joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40f3d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1854
call fcn.00444240
mov eax, dword [0x4c8578]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push str.ENVIRONMENT
push 0xaa
push 0
mov dword [ebp - 0x1854], 0
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
mov esi, eax
push esi
push 0
call dword [sym.imp.KERNEL32.DLL_LoadResource]
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
mov esi, eax
mov dword [ebp - 0x1850], esi
cmp esi, 0x800
jae 0x40f4ae
test esi, esi
je 0x40f49a
test edi, edi
je 0x40f455
cmp esi, 0x800
ja 0x40f455
push esi
lea eax, [ebp - 0x804]
push edi
push eax
call fcn.004465a0
add esp, 0xc
jmp 0x40f49a
push 0x800
lea eax, [ebp - 0x804]
push 0
push eax
call fcn.00446b20
add esp, 0xc
test edi, edi
jne 0x40f47c
call fcn.0044ebfa
mov dword [eax], 0x16
jmp 0x40f48f
cmp esi, 0x800
jbe 0x40f4a0
call fcn.0044ebfa
mov dword [eax], 0x22
call fcn.0044eb20
mov esi, dword [ebp - 0x1850]
cmp esi, 0x800
jae 0x40f568
mov byte [ebp + esi - 0x804], 0
lea eax, [ebp - 0x184c]
push eax
push dword [0x49645c]
push 0x496460
call fcn.00404150
lea eax, [ebp - 0x1850]
push eax
lea eax, [ebp - 0x804]
push eax
call fcn.00403da0
mov esi, eax
add esp, 0x14
test esi, esi
je 0x40f552
lea eax, [ebp - 0x184c]
push eax
lea eax, [ebp - 0x1850]
push eax
push esi
call fcn.00403e70
mov edi, eax
add esp, 0xc
test edi, edi
je 0x40f54b
mov eax, dword [ebp - 0x1850]
test eax, eax
je 0x40f544
push edi
push eax
lea eax, [ebp - 0x804]
mov ecx, 0x53f400
push eax
call fcn.00440cd0
lea eax, [ebp - 0x804]
cmp dword [eax], 0x3a444945
jne 0x40f544
lea eax, [ebp - 0x1854]
push eax
lea eax, [ebp - 0x800]
push 0x46c744
push eax
call fcn.00402c50
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.DLL_GlobalFree]
push esi
call dword [sym.imp.KERNEL32.DLL_GlobalFree]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x1854]
xor ecx, ebp
pop edi
pop esi
call fcn.00443fa5
mov esp, ebp
pop ebp
ret
call fcn.004443c2
int3
Function at 0x40f570
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1854
call fcn.00444240
mov eax, dword [0x4c8578]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push str.INSTITUTION
push 0xad
push 0
mov dword [ebp - 0x1854], 0
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
mov esi, eax
push esi
push 0
call dword [sym.imp.KERNEL32.DLL_LoadResource]
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
mov esi, eax
mov dword [ebp - 0x1850], esi
cmp esi, 0x800
jae 0x40f64e
test esi, esi
je 0x40f63a
test edi, edi
je 0x40f5f5
cmp esi, 0x800
ja 0x40f5f5
push esi
lea eax, [ebp - 0x804]
push edi
push eax
call fcn.004465a0
add esp, 0xc
jmp 0x40f63a
push 0x800
lea eax, [ebp - 0x804]
push 0
push eax
call fcn.00446b20
add esp, 0xc
test edi, edi
jne 0x40f61c
call fcn.0044ebfa
mov dword [eax], 0x16
jmp 0x40f62f
cmp esi, 0x800
jbe 0x40f640
call fcn.0044ebfa
mov dword [eax], 0x22
call fcn.0044eb20
mov esi, dword [ebp - 0x1850]
cmp esi, 0x800
jae 0x40f708
mov byte [ebp + esi - 0x804], 0
lea eax, [ebp - 0x184c]
push eax
push dword [0x49645c]
push 0x496460
call fcn.00404150
lea eax, [ebp - 0x1850]
push eax
lea eax, [ebp - 0x804]
push eax
call fcn.00403da0
mov esi, eax
add esp, 0x14
test esi, esi
je 0x40f6f2
lea eax, [ebp - 0x184c]
push eax
lea eax, [ebp - 0x1850]
push eax
push esi
call fcn.00403e70
mov edi, eax
add esp, 0xc
test edi, edi
je 0x40f6eb
mov eax, dword [ebp - 0x1850]
test eax, eax
je 0x40f6e4
push edi
push eax
lea eax, [ebp - 0x804]
mov ecx, 0x53f400
push eax
call fcn.00440cd0
lea eax, [ebp - 0x804]
cmp dword [eax], 0x3a444949
jne 0x40f6e4
lea eax, [ebp - 0x1854]
push eax
lea eax, [ebp - 0x800]
push 0x46c744
push eax
call fcn.00402c50
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.DLL_GlobalFree]
push esi
call dword [sym.imp.KERNEL32.DLL_GlobalFree]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x1854]
xor ecx, ebp
pop edi
pop esi
call fcn.00443fa5
mov esp, ebp
pop ebp
ret
call fcn.004443c2
int3
Function at 0x40f710
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1854
call fcn.00444240
mov eax, dword [0x4c8578]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push str.INTERVAL
push 0x85
push 0
mov dword [ebp - 0x1854], 0x1d4c0
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
mov esi, eax
push esi
push 0
call dword [sym.imp.KERNEL32.DLL_LoadResource]
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
mov esi, eax
mov dword [ebp - 0x1850], esi
cmp esi, 0x800
jae 0x40f7ee
test esi, esi
je 0x40f7da
test edi, edi
je 0x40f795
cmp esi, 0x800
ja 0x40f795
push esi
lea eax, [ebp - 0x804]
push edi
push eax
call fcn.004465a0
add esp, 0xc
jmp 0x40f7da
push 0x800
lea eax, [ebp - 0x804]
push 0
push eax
call fcn.00446b20
add esp, 0xc
test edi, edi
jne 0x40f7bc
call fcn.0044ebfa
mov dword [eax], 0x16
jmp 0x40f7cf
cmp esi, 0x800
jbe 0x40f7e0
call fcn.0044ebfa
mov dword [eax], 0x22
call fcn.0044eb20
mov esi, dword [ebp - 0x1850]
cmp esi, 0x800
jae 0x40f8a8
mov byte [ebp + esi - 0x804], 0
lea eax, [ebp - 0x184c]
push eax
push dword [0x49645c]
push 0x496460
call fcn.00404150
lea eax, [ebp - 0x1850]
push eax
lea eax, [ebp - 0x804]
push eax
call fcn.00403da0
mov esi, eax
add esp, 0x14
test esi, esi
je 0x40f892
lea eax, [ebp - 0x184c]
push eax
lea eax, [ebp - 0x1850]
push eax
push esi
call fcn.00403e70
mov edi, eax
add esp, 0xc
test edi, edi
je 0x40f88b
mov eax, dword [ebp - 0x1850]
test eax, eax
je 0x40f884
push edi
push eax
lea eax, [ebp - 0x804]
mov ecx, 0x53f400
push eax
call fcn.00440cd0
lea eax, [ebp - 0x804]
cmp dword [eax], 0x3a544e49
jne 0x40f884
lea eax, [ebp - 0x1854]
push eax
lea eax, [ebp - 0x800]
push 0x46c744
push eax
call fcn.00402c50
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.DLL_GlobalFree]
push esi
call dword [sym.imp.KERNEL32.DLL_GlobalFree]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x1854]
xor ecx, ebp
pop edi
pop esi
call fcn.00443fa5
mov esp, ebp
pop ebp
ret
call fcn.004443c2
int3
Function at 0x40f920
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1054
call fcn.00444240
mov eax, dword [0x4c8578]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
movzx ecx, word [ebp + 8]
push ebx
push esi
push edi
push eax
push ecx
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
mov edi, eax
push edi
push esi
call dword [sym.imp.KERNEL32.DLL_LoadResource]
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov ebx, eax
test ebx, ebx
je 0x40fa6f
push edi
push esi
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
mov dword [ebp - 0x1050], eax
inc eax
push eax
push 0x2040
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov edi, eax
mov eax, dword [ebp - 0x1050]
test eax, eax
je 0x40f9d5
lea ecx, [eax + 1]
test edi, edi
jne 0x40f9a2
call fcn.0044ebfa
mov dword [eax], 0x16
jmp 0x40f9ca
cmp ecx, eax
jb 0x40f9b3
push eax
push ebx
push edi
call fcn.004465a0
add esp, 0xc
jmp 0x40f9cf
push ecx
push 0
push edi
call fcn.00446b20
add esp, 0xc
call fcn.0044ebfa
mov dword [eax], 0x22
call fcn.0044eb20
mov eax, dword [ebp - 0x1050]
mov byte [edi + eax], 0
lea eax, [ebp - 0x104c]
push eax
push dword [0x49645c]
push 0x496460
call fcn.00404150
lea eax, [ebp - 0x1050]
push eax
push edi
call fcn.00403da0
mov ebx, dword [sym.imp.KERNEL32.DLL_GlobalFree]
add esp, 0x14
mov dword [ebp - 0x1054], eax
push edi
call ebx
mov eax, dword [ebp - 0x1054]
test eax, eax
je 0x40fa6f
lea ecx, [ebp - 0x104c]
push ecx
lea ecx, [ebp - 0x1050]
push ecx
push eax
call fcn.00403e70
mov edi, eax
add esp, 0xc
test edi, edi
je 0x40fa66
mov eax, dword [ebp - 0x1050]
test eax, eax
je 0x40fa63
shr eax, 1
inc eax
push eax
push 0x2040
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
push edi
push dword [ebp - 0x1050]
mov esi, eax
mov ecx, 0x53f400
push esi
call fcn.00440cd0
push edi
call ebx
mov eax, dword [ebp - 0x1054]
push eax
call ebx
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00443fa5
mov esp, ebp
pop ebp
ret 8
Function at 0x40fa90
Capabilities:
Delete file
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x4c8578]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
push 0x104
push edi
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
push edi
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
push eax
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.00407d30
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveExtensionA]
push esi
mov esi, dword [ebp + 0xc]
push esi
push edi
call fcn.00449d78
push 0x46c7d0
push esi
push edi
call fcn.00449dd2
lea eax, [ebp - 0x108]
push eax
push esi
push edi
call fcn.00449dd2
push 0x46c7d0
push esi
push edi
call fcn.00449dd2
push str.Audio
push esi
push edi
call fcn.00449dd2
push 0x46e1b0
push esi
push edi
call fcn.00449dd2
add esp, 0x48
push edi
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
push 0x46ddac
push 0xb8
push 0
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
mov esi, eax
push esi
push 0
call dword [sym.imp.KERNEL32.DLL_LoadResource]
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
push esi
push 0
mov ebx, eax
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
push 0
push 0x80
push 2
push 0
push 3
push 0xc0000000
push edi
mov dword [ebp - 0x10c], eax
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov esi, eax
test esi, esi
je 0x40fba8
push 0
lea eax, [ebp - 0x110]
push eax
push dword [ebp - 0x10c]
push ebx
push esi
call dword [sym.imp.KERNEL32.DLL_WriteFile]
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00443fa5
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40fbc0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1858
call fcn.00444240
mov eax, dword [0x4c8578]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push str.OPTIONS
push 0x88
xorps xmm0, xmm0
push 0
movlpd qword [ebp - 0x1858], xmm0
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
mov esi, eax
push esi
push 0
call dword [sym.imp.KERNEL32.DLL_LoadResource]
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
mov esi, eax
mov dword [ebp - 0x1850], esi
cmp esi, 0x800
jae 0x40fc9f
test esi, esi
je 0x40fc8b
test edi, edi
je 0x40fc46
cmp esi, 0x800
ja 0x40fc46
push esi
lea eax, [ebp - 0x804]
push edi
push eax
call fcn.004465a0
add esp, 0xc
jmp 0x40fc8b
push 0x800
lea eax, [ebp - 0x804]
push 0
push eax
call fcn.00446b20
add esp, 0xc
test edi, edi
jne 0x40fc6d
call fcn.0044ebfa
mov dword [eax], 0x16
jmp 0x40fc80
cmp esi, 0x800
jbe 0x40fc91
call fcn.0044ebfa
mov dword [eax], 0x22
call fcn.0044eb20
mov esi, dword [ebp - 0x1850]
cmp esi, 0x800
jae 0x40fd6a
mov byte [ebp + esi - 0x804], 0
lea eax, [ebp - 0x184c]
push eax
push dword [0x49645c]
push 0x496460
call fcn.00404150
lea eax, [ebp - 0x1850]
push eax
lea eax, [ebp - 0x804]
push eax
call fcn.00403da0
mov esi, eax
add esp, 0x14
test esi, esi
je 0x40fd4e
lea eax, [ebp - 0x184c]
push eax
lea eax, [ebp - 0x1850]
push eax
push esi
call fcn.00403e70
mov edi, eax
add esp, 0xc
test edi, edi
je 0x40fd47
mov eax, dword [ebp - 0x1850]
test eax, eax
je 0x40fd40
push edi
push eax
lea eax, [ebp - 0x804]
mov ecx, 0x53f400
push eax
call fcn.00440cd0
lea ecx, [ebp - 0x804]
mov eax, 0x5354504f
cmp eax, dword [ecx]
jne 0x40fd40
mov eax, 0x3a
cmp al, byte [ecx + 4]
jne 0x40fd40
lea eax, [ebp - 0x1858]
push eax
lea eax, [ebp - 0x7ff]
push 0x46e148
push eax
call fcn.00402c50
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.DLL_GlobalFree]
push esi
call dword [sym.imp.KERNEL32.DLL_GlobalFree]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x1858]
xor ecx, ebp
mov edx, dword [ebp - 0x1854]
pop edi
pop esi
call fcn.00443fa5
mov esp, ebp
pop ebp
ret
call fcn.004443c2
int3
Function at 0x40fd70
Capabilities:
Create directory
Delete file
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x4c8578]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
push 0x104
push edi
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
push edi
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
push eax
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.00407d30
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveExtensionA]
push esi
mov esi, dword [ebp + 0xc]
push esi
push edi
call fcn.00449d78
push 0x46c7d0
push esi
push edi
call fcn.00449dd2
lea eax, [ebp - 0x108]
push eax
push esi
push edi
call fcn.00449dd2
add esp, 0x24
push 0
push edi
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
push 0x46c7d0
push esi
push edi
call fcn.00449dd2
push 0x46ddbc
push esi
push edi
call fcn.00449dd2
add esp, 0x18
push edi
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
push 0x46ddac
push 0xf5
push 0
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
mov esi, eax
push esi
push 0
call dword [sym.imp.KERNEL32.DLL_LoadResource]
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
push esi
push 0
mov ebx, eax
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
push 0
push 0x80
push 2
push 0
push 3
push 0xc0000000
push edi
mov dword [ebp - 0x10c], eax
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov esi, eax
test esi, esi
je 0x40fe88
push 0
lea eax, [ebp - 0x110]
push eax
push dword [ebp - 0x10c]
push ebx
push esi
call dword [sym.imp.KERNEL32.DLL_WriteFile]
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00443fa5
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40fea0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1854
call fcn.00444240
mov eax, dword [0x4c8578]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push str.PROGRAM
push 0xab
push 0
mov dword [ebp - 0x1854], 0
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
mov esi, eax
push esi
push 0
call dword [sym.imp.KERNEL32.DLL_LoadResource]
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
mov esi, eax
mov dword [ebp - 0x1850], esi
cmp esi, 0x800
jae 0x40ff7e
test esi, esi
je 0x40ff6a
test edi, edi
je 0x40ff25
cmp esi, 0x800
ja 0x40ff25
push esi
lea eax, [ebp - 0x804]
push edi
push eax
call fcn.004465a0
add esp, 0xc
jmp 0x40ff6a
push 0x800
lea eax, [ebp - 0x804]
push 0
push eax
call fcn.00446b20
add esp, 0xc
test edi, edi
jne 0x40ff4c
call fcn.0044ebfa
mov dword [eax], 0x16
jmp 0x40ff5f
cmp esi, 0x800
jbe 0x40ff70
call fcn.0044ebfa
mov dword [eax], 0x22
call fcn.0044eb20
mov esi, dword [ebp - 0x1850]
cmp esi, 0x800
jae 0x410038
mov byte [ebp + esi - 0x804], 0
lea eax, [ebp - 0x184c]
push eax
push dword [0x49645c]
push 0x496460
call fcn.00404150
lea eax, [ebp - 0x1850]
push eax
lea eax, [ebp - 0x804]
push eax
call fcn.00403da0
mov esi, eax
add esp, 0x14
test esi, esi
je 0x410022
lea eax, [ebp - 0x184c]
push eax
lea eax, [ebp - 0x1850]
push eax
push esi
call fcn.00403e70
mov edi, eax
add esp, 0xc
test edi, edi
je 0x41001b
mov eax, dword [ebp - 0x1850]
test eax, eax
je 0x410014
push edi
push eax
lea eax, [ebp - 0x804]
mov ecx, 0x53f400
push eax
call fcn.00440cd0
lea eax, [ebp - 0x804]
cmp dword [eax], 0x3a444950
jne 0x410014
lea eax, [ebp - 0x1854]
push eax
lea eax, [ebp - 0x800]
push 0x46c744
push eax
call fcn.00402c50
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.DLL_GlobalFree]
push esi
call dword [sym.imp.KERNEL32.DLL_GlobalFree]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x1854]
xor ecx, ebp
pop edi
pop esi
call fcn.00443fa5
mov esp, ebp
pop ebp
ret
call fcn.004443c2
int3
Function at 0x410040
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1854
call fcn.00444240
mov eax, dword [0x4c8578]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x46e370
push 0xa2
push 0
mov dword [ebp - 0x1854], 0
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
mov esi, eax
push esi
push 0
call dword [sym.imp.KERNEL32.DLL_LoadResource]
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
mov esi, eax
mov dword [ebp - 0x1850], esi
cmp esi, 0x800
jae 0x41011e
test esi, esi
je 0x41010a
test edi, edi
je 0x4100c5
cmp esi, 0x800
ja 0x4100c5
push esi
lea eax, [ebp - 0x804]
push edi
push eax
call fcn.004465a0
add esp, 0xc
jmp 0x41010a
push 0x800
lea eax, [ebp - 0x804]
push 0
push eax
call fcn.00446b20
add esp, 0xc
test edi, edi
jne 0x4100ec
call fcn.0044ebfa
mov dword [eax], 0x16
jmp 0x4100ff
cmp esi, 0x800
jbe 0x410110
call fcn.0044ebfa
mov dword [eax], 0x22
call fcn.0044eb20
mov esi, dword [ebp - 0x1850]
cmp esi, 0x800
jae 0x4101e3
mov byte [ebp + esi - 0x804], 0
lea eax, [ebp - 0x184c]
push eax
push dword [0x49645c]
push 0x496460
call fcn.00404150
lea eax, [ebp - 0x1850]
push eax
lea eax, [ebp - 0x804]
push eax
call fcn.00403da0
mov esi, eax
add esp, 0x14
test esi, esi
je 0x4101cd
lea eax, [ebp - 0x184c]
push eax
lea eax, [ebp - 0x1850]
push eax
push esi
call fcn.00403e70
mov edi, eax
add esp, 0xc
test edi, edi
je 0x4101c6
mov eax, dword [ebp - 0x1850]
test eax, eax
je 0x4101bf
push edi
push eax
lea eax, [ebp - 0x804]
mov ecx, 0x53f400
push eax
call fcn.00440cd0
lea ecx, [ebp - 0x804]
mov eax, 0x44494552
cmp eax, dword [ecx]
jne 0x4101bf
mov eax, 0x3a
cmp al, byte [ecx + 4]
jne 0x4101bf
lea eax, [ebp - 0x1854]
push eax
lea eax, [ebp - 0x7ff]
push 0x46c744
push eax
call fcn.00402c50
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.DLL_GlobalFree]
push esi
call dword [sym.imp.KERNEL32.DLL_GlobalFree]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x1854]
xor ecx, ebp
pop edi
pop esi
call fcn.00443fa5
mov esp, ebp
pop ebp
ret
call fcn.004443c2
int3
Function at 0x4101f0
Capabilities:
Delete file
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x4c8578]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0xc]
push eax
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.00449d78
push 0x46c7d0
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.00449dd2
push esi
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.00449dd2
add esp, 0x24
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
movzx eax, word [ebp + 0x10]
push edi
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
mov esi, eax
push esi
push 0
call dword [sym.imp.KERNEL32.DLL_LoadResource]
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
push 0
push 0x80
push 2
push 0
push 0
mov ebx, eax
lea eax, [ebp - 0x108]
push 2
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov esi, eax
test esi, esi
je 0x4102c1
push 0
lea eax, [ebp - 0x10c]
push eax
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.DLL_WriteFile]
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00443fa5
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4102e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1804
call fcn.00444240
mov eax, dword [0x4c8578]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
movzx ecx, word [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
push eax
push ecx
push 0
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
mov esi, eax
push esi
push 0
call dword [sym.imp.KERNEL32.DLL_LoadResource]
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
mov esi, eax
mov eax, dword [ebp + 0x14]
cmp esi, eax
jae 0x410385
test esi, esi
je 0x41037d
test edi, edi
je 0x41034f
push esi
lea eax, [ebp - 0x804]
push edi
push eax
call fcn.004465a0
add esp, 0xc
jmp 0x410371
push eax
lea eax, [ebp - 0x804]
push 0
push eax
call fcn.00446b20
add esp, 0xc
call fcn.0044ebfa
mov dword [eax], 0x16
call fcn.0044eb20
cmp esi, 0x800
jae 0x410409
mov byte [ebp + esi - 0x804], 0
push 0x800
lea eax, [ebp - 0x1804]
mov ecx, 0x4d0c88
push eax
push 0x800
lea eax, [ebp - 0x804]
push eax
call fcn.00402950
lea ecx, [ebp - 0x1804]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4103b0
mov esi, dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
lea eax, [ebp - 0x1804]
push 0
push 0
push 0
push 0
sub ecx, edx
sar ecx, 1
push ecx
push eax
push 0
push 0xfde9
call esi
push 0
push 0
push eax
push ebx
push 0xffffffffffffffff
lea eax, [ebp - 0x1804]
push eax
push 0
push 0xfde9
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00443fa5
mov esp, ebp
pop ebp
ret 0x10
call fcn.004443c2
int3
Function at 0x410410
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x4c8578]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push eax
lea eax, [ebp - 0x108]
mov esi, ecx
push 0x104
push eax
call fcn.00449d78
push 0x46e1e4
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.00449dd2
add esp, 0x18
lea eax, [ebp - 0x108]
push 0
push eax
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
push 0x46e1f0
push 0xaa
push str.ENVIRONMENT
lea eax, [ebp - 0x108]
mov ecx, esi
push eax
call fcn.004101f0
push 0x46e1fc
push 0xae
push str.CANDIDATE
lea eax, [ebp - 0x108]
mov ecx, esi
push eax
call fcn.004101f0
push 0x46e20c
push 0xa1
push str.ERRORURL
lea eax, [ebp - 0x108]
mov ecx, esi
push eax
call fcn.004101f0
push 0x46e21c
push 0x8d
push 0x46e22c
lea eax, [ebp - 0x108]
mov ecx, esi
push eax
call fcn.004101f0
push 0x46e238
push 0xad
push str.INSTITUTION
lea eax, [ebp - 0x108]
mov ecx, esi
push eax
call fcn.004101f0
push 0x46e248
push 0x85
push str.INTERVAL
lea eax, [ebp - 0x108]
mov ecx, esi
push eax
call fcn.004101f0
push 0x46e258
push 0xaf
push str.LANGUAGE
lea eax, [ebp - 0x108]
mov ecx, esi
push eax
call fcn.004101f0
push 0x46e268
push 0x8b
push str.LOGPATH
lea eax, [ebp - 0x108]
mov ecx, esi
push eax
call fcn.004101f0
push str.message.bin
push 0x9e
push str.MESSAGE
lea eax, [ebp - 0x108]
mov ecx, esi
push eax
call fcn.004101f0
push 0x46e290
push 0x88
push str.OPTIONS
lea eax, [ebp - 0x108]
mov ecx, esi
push eax
call fcn.004101f0
push 0x46e29c
push 0xab
push str.PROGRAM
lea eax, [ebp - 0x108]
mov ecx, esi
push eax
call fcn.004101f0
push 0x46e2a8
push 0x67
push 0x46e2b4
lea eax, [ebp - 0x108]
mov ecx, esi
push eax
call fcn.004101f0
push 0x46e2bc
push 0x8e
push 0x46e2c8
lea eax, [ebp - 0x108]
mov ecx, esi
push eax
call fcn.004101f0
push 0x46e2d0
push 0x6f
push 0x46e2dc
lea eax, [ebp - 0x108]
mov ecx, esi
push eax
call fcn.004101f0
push 0x46e2e4
push 0x96
push 0x46e2f4
lea eax, [ebp - 0x108]
mov ecx, esi
push eax
call fcn.004101f0
push 0x46e300
push 0x94
push str.UPDATEURL
lea eax, [ebp - 0x108]
mov ecx, esi
push eax
call fcn.004101f0
push 0x46e310
push 0x75
push 0x46cf28
lea eax, [ebp - 0x108]
mov ecx, esi
push eax
call fcn.004101f0
push 0x46e318
push 0xa8
push str.KILLLIST
lea eax, [ebp - 0x108]
mov ecx, esi
push eax
call fcn.004101f0
push 0x46e334
push 0x7c
push str.ALTURL
lea eax, [ebp - 0x108]
mov ecx, esi
push eax
call fcn.004101f0
push str.ecminver.bin
push 0xa5
push str.ECMINVERSION
lea eax, [ebp - 0x108]
mov ecx, esi
push eax
call fcn.004101f0
push 0x46e350
push 0xbc
push str.KILLONQUITLIST
lea eax, [ebp - 0x108]
push eax
mov ecx, esi
call fcn.004101f0
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00443fa5
mov esp, ebp
pop ebp
ret 4