joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407d9c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004033fc
xor eax, eax
push ebp
push 0x407e75
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp byte [eax], 0x5c
jne 0x407dd4
mov eax, dword [ebp - 4]
call fcn.004071d0
jmp 0x407ddc
mov eax, dword [ebp - 4]
call fcn.00407bd4
call fcn.00404ae8
mov esi, eax
test esi, esi
jle 0x407e28
mov ebx, 1
lea edx, [ebp - 8]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 8]
cmp byte [eax], 0x5c
jne 0x407e12
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0xc]
call fcn.004071d0
jmp 0x407e24
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0x10]
call fcn.00407bd4
inc ebx
dec esi
jne 0x407dec
push 1
push dword [ebp - 4]
push 0x407e8c
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.00406f34
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004032cc
mov eax, dword [ebp - 0x14]
call fcn.0040340c
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407e7c
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.004030b8
ret

Function at 0x401230
Capabilities:
Execute command

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push 0x31
push 0x401210
push 0x401218
push 0
call sub.USER32.dll_MessageBoxA
mov eax, eax
mov dword [ebp - 4], eax
add esp, 0xfffffff4
push 0x401229
call sub.msvcrt.dll_system
add esp, 0x10
xor eax, eax
jmp 0x401262
leave
ret 0x10

Function at 0x401270
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
push ebx
call sym.___main
call sub.KERNEL32.dll_GetCommandLineA
mov ebx, eax
add esp, 0xfffffff4
lea eax, [ebp - 0x50]
push eax
call sub.KERNEL32.dll_GetStartupInfoA
add esp, 0xc
test ebx, ebx
je 0x4012dc
jmp 0x401299
inc ebx
mov al, byte [ebx]
cmp al, 0x20
je 0x401298
cmp al, 9
je 0x401298
mov al, byte [ebx]
cmp al, 0x22
jne 0x4012c3
lea esi, [esi]
inc ebx
mov al, byte [ebx]
cmp al, 0x22
je 0x4012d1
test al, al
jne 0x4012b0
jmp 0x4012d2
inc ebx
mov al, byte [ebx]
cmp al, 0x20
je 0x4012d1
cmp al, 9
je 0x4012d2
test al, al
jne 0x4012c0
jmp 0x4012d2
inc ebx
mov al, byte [ebx]
cmp al, 0x20
je 0x4012d1
cmp al, 9
je 0x4012d1
mov eax, 0xa
test byte [ebp - 0x24], 1
je 0x4012eb
movzx eax, word [ebp - 0x20]
push eax
push ebx
push 0
add esp, 0xfffffff4
push 0
call sub.KERNEL32.dll_GetModuleHandleA
add esp, 0xc
push eax
call sym._WinMain_16
mov ebx, dword [ebp - 0x68]
leave
ret
Function at 0x401c18
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40e050]
jne 0x401c22
repz ret
jmp fcn.00405760

Function at 0x405583
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x4055aa
call fcn.00402cb2
mov dword [eax], esi
call fcn.00402c9f
push 0x16
pop esi
mov dword [eax], esi
call fcn.004027a2
mov eax, esi
jmp 0x4055ff
test dword [ebp + 0xc], 0xfffffff9
jne 0x405590
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4055d7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00402cc5
pop ecx
call fcn.00402c9f
mov eax, dword [eax]
jmp 0x4055ff
test al, 0x10
jne 0x4055fd
test al, 1
je 0x4055fd
test byte [ebp + 0xc], 2
je 0x4055fd
call fcn.00402cb2
mov dword [eax], 5
call fcn.00402c9f
mov dword [eax], 0xd
jmp 0x4055ce
xor eax, eax
pop esi
pop ebp
ret
Function at 0x40703b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x40e050]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004027e9
and dword [ebp - 0x14], 0
cmp dword [0x9c8cf4], 0
mov dword [ebp - 0x18], eax
jne 0x4070ee
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x407196
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x407196
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x9c8cf4], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x9c8cf8], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x9c8cfc], eax
call edi
push eax
call esi
mov dword [0x9c8d04], eax
test eax, eax
je 0x4070ee
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x9c8d00], eax
mov eax, dword [0x9c8d00]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x407147
cmp dword [0x9c8d04], ecx
je 0x407147
push eax
call esi
push dword [0x9c8d04]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x407147
test ebx, ebx
je 0x407147
call edi
test eax, eax
je 0x40713e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40713e
test byte [ebp - 8], 1
jne 0x407147
or dword [ebp + 0x10], 0x200000
jmp 0x40717a
mov eax, dword [0x9c8cf8]
cmp eax, dword [ebp - 0x18]
je 0x40717a
push eax
call esi
test eax, eax
je 0x40717a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40717a
mov eax, dword [0x9c8cfc]
cmp eax, dword [ebp - 0x18]
je 0x40717a
push eax
call esi
test eax, eax
je 0x40717a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x9c8cf4]
call esi
test eax, eax
je 0x407196
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x407198
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401c18
leave
ret
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
nop
push 4
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x433072
nop
nop
nop
nop
nop
mov ebx, 0x40de38
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
mov esi, 0x2a003f11
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x433060
nop
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
je 0x4330d2
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x5de8622d
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x4330c0
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x4016dd
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebx]
xor ecx, ecx
cmp eax, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], ecx
je 0x40176b
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea edx, [ebp - 4]
push edx
push ecx
lea edx, [ebp - 8]
push edx
push ecx
push dword [ebp + 8]
push eax
call edi
cmp dword [ebp - 8], 1
je 0x401714
cmp dword [ebp - 8], 2
jne 0x40176a
push esi
mov esi, dword [ebp + 0xc]
call fcn.00407d14
mov eax, dword [ebp - 4]
shr eax, 1
inc eax
push eax
call fcn.00407f07
mov esi, eax
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 8]
push dword [ebx]
call edi
test eax, eax
jne 0x401769
mov eax, dword [ebp - 4]
shr eax, 1
and word [esi + eax*2], 0
mov esi, dword [ebp + 0xc]
mov eax, dword [esi]
test eax, eax
je 0x40175b
push eax
call fcn.0048c8bf
pop ecx
mov edx, esi
call fcn.00406080
mov dword [ebp - 0xc], 1
pop esi
pop edi
mov eax, dword [ebp - 0xc]
leave
ret 8

Function at 0x401772
Capabilities:
Set registry value

Disassembly:
push edi
xor edi, edi
cmp dword [esi], edi
je 0x4017a0
push dword [esp + 0xc]
call fcn.0048c8bf
pop ecx
lea eax, [eax + eax + 2]
push eax
push dword [esp + 0x10]
push 1
push edi
push dword [esp + 0x18]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x4017a0
inc edi
mov eax, edi
pop edi
ret 8
Function at 0x403581
Capabilities:
Delete file
Move file

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x4035a0
push 4
push eax
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x4035a3
xor eax, eax
inc eax
ret 4

Function at 0x4035ab
Capabilities:
Terminate thread

Disassembly:
mov eax, dword [esi + 8]
test eax, eax
je 0x4035dd
push 0x3e8
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x4035d0
push 0
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [esi + 8], 0
xor eax, eax
inc eax
ret
Function at 0x4036d8
Capabilities:
Log keystrokes

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov edi, eax
mov eax, dword [0x4e0044]
xor esi, esi
cmp eax, esi
mov dword [esp + 0x1c], esi
je 0x4036f5
mov ebp, dword [eax + 4]
jmp 0x4036f7
xor ebp, ebp
cmp ebp, esi
jne 0x403707
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov ebp, eax
cmp ebp, esi
je 0x40372c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp ebp, eax
je 0x40372c
push ebp
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x40372c
push esi
push ebp
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [esp + 0x1c], 1
push ecx
mov eax, esp
mov dword [edi + 0x3ac], esi
push ebp
mov ebx, edi
mov dword [eax], esi
call fcn.00403b65
mov ecx, eax
cmp ecx, esi
mov dword [esp + 0x18], ecx
jne 0x403759
push 1
push ebp
call dword [sym.imp.USER32.dll_EnableWindow]
xor eax, eax
jmp 0x40384a
mov eax, dword [0x4e0044]
cmp eax, esi
mov dword [esp + 0x20], esi
je 0x403770
mov edx, dword [eax + 4]
mov dword [esp + 0x20], edx
mov dword [eax + 4], ecx
lea eax, [edi + 4]
push eax
mov eax, ebp
call fcn.00407377
cmp dword [edi + 0x3a0], esi
je 0x4037eb
push esi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push esi
push esi
push esi
push 0x2001
mov dword [esp + 0x24], eax
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
push 0x43
push esi
push esi
push esi
push esi
push esi
push dword [esp + 0x30]
call dword [sym.imp.USER32.dll_SetWindowPos]
cmp ebx, dword [esp + 0x14]
je 0x4037cf
push 1
push ebx
push dword [esp + 0x1c]
call dword [sym.imp.USER32.dll_AttachThreadInput]
push dword [esp + 0x18]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
cmp ebx, dword [esp + 0x14]
je 0x4037eb
push esi
push ebx
push dword [esp + 0x1c]
call dword [sym.imp.USER32.dll_AttachThreadInput]
call fcn.0046bd0d
push 0x97
push esi
push esi
push esi
push esi
push esi
push dword [edi + 4]
mov dword [edi + 0x3ac], esi
call dword [sym.imp.USER32.dll_SetWindowPos]
cmp dword [esp + 0x1c], esi
je 0x40382e
push 1
push ebp
call dword [sym.imp.USER32.dll_EnableWindow]
cmp ebp, esi
je 0x40382e
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [edi + 4]
jne 0x40382e
push ebp
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [0x4e0044]
cmp eax, esi
je 0x40383e
mov ecx, dword [esp + 0x20]
mov dword [eax + 4], ecx
push dword [edi + 4]
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [edi + 0x28]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x4038a9
Capabilities:
Create thread

Disassembly:
push edi
xor edi, edi
cmp dword [esi], edi
je 0x40391a
cmp dword [esp + 8], edi
je 0x40391a
mov eax, dword [esi + 8]
cmp eax, edi
je 0x4038d5
push edi
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x4038d5
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 8], edi
cmp dword [esi + 8], edi
jne 0x40391a
push ebx
mov ebx, dword [esi]
push 0xc
call fcn.00442cda
cmp eax, edi
pop ecx
jne 0x4038ed
xor eax, eax
jmp 0x40390b
mov ecx, dword [esp + 0xc]
push edi
push edi
push eax
push 0x404d82
push edi
push edi
mov dword [eax], ebx
mov dword [eax + 8], edi
mov dword [eax + 4], ecx
call fcn.0048eee6
add esp, 0x18
xor ecx, ecx
cmp eax, edi
setne cl
mov dword [esi + 8], eax
pop ebx
mov eax, ecx
jmp 0x40391c
xor eax, eax
pop edi
ret 4

Function at 0x404da8
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, eax
cmp dword [edi + 0xc], 0xffffffff
jne 0x404dfd
push esi
lea esi, [ebp - 4]
call fcn.00404e03
push dword [eax]
push 0
push 0x4ba9e0
push str.basesetting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov esi, eax
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.00405148
test esi, esi
pop esi
je 0x404dee
push edi
call fcn.00404f2d
test eax, eax
jne 0x404df7
call fcn.0040510d
test eax, eax
je 0x404dfa
xor eax, eax
inc eax
mov dword [edi + 0xc], eax
mov eax, dword [edi + 0xc]
pop edi
leave
ret

Function at 0x405094
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [edi + 0x18], 0
jne 0x4050ca
push esi
lea esi, [ebp - 4]
call fcn.00404e03
push dword [eax]
push 2
push 0x4baa08
push str.basesetting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [edi + 0x18], eax
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.00405148
pop esi
mov eax, dword [edi + 0x18]
leave
ret

Function at 0x40510d
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [edi + 4], 0xffffffff
jne 0x405143
push esi
lea esi, [ebp - 4]
call fcn.00404e03
push dword [eax]
push 0
push str.debug
push str.basesetting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [edi + 4], eax
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.00405148
pop esi
mov eax, dword [edi + 4]
leave
ret
Function at 0x405568
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x4ae423
call fcn.004acfc0
push ecx
and dword [ebp - 0x10], 0
push edi
mov edi, ecx
add edi, 0x14
mov eax, dword [edi]
cmp dword [eax - 0xc], 0
jne 0x4055dc
push esi
lea esi, [ebp - 0x10]
call fcn.00404e03
and dword [ebp - 4], 0
push dword [eax]
mov eax, 0x104
push eax
push eax
mov esi, edi
call fcn.00407f07
push eax
push 0x4baae0
push str.supportprocess
push str.basesetting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00405148
mov eax, dword [edi]
test eax, eax
pop esi
je 0x4055d5
push eax
call fcn.0048c8bf
pop ecx
mov edx, edi
call fcn.00406080
mov eax, dword [edi]
sub eax, 0x10
call fcn.00408006
mov ecx, dword [ebp - 0xc]
add eax, 0x10
mov dword [ebx], eax
mov eax, ebx
pop edi
mov dword fs:[0], ecx
leave
ret

Function at 0x405af3
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, edi
call fcn.004054ef
test eax, eax
jne 0x405b07
push 0x60
pop eax
leave
ret
cmp dword [edi + 8], 0xffffffff
jne 0x405b39
push esi
lea esi, [ebp - 4]
call fcn.00404e03
push dword [eax]
push 0x60
push str.debugdpi
push str.basesetting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [edi + 8], eax
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.00405148
pop esi
mov eax, dword [edi + 8]
leave
ret
Function at 0x405bb3
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x4af9c8
call fcn.004acfc0
sub esp, 0x20
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x20]
add edi, 0x1c
xor ebx, ebx
cmp eax, ebx
je 0x405bdf
mov ecx, dword [edi + 8]
sub ecx, eax
sar ecx, 3
jne 0x405d07
mov eax, dword [0x4df350]
mov ecx, 0x4df350
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
lea esi, [ebp - 0x1c]
mov dword [ebp - 4], ebx
call fcn.00404e03
mov byte [ebp - 4], 1
push dword [eax]
mov eax, 0x104
push eax
push eax
lea esi, [ebp - 0x14]
call fcn.00407f07
push eax
push str.1.01.21.5
push str.supportrate
push str.basesetting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
call fcn.00405148
cmp dword [ebp - 0x14], ebx
jne 0x405c3f
xor eax, eax
jmp 0x405c48
push dword [ebp - 0x14]
call fcn.0048c8bf
pop ecx
lea edx, [ebp - 0x14]
call fcn.00406080
mov esi, 0x4baadc
push esi
lea eax, [ebp - 0x18]
mov dword [ebp - 0x1c], ebx
push eax
lea ecx, [ebp - 0x1c]
lea ebx, [ebp - 0x14]
call fcn.00405d18
jmp 0x405ce3
push eax
call fcn.0048c9e1
fstp qword [ebp - 0x24]
mov edx, dword [edi + 4]
test edx, edx
pop ecx
jne 0x405c7f
xor ecx, ecx
jmp 0x405c87
mov ecx, dword [edi + 8]
sub ecx, edx
sar ecx, 3
test edx, edx
je 0x405ca7
mov eax, dword [edi + 0xc]
sub eax, edx
sar eax, 3
cmp ecx, eax
jae 0x405ca7
mov eax, dword [edi + 8]
fld qword [ebp - 0x24]
fstp qword [eax]
add eax, 8
mov dword [edi + 8], eax
jmp 0x405cc4
mov ebx, dword [edi + 8]
cmp edx, ebx
jbe 0x405cb3
call fcn.0048f57f
push ebx
push edi
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x2c]
push eax
mov eax, edi
call fcn.004060c1
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.00405148
push esi
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x1c]
lea ebx, [ebp - 0x14]
call fcn.00405d18
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x18]
cmp dword [eax - 0xc], 0
jne 0x405c6a
add eax, 0xfffffff0
call fcn.00405148
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.00405148
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret

Function at 0x405e89
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push dword [esp + 0xc]
mov esi, eax
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x405ea0
pop esi
ret
push edi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x405ed5
push dword [esp + 0x10]
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, edi
and esi, 0xf
jbe 0x405ed1
cmp edi, eax
jae 0x405ed5
dec esi
movzx ecx, word [edi]
lea edi, [edi + ecx*2 + 2]
jne 0x405ec3
cmp edi, eax
jb 0x405ed9
xor eax, eax
jmp 0x405ee3
mov ax, word [edi]
neg ax
sbb eax, eax
and eax, edi
pop edi
pop esi
ret
Function at 0x406d52
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
push dword [ebp + 0xc]
mov esi, eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test edi, edi
jne 0x406d71
xor eax, eax
jmp 0x406dc1
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [ebp - 8], eax
je 0x406d6d
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
mov dword [ebp - 4], eax
je 0x406d6d
push ebx
lea ebx, [edi + 1]
push ebx
call fcn.00407b90
test eax, eax
je 0x406dad
push edi
push dword [ebp - 4]
push eax
call fcn.0048ca60
add esp, 0xc
mov eax, ebx
call fcn.00407b77
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FreeResource]
xor eax, eax
inc eax
pop ebx
pop edi
pop esi
leave
ret

Function at 0x406dc5
Capabilities:
Get file size
Read file on windows

Disassembly:
mov eax, 0x4ae304
call fcn.004acfc0
push ecx
push ecx
mov eax, dword [0x4df350]
push ebx
push esi
push edi
mov edi, ecx
mov esi, 0x4df350
xor ebx, ebx
mov ecx, esi
mov dword [ebp - 0x14], ebx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
cmp dword [ebp + 0x14], ebx
lea eax, [edi + 0xc]
jne 0x406dfd
mov eax, edi
lea edi, [ebp - 0x10]
call fcn.0040805e
mov edi, dword [ebp - 0x10]
cmp dword [edi - 0xc], ebx
je 0x406ef3
mov eax, dword [0x4df350]
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp + 0x14], eax
push dword [ebp + 0x10]
mov byte [ebp - 4], 1
push dword [ebp + 8]
lea eax, [ebp + 0x14]
push edi
push str._s_d._s
call fcn.0040818d
add esp, 0x10
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocString
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp + 0x10], eax
je 0x406ee8
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, ebx
je 0x406edf
mov esi, dword [ebp + 0xc]
push ebx
lea eax, [ebp + 8]
push eax
push edi
lea eax, [edi + 0xa]
push eax
mov dword [ebp + 8], ebx
call fcn.00407b90
push eax
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, ebx
mov dword [ebp - 0x14], eax
je 0x406ed6
cmp dword [ebp + 8], edi
jne 0x406ed6
mov eax, edi
call fcn.00407b77
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 0x14]
add eax, 0xfffffff0
call fcn.00405148
xor esi, esi
inc esi
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00405148
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x10
xor eax, eax
mov edx, esi
call fcn.004051bd
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 0x14]
add eax, 0xfffffff0
call fcn.00405148
mov esi, dword [ebp - 0x14]
jmp 0x406eb8
Function at 0x408385
Capabilities:
Delete file

Disassembly:
mov eax, 0x4af9a6
call fcn.004acfc0
sub esp, 0x14
mov eax, dword [0x4df350]
push ebx
push esi
mov ebx, ecx
xor esi, esi
push edi
mov ecx, 0x4df350
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x10], esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x18], eax
push esi
mov dword [ebp - 4], esi
mov edi, 0x4e1030
mov dword [ebp - 0x1c], esi
push str.GetPacketData__d
mov esi, edi
call fcn.00462aca
pop ecx
pop ecx
lea eax, [ebp - 0x10]
push eax
push 0
mov esi, ebx
call fcn.00408495
push eax
push str.GetPacketData_return:_d
mov esi, edi
mov dword [ebp - 0x14], eax
call fcn.00462aca
cmp dword [ebp - 0x14], 0
pop ecx
pop ecx
jne 0x4083fa
mov dword [ebx + 0x1c], 1
jmp 0x408473
push 0x28
call fcn.00442cda
test eax, eax
pop ecx
je 0x408410
push eax
call fcn.004529e1
mov ebx, eax
jmp 0x408412
xor ebx, ebx
test ebx, ebx
mov dword [ebp - 0x1c], ebx
je 0x408473
push str.Extract...
call fcn.00462aca
mov eax, dword [ebx]
pop ecx
push dword [ebp + 8]
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push ebx
call dword [eax]
mov ebx, eax
xor eax, eax
test ebx, ebx
sete al
push eax
push str.Extract_return:_d
call fcn.00462aca
test ebx, ebx
pop ecx
pop ecx
je 0x40846c
xor esi, esi
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.00405148
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 4
mov dword [ebp - 0x20], 1
mov eax, dword [ebp - 0x18]
cmp dword [eax - 0xc], 0
je 0x408483
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x408490
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
mov esi, dword [ebp - 0x20]
jmp 0x40844e