcn.00599d9b
add esp, 8
mov ax, word [0x419a3c]
add ax, 1
mov word [0x419a3c], ax
jmp 0x5997ca
mov ecx, dword [ebp + 0xc]
push ecx
push 0x4180c0
call fcn.00599d9b
add esp, 8
mov dx, word [0x419a3e]
add dx, 1
mov word [0x419a3e], dx
mov esp, ebp
pop ebp
ret 8

Function at 0x5b3b39
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
mov al, byte [ebp + 8]
mov byte [ebp - 4], al
cmp byte [ebp - 4], 1
je 0x5b3bae
cmp byte [ebp - 4], 0x80
je 0x5b3b8b
cmp byte [ebp - 4], 0xff
je 0x5b3b57
jmp 0x5b3bd1
push 0x418ce8
call fcn.005b423b
add esp, 4
cmp dword [ebp + 0xc], 0
je 0x5b3b7b
mov ecx, dword [ebp + 0xc]
push ecx
push 0x41911c
call fcn.005b423b
add esp, 8
push 1
push 0
call fcn.005a7461
push 1
call fcn.005b5116
mov edx, dword [ebp + 0xc]
push edx
push 0x419110
call fcn.005b423b
add esp, 8
mov ax, word [0x41a9cc]
add ax, 1
mov word [0x41a9cc], ax
jmp 0x5b3bd1
mov ecx, dword [ebp + 0xc]
push ecx
push 0x419100
call fcn.005b423b
add esp, 8
mov dx, word [0x41a9ce]
add dx, 1
mov word [0x41a9ce], dx
mov esp, ebp
pop ebp
ret 8

Function at 0x5cebb9
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
mov al, byte [ebp + 8]
mov byte [ebp - 4], al
cmp byte [ebp - 4], 1
je 0x5cec2e
cmp byte [ebp - 4], 0x80
je 0x5cec0b
cmp byte [ebp - 4], 0xff
je 0x5cebd7
jmp 0x5cec51
push 0x418ce8
call fcn.005cf2bb
add esp, 4
cmp dword [ebp + 0xc], 0
je 0x5cebfb
mov ecx, dword [ebp + 0xc]
push ecx
push 0x41911c
call fcn.005cf2bb
add esp, 8
push 1
push 0
call fcn.005c24e1
push 1
call fcn.005d0196
mov edx, dword [ebp + 0xc]
push edx
push 0x419110
call fcn.005cf2bb
add esp, 8
mov ax, word [0x41a9cc]
add ax, 1
mov word [0x41a9cc], ax
jmp 0x5cec51
mov ecx, dword [ebp + 0xc]
push ecx
push 0x419100
call fcn.005cf2bb
add esp, 8
mov dx, word [0x41a9ce]
add dx, 1
mov word [0x41a9ce], dx
mov esp, ebp
pop ebp
ret 8
Function at 0x5e2fb0
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, dword [esp + 0x14]
push ebx
push ebp
push esi
mov eax, dword [eax]
push edi
test eax, eax
mov dword [esp + 0x10], eax
je 0x5e30cb
mov ebx, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
push 0
push esi
push ebp
call fcn.005ea1ab
push 0x8000
push ebx
push ebp
call fcn.005e84c5
lea eax, [ebx + 0x8000]
push 0x8000
push eax
push ebp
call fcn.005e84c5
add esi, 0x10000
mov edi, 0x416e5c
mov dword [esp + 0x40], esi
or ecx, 0xffffffff
xor eax, eax
add esp, 0x24
xor esi, esi
mov edx, 0x10000
repne scasb al, byte es:[edi]
not ecx
dec ecx
sub edx, ecx
test edx, edx
jle 0x5e305c
cmp byte [ebx], 0x2a
jne 0x5e303c
push 6
push 0x416e5c
push ebx
call fcn.005e8ad0
add esp, 0xc
test eax, eax
je 0x5e3079
inc esi
mov edi, 0x416e5c
or ecx, 0xffffffff
xor eax, eax
inc ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov eax, 0x10000
sub eax, ecx
cmp esi, eax
jl 0x5e3023
mov ebx, dword [esp + 0x20]
mov eax, dword [esp + 0x10]
dec eax
mov dword [esp + 0x10], eax
jne 0x5e2fcf
mov ecx, dword [esp + 0x24]
pop edi
mov dword [ecx], eax
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x10]
mov edi, 0x416e5c
xor eax, eax
mov dword [edx], ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov eax, dword [esp + 0x20]
mov edx, dword [0x418a60]
not ecx
dec ecx
pop edi
add ecx, esi
mov ax, word [ecx + eax]
and eax, 0xffff
mov ecx, eax
and eax, 0xfff0
and ecx, 0xf
add ecx, 0xfff0
shl ecx, 0x10
add edx, ecx
add eax, edx
mov dword [0x418ba8], eax
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov ecx, dword [esp + 0x24]
mov esi, dword [esp + 0x20]
pop edi
mov dword [ecx], eax
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x5e5d10
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0xc]
push esi
mov esi, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push eax
push edi
push 1
push esi
call fcn.005e7c54
add esp, 0x10
cmp eax, edi
jae 0x5e5d3c
push 0x416f38
call fcn.005e5de0
add esp, 4
dec edi
js 0x5e5d6d
mov ax, word [0x41c0a6]
inc edi
mov cl, al
xor edx, edx
mov dl, byte [esi]
and ecx, 0xff
xor ecx, edx
xor edx, edx
mov dl, ah
mov ax, word [ecx*2 + 0x41c0a8]
xor ax, dx
inc esi
dec edi
mov word [0x41c0a6], ax
jne 0x5e5d46
pop edi
pop esi
ret

Function at 0x5e5d70
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
push ebp
push esi
mov esi, dword [esp + 0xc]
push eax
push ecx
push 1
push esi
call fcn.005e7d8d
mov ecx, dword [0x41c09c]
mov ebp, eax
add ecx, ebp
add esp, 0x10
mov dword [0x41c09c], ecx
lea ecx, [ebp - 1]
test ecx, ecx
jl 0x5e5ddb
push edi
lea edi, [ecx + 1]
mov cx, word [0x41c0a6]
mov dl, cl
xor eax, eax
mov al, byte [esi]
and edx, 0xff
xor edx, eax
xor eax, eax
mov al, ch
mov cx, word [edx*2 + 0x41c0a8]
xor cx, ax
inc esi
dec edi
mov word [0x41c0a6], cx
jne 0x5e5dad
pop edi
mov eax, ebp
pop esi
pop ebp
ret
mov eax, ebp
pop esi
pop ebp
ret

Function at 0x5e5de0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
push eax
push 0x416f48
call fcn.005e8417
add esp, 8
push 1
call fcn.005e8b87
nop
nop
nop
nop
nop
nop
nop
Function at 0x5e7b40
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
push ebx
push ebp
push esi
push edi
push 0x8000
push eax
call fcn.005ec51f
mov ebx, eax
push ebx
call fcn.005e2110
push 0
push 0
push ebx
mov esi, eax
call fcn.005ea1ab
push esi
call fcn.005e7e75
mov ebp, dword [esp + 0x34]
mov edi, eax
push ebp
call fcn.005e84ba
push esi
push edi
push ebx
call fcn.005e84c5
add esp, 0x2c
test eax, eax
je 0x5e7bcd
push 0x180
push 0x8302
push ebp
call fcn.005ec51f
push 2
push 0x417e70
push edi
mov ebp, eax
call fcn.005e8ad0
add esp, 0x18
test eax, eax
jne 0x5e7bc4
mov ax, word [edi + 8]
shl eax, 4
sub esi, eax
add eax, edi
push esi
push eax
push ebp
call fcn.005e86bb
add esp, 0xc
push ebp
call fcn.005ea245
add esp, 4
push edi
call fcn.005e7d5e
push ebx
call fcn.005ea245
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x602f48
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x602f4e
ret

Function at 0x66bef9
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
mov al, byte [ebp + 8]
mov byte [ebp - 4], al
cmp byte [ebp - 4], 1
je 0x66bf6e
cmp byte [ebp - 4], 0x80
je 0x66bf4b
cmp byte [ebp - 4], 0xff
je 0x66bf17
jmp 0x66bf91
push 0x418ce8
call fcn.0066c5fb
add esp, 4
cmp dword [ebp + 0xc], 0
je 0x66bf3b
mov ecx, dword [ebp + 0xc]
push ecx
push 0x41911c
call fcn.0066c5fb
add esp, 8
push 1
push 0
call fcn.0065f561
push 1
call fcn.0066d4d6
mov edx, dword [ebp + 0xc]
push edx
push 0x419110
call fcn.0066c5fb
add esp, 8
mov ax, word [0x41a9cc]
add ax, 1
mov word [0x41a9cc], ax
jmp 0x66bf91
mov ecx, dword [ebp + 0xc]
push ecx
push 0x419100
call fcn.0066c5fb
add esp, 8
mov dx, word [0x41a9ce]
add dx, 1
mov word [0x41a9ce], dx
mov esp, ebp
pop ebp
ret 8
Function at 0x401363
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x401378
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x40138a
xor eax, eax
jmp 0x4013bc
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
add eax, esi
and ecx, 0xf
jbe 0x4013ae
cmp esi, eax
jae 0x401386
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x4013a0
cmp esi, eax
jae 0x401386
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop ebp
ret

Function at 0x401f37
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [esp + 0xc]
push eax
push 4
push 0
push dword [esp + 0x14]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
ret 8

Function at 0x401f51
Capabilities:
Set registry value

Disassembly:
push esi
push dword [esp + 0xc]
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push dword [esp + 0x10]
push dword [esp + 0x18]
push 0
push dword [esp + 0x18]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop esi
ret 0xc

Function at 0x401f7a
Capabilities:
Set registry value

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
mov ebx, ecx
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
add esi, eax
add edi, eax
cmp eax, 1
jne 0x401f85
push edi
push dword [esp + 0x18]
push 7
push 0
push dword [esp + 0x20]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebx
ret 8

Function at 0x4025c8
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x94]
sub esp, 0x114
mov eax, dword [0x440290]
push ebx
push esi
push 0x2001f
push dword [ebp + 0x9c]
mov ebx, ecx
push dword [ebx]
xor esi, esi
lea ecx, [ebp - 0x74]
mov dword [ebp + 0x90], eax
mov dword [ebp - 0x74], esi
call fcn.00401f02
cmp eax, esi
jne 0x402650
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
jmp 0x402619
lea eax, [ebp - 0x70]
push eax
call fcn.004025c8
cmp eax, esi
jne 0x40264f
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x70]
push eax
push esi
push dword [ebp - 0x74]
mov dword [ebp - 0x78], 0x100
call edi
test eax, eax
lea ecx, [ebp - 0x74]
je 0x40260c
call fcn.00401e9d
push dword [ebp + 0x9c]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
pop edi
lea ecx, [ebp - 0x74]
mov esi, eax
call fcn.00401e9d
mov ecx, dword [ebp + 0x90]
mov eax, esi
pop esi
pop ebx
call fcn.0040fd5d
add ebp, 0x94
leave
ret 4
Function at 0x40c9c7
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
je 0x40ca1a
call fcn.0042c74b
mov edi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, ebx
je 0x40ca1a
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebx
mov dword [ebp - 8], eax
jne 0x40ca10
xor eax, eax
jmp 0x40cb33
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], ebx
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0xc], 1
je 0x40ca4a
mov eax, dword [esi]
push edi
push dword [ebp - 4]
mov ecx, esi
push ebx
call dword [eax + 0x1c]
cmp dword [ebp - 8], 0
mov dword [ebp - 0xc], eax
je 0x40ca4a
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebx + 0x48]
test eax, eax
je 0x40cb30
mov ecx, dword [eax + 0x40]
and dword [ebp + 0xc], 0
test ecx, ecx
mov dword [ebp + 8], ecx
mov dword [ebp - 8], ecx
je 0x40ca77
lea ecx, [eax + 0x3c]
lea eax, [ebp + 8]
push eax
call fcn.0040652f
mov eax, dword [eax]
mov dword [ebp + 0xc], eax
xor eax, eax
cmp dword [edi + 8], eax
mov dword [ebp - 4], eax
jbe 0x40cb30
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x40cac0
mov ecx, dword [ecx + 4]
mov edx, dword [edi + 0xc]
mov ecx, dword [ecx + 0x28]
cmp ecx, dword [edx + eax*8]
jne 0x40cac0
mov eax, dword [ebp + 8]
test eax, eax
mov dword [ebp - 8], eax
je 0x40caba
mov ecx, dword [ebx + 0x48]
lea eax, [ebp + 8]
add ecx, 0x3c
push eax
call fcn.0040652f
mov eax, dword [eax]
mov dword [ebp + 0xc], eax
jmp 0x40cb20
and dword [ebp + 0xc], 0
jmp 0x40cb20
mov ecx, dword [edi + 0xc]
shl eax, 3
cmp dword [eax + ecx], 0
mov dword [ebp - 0x10], eax
je 0x40cb20
push 0xc
call fcn.004212f7
mov esi, eax
test esi, esi
pop ecx
je 0x40cb02
mov eax, dword [edi + 0xc]
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebx + 0x1c]
add eax, edx
push dword [eax]
mov edi, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
and dword [esi + 4], 0
mov dword [esi + 8], edi
mov edi, dword [ebp + 0x10]
mov dword [esi], eax
jmp 0x40cb04
xor esi, esi
mov ecx, dword [ebx + 0x48]
add ecx, 0x3c
cmp dword [ebp - 8], 0
push esi
je 0x40cb1b
push dword [ebp - 8]
call fcn.0041c5b7
jmp 0x40cb20
call fcn.0041c58e
mov eax, dword [ebp - 4]
inc eax
cmp eax, dword [edi + 8]
mov dword [ebp - 4], eax
jb 0x40ca85
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x410d62
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.00410fa0
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x410dfd
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x44323c]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x410dfd
cmp eax, 1
je 0x410e1e
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x410dfd
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x410dca
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x410df9
xor eax, eax
inc eax
jmp 0x410e3d
cmp edi, eax
jae 0x410e01
xor eax, eax
jmp 0x410e3d
cmp eax, esi
jae 0x410e08
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x44323c]
jmp 0x410e21
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4114cf
Capabilities:
Terminate process

Disassembly:
push 8
push 0x4361e0
call fcn.00410e48
push 8
call fcn.004148ef
pop ecx
xor edi, edi
mov dword [ebp - 4], edi
xor esi, esi
inc esi
cmp dword [0x44327c], esi
jne 0x411503
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x443278], esi
mov al, byte [ebp + 0x10]
mov byte [0x443274], al
cmp dword [ebp + 0xc], edi
jne 0x41154d
cmp dword [0x444b2c], edi
je 0x41153d
mov eax, dword [0x444b28]
sub eax, 4
mov dword [0x444b28], eax
cmp eax, dword [0x444b2c]
jb 0x41153d
mov eax, dword [eax]
cmp eax, edi
je 0x41151e
call eax
jmp 0x41151e
push 0x43f09c
mov eax, 0x43f094
call fcn.0041144d
pop ecx
push 0x43f0a8
mov eax, 0x43f0a0
call fcn.0041144d
pop ecx
or dword [ebp - 4], 0xffffffff
call 0x41157e
cmp dword [ebp + 0x10], edi
jne 0x41158c
mov dword [0x44327c], esi
push dword [ebp + 8]
call fcn.0041140b
xor edi, edi
xor esi, esi
inc esi
cmp dword [ebp + 0x10], edi
je 0x41158b
push 8
call fcn.0041483a
pop ecx
ret
call fcn.00410e83
ret
Function at 0x411637
Capabilities:
Accept command line arguments
Parse pe header
Terminate process

Disassembly:
push 0x60
push 0x4361f0
call fcn.00410e48
mov edi, 0x94
mov eax, edi
call fcn.00410fa0
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x44323c], ecx
mov eax, dword [esi + 4]
mov dword [0x443248], eax
mov edx, dword [esi + 8]
mov dword [0x44324c], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x443240], esi
cmp ecx, 2
je 0x411697
or esi, 0x8000
mov dword [0x443240], esi
shl eax, 8
add eax, edx
mov dword [0x443244], eax
xor esi, esi
push esi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x4116d2
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4116d2
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x4116ea
cmp eax, 0x20b
je 0x4116d7
mov dword [ebp - 0x1c], esi
jmp 0x4116fe
cmp dword [ecx + 0x84], 0xe
jbe 0x4116d2
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x4116f8
cmp dword [ecx + 0x74], 0xe
jbe 0x4116d2
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push 1
call fcn.0041493a
pop ecx
test eax, eax
jne 0x411712
push 0x1c
call fcn.00411613
pop ecx
call fcn.00412db6
test eax, eax
jne 0x411723
push 0x10
call fcn.00411613
pop ecx
call fcn.00415935
mov dword [ebp - 4], esi
call fcn.00416125
test eax, eax
jge 0x41173c
push 0x1b
call fcn.004115ee
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x444b20], eax
call fcn.00416003
mov dword [0x443280], eax
call fcn.00415f61
test eax, eax
jge 0x411762
push 8
call fcn.004115ee
pop ecx
call fcn.00415d2e
test eax, eax
jge 0x411773
push 9
call fcn.004115ee
pop ecx
push 1
call fcn.00411465
pop ecx
mov dword [ebp - 0x28], eax
cmp eax, esi
je 0x411789
push eax
call fcn.004115ee
pop ecx
mov dword [ebp - 0x44], esi
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.00415cd1
mov dword [ebp - 0x20], eax
test byte [ebp - 0x44], 1
je 0x4117aa
movzx eax, word [ebp - 0x40]
jmp 0x4117ad
push 0xa
pop eax
push eax
push dword [ebp - 0x20]
push esi
push esi
call edi
push eax
call fcn.0041be8e
mov edi, eax
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x1c], esi
jne 0x4117cb
push edi
call fcn.00411592
call fcn.004115b4
jmp 0x4117fd
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call fcn.00410e83
ret