joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001f10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xe0
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [esp], eax
call sym.___wine_dbg_get_channel_flags
movzx eax, al
bt eax, esi
jae 0x100020e8
mov edi, dword [0x10007084]
xor eax, eax
mov edx, dword fs:[0x18]
cmp dword [edx + 0x24], edi
je 0x10001ff7
test byte [0x10003030], 8
jne 0x10002090
lea ebx, [ebp - 0xd4]
mov edi, ebx
test byte [0x10003040], 8
jne 0x10002050
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [esp + 4], str._04x:
mov dword [esp], edi
mov dword [esp + 8], eax
call sym._sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x10001f99
cmp esi, 3
jbe 0x10002008
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov ecx, ebx
mov edi, eax
mov esi, dword [ecx]
add ecx, 4
lea edx, [esi - 0x1010101]
not esi
and edx, esi
and edx, 0x80808080
je 0x10001faa
mov esi, edx
mov dword [esp + 0xc], edi
shr esi, 0x10
test edx, 0x8080
mov dword [esp + 4], 1
cmove edx, esi
lea esi, [ecx + 2]
mov dword [esp], ebx
cmove ecx, esi
mov eax, edx
add al, dl
sbb ecx, 3
sub ecx, ebx
mov dword [esp + 8], ecx
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0xe0
pop ebx
pop esi
pop edi
pop ebp
ret
add eax, edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 8], str._s:_s:_s
mov dword [esp], eax
mov dword [esp + 0x14], edi
mov edi, dword [ebp + 0xc]
lea edx, [edi + 1]
mov dword [esp + 0x10], edx
mov edx, dword [esi*4 + 0x100051ec]
mov dword [esp + 0xc], edx
mov edx, ebx
sub edx, eax
add edx, 0xc8
mov dword [esp + 4], edx
call sym._snprintf.constprop.0
jmp 0x10001f99
mov dword [esp], 0x10003040
call sym.___wine_dbg_get_channel_flags
test al, 8
je 0x10001f70
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov dword [esp], edi
mov dword [esp + 4], str._04x:
mov dword [esp + 8], eax
call sym._sprintf
add edi, eax
jmp 0x10001f70
mov dword [esp], 0x10003030
call sym.___wine_dbg_get_channel_flags
test al, 8
je 0x10001f5b
call dword [sym.imp.kernel32.dll_GetTickCount]
mov edx, 0x10624dd3
lea ebx, [ebp - 0xd4]
mov dword [esp + 4], str._3u._03u:
mov ecx, eax
mul edx
mov dword [esp], ebx
shr edx, 6
imul eax, edx, 0x3e8
mov dword [esp + 8], edx
sub ecx, eax
mov dword [esp + 0xc], ecx
call sym._sprintf
lea edi, [ebx + eax]
jmp 0x10001f63
mov eax, 0xffffffff
jmp 0x10001ff7
Function at 0x406e20
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0xc], 0
cmp dword [ebp + 8], 0
jne 0x406e3a
xor eax, eax
jmp 0x406f29
mov eax, dword [ebp + 8]
push eax
call fcn.00431b61
add esp, 4
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
add edx, 1
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x14]
mov cl, byte [eax]
mov byte [ebp - 1], cl
add dword [ebp - 0x14], 1
cmp byte [ebp - 1], 0
jne 0x406e58
mov edx, dword [ebp - 0x14]
sub edx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0xc], 0
jmp 0x406e8b
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp - 0x20]
jge 0x406ef4
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0xc]
movsx ecx, byte [eax]
cmp ecx, 0x5c
je 0x406eaf
mov edx, dword [ebp - 8]
add edx, dword [ebp - 0xc]
movsx eax, byte [edx]
cmp eax, 0x2f
jne 0x406ef2
mov ecx, dword [ebp - 8]
add ecx, dword [ebp - 0xc]
mov byte [ecx], 0
push 0
mov edx, dword [ebp - 8]
push edx
call fcn.00431bb1
add esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x406ee9
mov eax, dword [ebp - 8]
push eax
call fcn.00431c11
add esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x406ee9
or eax, 0xffffffff
jmp 0x406f29
mov ecx, dword [ebp - 8]
add ecx, dword [ebp - 0xc]
mov byte [ecx], 0x2f
jmp 0x406e82
push 0
mov edx, dword [ebp - 8]
push edx
call fcn.00431bb1
add esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x406f1a
mov eax, dword [ebp - 8]
push eax
call fcn.00431c11
add esp, 4
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.0043128d
add esp, 4
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret

Function at 0x406f30
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x406f4b
xor al, al
jmp 0x406f59
mov ecx, dword [ebp - 4]
and ecx, 0x10
je 0x406f57
mov al, 1
jmp 0x406f59
xor al, al
mov esp, ebp
pop ebp
ret
Function at 0x409470
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44d398
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x4679d0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x30]
cmp dword [eax + 0x40], 0
je 0x4094b0
mov ecx, dword [ebp - 0x30]
movzx edx, byte [ecx + 0x45]
test edx, edx
jne 0x4094bc
mov al, 1
jmp 0x40965f
mov dword [ebp - 0x54], 8
call fcn.00401720
push eax
mov eax, dword [ebp - 0x30]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x30]
mov eax, dword [edx + 0xc]
call eax
mov dword [ebp - 0x40], eax
call fcn.00401720
mov dword [ebp - 0x44], eax
lea ecx, [ebp - 0x40]
push ecx
lea edx, [ebp - 0x44]
push edx
call fcn.004016a0
add esp, 8
movzx eax, al
test eax, eax
je 0x4094ff
xor al, al
jmp 0x40965f
push 0
push 8
lea ecx, [ebp - 0x28]
call fcn.00404de0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x2c]
push ecx
lea edx, [ebp - 0x58]
push edx
lea ecx, [ebp - 0x28]
call fcn.004041a0
mov ecx, eax
call fcn.00406430
mov esi, eax
lea ecx, [ebp - 0x28]
call fcn.00403340
add esi, eax
push esi
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x28]
call fcn.004041a0
mov ecx, eax
call fcn.00406430
push eax
mov ecx, dword [ebp - 0x30]
add ecx, 0x48
push ecx
mov edx, dword [ebp - 0x30]
mov ecx, dword [edx + 0x40]
call fcn.00409a00
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
je 0x40957a
cmp dword [ebp - 0x3c], 1
je 0x409581
cmp dword [ebp - 0x3c], 3
je 0x40961b
jmp 0x409633
mov eax, dword [ebp - 0x30]
mov byte [eax + 0x45], 0
lea ecx, [ebp - 0x4c]
push ecx
lea ecx, [ebp - 0x28]
call fcn.004041a0
mov ecx, eax
call fcn.00406430
mov edx, dword [ebp - 0x2c]
sub edx, eax
mov dword [ebp - 0x38], edx
je 0x4095e4
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 0x50]
push ecx
mov edx, dword [ebp - 0x38]
push edx
push 1
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x28]
call fcn.004041a0
mov ecx, eax
call fcn.00406430
push eax
call fcn.00431f22
add esp, 0x10
cmp dword [ebp - 0x38], eax
je 0x4095e4
mov byte [ebp - 0x34], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.004032a0
mov al, byte [ebp - 0x34]
jmp 0x40965f
mov ecx, dword [ebp - 0x30]
movzx edx, byte [ecx + 0x45]
test edx, edx
jne 0x409607
mov byte [ebp - 0x31], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.004032a0
mov al, byte [ebp - 0x31]
jmp 0x40965f
cmp dword [ebp - 0x38], 0
jne 0x409619
push 0
push 8
lea ecx, [ebp - 0x28]
call fcn.00405760
jmp 0x40964b
mov byte [ebp - 0x33], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.004032a0
mov al, byte [ebp - 0x33]
jmp 0x40965f
mov byte [ebp - 0x32], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.004032a0
mov al, byte [ebp - 0x32]
jmp 0x40965f
jmp 0x409512
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00430a1b
mov esp, ebp
pop ebp
ret
Function at 0x40a4a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4679d0]
xor eax, ebp
mov dword [ebp - 4], eax
lea ecx, [ebp - 0xc]
call fcn.00406d40
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 0x1c], eax
push 0x45c3cc
movzx eax, word [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x10], 0
jne 0x40a4fc
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0xc]
mov dword [edx], eax
mov ecx, dword [ebp - 8]
mov dword [edx + 4], ecx
mov eax, dword [ebp + 8]
jmp 0x40a563
mov edx, dword [ebp - 0x10]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x40a526
cmp dword [ebp - 0x18], 0
ja 0x40a539
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
mov dword [ecx], edx
mov eax, dword [ebp - 8]
mov dword [ecx + 4], eax
mov eax, dword [ebp + 8]
jmp 0x40a563
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x20], eax
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
mov dword [ecx], edx
mov eax, dword [ebp - 8]
mov dword [ecx + 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00430a1b
mov esp, ebp
pop ebp
ret
Function at 0x40a580
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4679d0]
xor eax, ebp
mov dword [ebp - 4], eax
lea ecx, [ebp - 0xc]
call fcn.00406d40
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 0x1c], eax
push 2
movzx eax, word [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x10], 0
jne 0x40a5d9
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0xc]
mov dword [edx], eax
mov ecx, dword [ebp - 8]
mov dword [edx + 4], ecx
mov eax, dword [ebp + 8]
jmp 0x40a640
mov edx, dword [ebp - 0x10]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x40a603
cmp dword [ebp - 0x18], 0
ja 0x40a616
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
mov dword [ecx], edx
mov eax, dword [ebp - 8]
mov dword [ecx + 4], eax
mov eax, dword [ebp + 8]
jmp 0x40a640
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x20], eax
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
mov dword [ecx], edx
mov eax, dword [ebp - 8]
mov dword [ecx + 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00430a1b
mov esp, ebp
pop ebp
ret
Function at 0x40acb0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44d503
mov eax, dword fs:[0]
push eax
sub esp, 0x8c
mov eax, dword [0x4679d0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x94], 0
push 0x45c2ef
lea ecx, [ebp - 0x58]
call fcn.00403160
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0x98]
push eax
lea ecx, [ebp - 0x70]
push ecx
call fcn.00403020
add esp, 8
mov byte [ebp - 4], 1
push 0xc
lea ecx, [ebp - 0x28]
call fcn.00402db0
lea ecx, [ebp - 0x28]
call fcn.0040cfd0
mov byte [ebp - 4], 2
push 0x45c4f8
lea ecx, [ebp - 0x88]
call fcn.00403160
mov byte [ebp - 4], 3
lea edx, [ebp - 0x28]
push edx
lea eax, [ebp - 0x88]
push eax
lea ecx, [ebp - 0x70]
push ecx
call fcn.00402e50
add esp, 0xc
push 0xc
lea ecx, [ebp - 0x1c]
call fcn.00402db0
lea ecx, [ebp - 0x1c]
call fcn.0040cfd0
mov byte [ebp - 4], 4
mov dword [ebp - 0x8c], 0
jmp 0x40ad8e
mov edx, dword [ebp - 0x8c]
add edx, 1
mov dword [ebp - 0x8c], edx
lea ecx, [ebp - 0x28]
call fcn.00405540
cmp dword [ebp - 0x8c], eax
jae 0x40ae07
mov eax, dword [ebp - 0x8c]
push eax
lea ecx, [ebp - 0x28]
call fcn.0040d110
push eax
lea ecx, [ebp - 0x40]
call fcn.004030d0
mov byte [ebp - 4], 5
push 0x45c2f2
lea ecx, [ebp - 0x40]
push ecx
call fcn.00409a30
add esp, 8
movzx edx, al
test edx, edx
je 0x40adf6
push 0x45c4fc
lea eax, [ebp - 0x40]
push eax
call fcn.00409a30
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x40adf6
lea edx, [ebp - 0x40]
push edx
lea ecx, [ebp - 0x1c]
call fcn.00407ee0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x40]
call fcn.004032a0
jmp 0x40ad7f
mov dword [ebp - 0x90], 0
jmp 0x40ae22
mov eax, dword [ebp - 0x90]
add eax, 1
mov dword [ebp - 0x90], eax
lea ecx, [ebp - 0x1c]
call fcn.00405540
cmp dword [ebp - 0x90], eax
jae 0x40ae34
jmp 0x40ae13
lea ecx, [ebp - 0x1c]
call fcn.00405540
cmp eax, 2
jb 0x40ae54
push 1
lea ecx, [ebp - 0x1c]
call fcn.0040d110
push eax
lea ecx, [ebp - 0x58]
call fcn.00404e20
lea ecx, [ebp - 0x58]
push ecx
mov ecx, dword [ebp + 8]
call fcn.004031a0
mov edx, dword [ebp - 0x94]
or edx, 1
mov dword [ebp - 0x94], edx
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x1c]
call fcn.0040d0f0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x88]
call fcn.004032a0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
call fcn.0040d0f0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x70]
call fcn.004032a0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x58]
call fcn.004032a0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00430a1b
mov esp, ebp
pop ebp
ret
Function at 0x40aed0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44d550
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x4679d0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [ebp + 8]
call fcn.00403c90
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x6c]
push eax
lea ecx, [ebp - 0x64]
push ecx
call fcn.00403020
add esp, 8
mov dword [ebp - 4], 0
push 0xc
lea ecx, [ebp - 0x1c]
call fcn.00402db0
lea ecx, [ebp - 0x1c]
call fcn.0040cfd0
mov byte [ebp - 4], 1
push 0x45c500
lea ecx, [ebp - 0x4c]
call fcn.00403160
mov byte [ebp - 4], 2
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x64]
push ecx
call fcn.00402e50
add esp, 0xc
mov dword [ebp - 0x68], 0
jmp 0x40af6d
mov edx, dword [ebp - 0x68]
add edx, 1
mov dword [ebp - 0x68], edx
lea ecx, [ebp - 0x1c]
call fcn.00405540
cmp dword [ebp - 0x68], eax
jae 0x40afdd
mov eax, dword [ebp - 0x68]
push eax
lea ecx, [ebp - 0x1c]
call fcn.0040d110
push eax
lea ecx, [ebp - 0x34]
call fcn.004030d0
mov byte [ebp - 4], 3
push 0x45c2f3
lea ecx, [ebp - 0x34]
push ecx
call fcn.00409a30
add esp, 8
movzx edx, al
test edx, edx
je 0x40afcf
push 0x45c504
lea eax, [ebp - 0x34]
push eax
call fcn.00409a30
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x40afcf
lea edx, [ebp - 0x34]
push edx
mov ecx, dword [ebp + 8]
call fcn.00407ee0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x34]
call fcn.004032a0
jmp 0x40af64
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x4c]
call fcn.004032a0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1c]
call fcn.0040d0f0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x64]
call fcn.004032a0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00430a1b
mov esp, ebp
pop ebp
ret
Function at 0x40e140
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x40e164
xor eax, eax
jmp 0x40e1e4
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40e17b
xor eax, eax
jmp 0x40e1e4
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0x14]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 0x10]
and eax, 0xf
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x40e1c7
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jae 0x40e1c7
mov edx, dword [ebp - 4]
movzx eax, word [edx]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax*2 + 2]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
sub eax, 1
mov dword [ebp - 8], eax
jmp 0x40e19e
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jb 0x40e1d3
xor eax, eax
jmp 0x40e1e4
mov edx, dword [ebp - 4]
movzx eax, word [edx]
test eax, eax
jne 0x40e1e1
xor eax, eax
jmp 0x40e1e4
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x40ecb0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
mov eax, dword [0x4679d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x228], 0
push 0x104
lea eax, [ebp - 0x20c]
push eax
push str.APPDATA
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov dword [ebp - 0x22c], eax
lea ecx, [ebp - 0x20c]
push ecx
lea edx, [ebp - 0x224]
push edx
call fcn.00403020
add esp, 8
lea eax, [ebp - 0x224]
push eax
mov ecx, dword [ebp + 8]
call fcn.004031a0
mov ecx, dword [ebp - 0x228]
or ecx, 1
mov dword [ebp - 0x228], ecx
lea ecx, [ebp - 0x224]
call fcn.004032a0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00430a1b
mov esp, ebp
pop ebp
ret

Function at 0x413c33
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 4], ecx
mov esi, edi
cmp dword [ebp + 8], esi
je 0x413c78
call fcn.0041ad5e
push 0xf0
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x413c78
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x413c94
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.0040f1ef
mov ebx, eax
test edi, edi
je 0x413c92
test esi, esi
je 0x413c92
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x441032
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4679d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00437911
mov dword [ebp - 0x14], eax
cmp dword [0x46d404], esi
jne 0x441125
push 0x800
push esi
push 0x455840
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x4410b2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x441205
push esi
push esi
push 0x455840
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x441205
push 0x455858
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x441205
push eax
call ebx
push 0x455864
push edi
mov dword [0x46d404], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x455874
push edi
mov dword [0x46d408], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x455888
push edi
mov dword [0x46d40c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x46d414], eax
test eax, eax
je 0x441122
push 0x4558a4
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x46d410], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x44114a
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x44113d
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x44115f
push 4
pop eax
jmp 0x441207
cmp dword [ebp - 0x14], esi
je 0x44115f
push dword [0x46d404]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x441144
mov eax, dword [0x46d410]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x4411bd
cmp dword [0x46d414], edi
je 0x4411bd
push eax
call ebx
push dword [0x46d414]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x4411bd
test eax, eax
je 0x4411bd
call ecx
test eax, eax
je 0x4411b2
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x4411b2
test byte [ebp - 8], 1
jne 0x4411bd
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x4411ed
mov eax, dword [0x46d408]
cmp eax, edi
je 0x4411ea
push eax
call ebx
test eax, eax
je 0x4411ea
call eax
mov esi, eax
test esi, esi
je 0x4411ea
mov eax, dword [0x46d40c]
cmp eax, edi
je 0x4411ea
push eax
call ebx
test eax, eax
je 0x4411ea
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x46d404]
call ebx
test eax, eax
je 0x441205
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x441207
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00430a1b
mov esp, ebp
pop ebp
ret