joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402410
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x54e27b
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
mov eax, dword [0x5b0630]
xor eax, esp
mov dword [esp + 0x218], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5b0630]
xor eax, esp
push eax
lea eax, [esp + 0x230]
mov dword fs:[0], eax
mov eax, dword [esp + 0x240]
mov esi, ecx
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], eax
call fcn.00408d60
xor ebx, ebx
mov dword [esp + 0x238], ebx
mov ebp, 7
xor ecx, ecx
mov dword [esi + 0x30], ebp
mov dword [esi + 0x2c], ebx
mov word [esi + 0x1c], cx
xor edx, edx
mov dword [esi + 0x4c], ebp
mov dword [esi + 0x48], ebx
mov word [esi + 0x38], dx
xor eax, eax
mov dword [esi + 0x74], ebp
mov dword [esi + 0x70], ebx
mov word [esi + 0x60], ax
lea ecx, [esi + 0x80]
mov byte [esp + 0x238], 3
push ecx
mov dword [esi + 0x78], ebx
mov dword [esi + 0x7c], ebx
call fcn.00402020
lea edx, [esi + 0x330]
mov byte [esp + 0x238], 4
push edx
mov dword [esi + 0x32c], ebx
call fcn.0041bcd0
mov dword [esi + 0x34c], ebx
xor eax, eax
mov dword [esi + 0x368], ebp
mov dword [esi + 0x364], ebx
mov word [esi + 0x354], ax
lea edi, [esi + 0x37c]
mov dword [esi + 0x370], ebx
mov dword [esi + 0x374], ebx
xor ecx, ecx
mov dword [edi + 0x18], ebp
mov dword [edi + 0x14], ebx
mov word [edi + 4], cx
mov edx, dword [esp + 0x244]
mov byte [esp + 0x238], 8
push 0x88
mov dword [esi + 0x58], edx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x398], ebx
mov dword [esi + 0x39c], ebx
call fcn.00450beb
add esp, 4
mov dword [esp + 0x20], eax
mov ebp, dword [esp + 0x18]
mov byte [esp + 0x238], 9
cmp eax, ebx
je 0x40254f
push ebp
mov ecx, eax
call fcn.004119c0
jmp 0x402551
xor eax, eax
mov byte [esp + 0x238], 8
push 0x206
mov dword [esi + 0x328], eax
lea ecx, [esp + 0x2a]
xor eax, eax
push ebx
push ecx
mov byte [esi + 0x378], bl
mov word [esp + 0x30], ax
call fcn.00523d50
add esp, 0xc
lea edx, [esp + 0x24]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [esp + 0x24]
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
cmp cx, bx
jne 0x402596
mov ecx, dword [str.7z.dll]
mov edx, dword [0x589228]
mov dword [eax], ecx
mov ecx, dword [0x58922c]
mov dword [eax + 4], edx
mov dx, word [0x589230]
mov dword [eax + 8], ecx
mov word [eax + 0xc], dx
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esi + 0x348], eax
mov eax, ebp
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4025e0
sub eax, edx
sar eax, 1
push eax
push ebp
mov ecx, edi
call fcn.0040c5e0
call fcn.00403ca0
mov ecx, esi
call fcn.00403d40
mov edi, esi
call fcn.004045b0
mov eax, esi
mov ecx, dword [esp + 0x230]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x218]
xor ecx, esp
call fcn.00523c2c
add esp, 0x228
ret 8
Function at 0x403ca0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x4c
mov eax, dword [0x5b0630]
xor eax, esp
mov dword [esp + 0x48], eax
cmp dword [esi + 0x394], 8
push edi
jb 0x403cc6
mov eax, dword [esi + 0x380]
jmp 0x403ccc
lea eax, [esi + 0x380]
push 0x589388
push eax
call fcn.005296f3
mov edi, eax
add esp, 8
test edi, edi
je 0x403d2b
xor eax, eax
push 0x3e
push eax
lea ecx, [esp + 0x12]
push ecx
mov word [esp + 0x14], ax
call fcn.00523d50
push edi
push 0x40
lea edx, [esp + 0x1c]
push 1
push edx
call fcn.005299aa
push edi
call fcn.00529a3e
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x48]
add esp, 0x20
mov dword [esi + 0x370], eax
or eax, ecx
mov dword [esi + 0x374], ecx
je 0x403d2b
mov byte [esi + 0x378], 1
mov ecx, dword [esp + 0x4c]
pop edi
xor ecx, esp
call fcn.00523c2c
mov esp, ebp
pop ebp
ret
Function at 0x404a40
Capabilities:
Create thread

Disassembly:
sub esp, 0xc
push ebx
push esi
push edi
push 0xb2c
mov ebx, eax
mov edi, ecx
call fcn.00524d69
add esp, 4
push 0xb2c
mov esi, eax
push 0
push esi
call fcn.00523d50
mov edx, esi
add esp, 0xc
mov eax, edi
sub edx, edi
nop
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x404a70
test ebx, ebx
je 0x404aaa
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x404a83
sub eax, edx
je 0x404aaa
mov ecx, esi
sub ecx, ebx
mov eax, ebx
lea edx, [ecx + 0x104]
lea ebx, [ebx]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x404aa0
push esi
push 0
push 0x404b30
call fcn.005245a5
mov esi, dword [esp + 0x28]
mov ecx, dword [esi + 0x33c]
add esi, 0x330
add esp, 0xc
mov dword [esp + 0xc], eax
test ecx, ecx
jne 0x404ad6
xor edx, edx
jmp 0x404ade
mov edx, dword [esi + 0x14]
sub edx, ecx
sar edx, 2
mov edi, dword [esi + 0x10]
mov ebx, edi
sub ebx, ecx
sar ebx, 2
cmp ebx, edx
jae 0x404afd
mov dword [edi], eax
add edi, 4
mov dword [esi + 0x10], edi
pop edi
pop esi
pop ebx
add esp, 0xc
ret 4
cmp ecx, edi
jbe 0x404b06
call fcn.00524172
mov eax, dword [esi]
push edi
push eax
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x1c]
push eax
mov eax, esi
call fcn.0040ad90
pop edi
pop esi
pop ebx
add esp, 0xc
ret 4
Function at 0x4065f0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x54eaf0
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x5b0630]
xor eax, esp
mov dword [esp + 0x38], eax
push ebx
push esi
push edi
mov eax, dword [0x5b0630]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
mov esi, dword [ebp + 0xc]
xor edi, edi
xor eax, eax
mov word [esp + 0x30], ax
mov eax, esi
mov ebx, ecx
mov dword [esp + 0x44], 7
mov dword [esp + 0x40], edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x406646
sub eax, edx
sar eax, 1
push eax
push esi
lea ecx, [esp + 0x34]
call fcn.0040c5e0
lea ecx, [esp + 0x2c]
mov dword [esp + 0x58], edi
push ecx
lea edi, [esp + 0x14]
call fcn.00416200
add esp, 4
mov byte [esp + 0x58], 1
mov eax, dword [esp + 0x14]
mov edi, 0x10
cmp dword [esp + 0x28], edi
jae 0x40668d
lea eax, [esp + 0x14]
push ebx
mov ecx, str.12990103
call fcn.00404a40
mov eax, dword [ebx + 0x58]
test eax, eax
je 0x4066a9
mov edx, dword [ebp + 8]
push esi
push edx
call eax
add esp, 8
cmp dword [esp + 0x28], edi
jb 0x4066bc
mov eax, dword [esp + 0x14]
push eax
call fcn.00450c25
add esp, 4
cmp dword [esp + 0x44], 8
mov dword [esp + 0x28], 0xf
mov dword [esp + 0x24], 0
mov byte [esp + 0x14], 0
jb 0x4066e5
mov ecx, dword [esp + 0x30]
push ecx
call fcn.00450c25
add esp, 4
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.00523c2c
mov esp, ebp
pop ebp
ret 8
Function at 0x406a10
Capabilities:
Get file version info

Disassembly:
sub esp, 0x31c
mov eax, dword [0x5b0630]
xor eax, esp
mov dword [esp + 0x318], eax
push ebp
push esi
xor esi, esi
push 0x103
lea eax, [esp + 0x19]
push esi
mov dword [esp + 0x10], esi
push eax
mov byte [esp + 0x20], 0
call fcn.00523d50
add esp, 0xc
push 0x208
lea ecx, [esp + 0x11c]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x11c]
push eax
mov dword [esp + 0x14], esi
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebp, eax
cmp ebp, esi
je 0x406afe
push edi
push ebp
push 2
mov dword [esp + 0x1c], esi
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, dword [esp + 0x10]
mov edi, eax
push edi
push ebp
push ecx
lea edx, [esp + 0x128]
push edx
call sub.VERSION.dll_GetFileVersionInfoW
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x10]
push ecx
push 0x5892a0
push edi
call sub.VERSION.dll_VerQueryValueW
mov eax, dword [esp + 0xc]
mov cx, word [eax + 0x12]
mov dx, word [eax + 0x10]
mov di, word [eax + 0x16]
movzx eax, word [eax + 0x14]
push eax
movzx eax, di
push eax
movzx edx, dx
movzx eax, cx
push edx
push eax
lea ecx, [esp + 0x28]
push str._d._d._d._d
push ecx
call fcn.005292f5
add esp, 0x18
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
xor esi, esi
pop edi
mov dword [ebx + 0x14], esi
lea eax, [esp + 0x14]
pop esi
mov dword [ebx + 0x18], 0xf
mov byte [ebx + 4], 0
lea edx, [eax + 1]
pop ebp
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x406b15
sub eax, edx
push eax
lea edx, [esp + 0x10]
push edx
mov ecx, ebx
call fcn.0040bfb0
mov ecx, dword [esp + 0x318]
xor ecx, esp
mov eax, ebx
call fcn.00523c2c
add esp, 0x31c
ret

Function at 0x406b50
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x5b0630]
xor eax, esp
mov dword [esp + 0x114], eax
push 0x114
lea eax, [esp + 4]
push 0
push eax
call fcn.00523d50
add esp, 0xc
lea ecx, [esp]
push ecx
mov dword [esp + 4], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 4], 6
mov ecx, dword [esp + 0x114]
sbb eax, eax
xor ecx, esp
inc eax
call fcn.00523c2c
add esp, 0x118
ret
Function at 0x406bb0
Capabilities:
Create shortcut via ishelllink

Disassembly:
sub esp, 0x21c
mov eax, dword [0x5b0630]
xor eax, esp
mov dword [esp + 0x218], eax
mov eax, dword [esp + 0x220]
push ebp
mov ebp, dword [esp + 0x228]
push esi
push 0
mov esi, ecx
mov dword [esp + 0x14], eax
call dword [sym.imp.ole32.dll_CoInitialize]
lea ecx, [esp + 8]
push ecx
push 0x589204
push 1
push 0
push 0x588a08
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x406c24
mov eax, dword [esp + 8]
mov edx, dword [eax]
mov edx, dword [edx]
lea ecx, [esp + 0xc]
push ecx
push 0x552c6c
push eax
call edx
test eax, eax
mov eax, dword [esp + 8]
mov ecx, dword [eax]
jge 0x406c2b
mov edx, dword [ecx + 8]
push eax
call edx
xor al, al
jmp 0x406cdd
test esi, esi
jne 0x406c3e
mov edx, dword [0x5b7a00]
push edx
push eax
mov eax, dword [ecx + 0x50]
call eax
jmp 0x406c45
mov edx, dword [ecx + 0x50]
push esi
push eax
call edx
test edi, edi
je 0x406c6e
mov eax, edi
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x406c50
sub eax, edx
sar eax, 1
je 0x406c6e
mov eax, dword [esp + 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x2c]
push edi
push eax
call edx
test ebx, ebx
je 0x406c7f
mov eax, dword [esp + 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x24]
push ebx
push eax
call edx
mov eax, dword [esp + 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x3c]
push 0
push eax
call edx
test ebp, ebp
je 0x406ca9
mov eax, dword [esp + 0x10]
push ebp
push eax
lea ecx, [esp + 0x20]
push str._s_s
push ecx
call fcn.00523e01
add esp, 0x10
mov eax, dword [esp + 0xc]
mov edx, dword [eax]
mov edx, dword [edx + 0x18]
push 1
lea ecx, [esp + 0x1c]
push ecx
push eax
call edx
mov esi, eax
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
xor eax, eax
test esi, esi
setge al
mov ecx, dword [esp + 0x220]
pop esi
pop ebp
xor ecx, esp
call fcn.00523c2c
add esp, 0x21c
ret 8
Function at 0x407770
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x54ec20
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push ebx
push esi
push edi
mov eax, dword [0x5b0630]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
mov esi, ecx
push esi
xor edi, edi
push edi
push 0x4078f0
call fcn.005245a5
mov dword [esi + 0x39c], eax
add esp, 0xc
lea eax, [esp + 0x30]
push eax
call fcn.0041bcd0
lea ecx, [esp + 0x30]
lea ebx, [esi + 0x208]
push ecx
mov dword [esp + 0x54], edi
call fcn.004090d0
lea edx, [esp + 0x18]
push edx
call fcn.0041bcd0
lea eax, [esp + 0x18]
lea ebx, [esi + 0x220]
push eax
mov byte [esp + 0x54], 1
call fcn.004090d0
mov ecx, dword [esp + 0x40]
sub ecx, dword [esp + 0x3c]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
jne 0x407848
mov ecx, dword [esp + 0x28]
sub ecx, dword [esp + 0x24]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
jne 0x407848
push esi
mov eax, 0x5891a1
mov ecx, str.12030000
call fcn.00404a40
mov ecx, esi
call fcn.00405290
mov esi, dword [esi + 0x54]
cmp esi, edi
je 0x407857
call esi
jmp 0x407857
push esi
push edi
push 0x406d00
call fcn.005245a5
add esp, 0xc
mov eax, dword [esp + 0x24]
cmp eax, edi
je 0x40787b
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x28]
push ecx
push edx
call fcn.00410c10
mov eax, dword [esp + 0x2c]
push eax
call fcn.00450c25
add esp, 0xc
mov ecx, dword [esp + 0x18]
push ecx
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], edi
call fcn.00450c25
mov eax, dword [esp + 0x40]
add esp, 4
cmp eax, edi
je 0x4078b8
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x40]
push edx
push ecx
call fcn.00410c10
mov edx, dword [esp + 0x44]
push edx
call fcn.00450c25
add esp, 0xc
mov eax, dword [esp + 0x30]
push eax
mov dword [esp + 0x40], edi
mov dword [esp + 0x44], edi
mov dword [esp + 0x48], edi
call fcn.00450c25
add esp, 4
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x44
ret
Function at 0x40c2b0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x549a3b
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x5b0630]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.00523197
push 4
mov dword [esp + 0x24], 0
call fcn.00450beb
mov edi, eax
add esp, 4
test edi, edi
je 0x40c332
call fcn.005229bd
mov dword [edi], eax
call fcn.005227eb
push 0
lea ecx, [esp + 0x14]
mov ebx, eax
call fcn.0052270f
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x40c327
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0x10]
call fcn.00522737
jmp 0x40c334
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret

Function at 0x40fc00
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x54af48
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
push edi
mov eax, dword [0x5b0630]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov ecx, dword [esp + 0x40]
xor edi, edi
push 0xffffffffffffffff
push edi
xor eax, eax
push ecx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], edi
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], edi
mov word [esp + 0x20], ax
call fcn.0040a7d0
mov edx, dword [esp + 0x44]
mov eax, edx
mov dword [esp + 0x34], edi
lea esi, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x40fc60
sub eax, esi
sar eax, 1
push eax
push edx
lea ecx, [esp + 0x18]
call fcn.0040c4c0
mov esi, dword [esp + 0x3c]
push 0xffffffffffffffff
push edi
xor edx, edx
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], edi
push eax
mov ecx, esi
mov word [esi + 4], dx
call fcn.0040a7d0
cmp dword [esp + 0x28], 8
jb 0x40fcad
mov eax, dword [esp + 0x14]
push eax
call fcn.00450c25
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x2c
ret
Function at 0x4119c0
Capabilities:
Get common file path
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x54e1b8
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x5b0630]
xor eax, esp
mov dword [esp + 0x210], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5b0630]
xor eax, esp
push eax
lea eax, [esp + 0x22c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x23c]
mov esi, ecx
xor ebx, ebx
lea ecx, [esi + 0x10]
mov dword [esi], ebx
push ebx
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push 0x5891a1
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], eax
mov byte [ecx + 4], bl
call fcn.0040bfb0
lea ecx, [esi + 0x2c]
mov dword [esp + 0x234], ebx
push ebx
mov edi, 7
xor edx, edx
mov dword [ecx + 0x18], edi
mov dword [ecx + 0x14], ebx
push 0x589988
mov word [ecx + 4], dx
call fcn.0040c5e0
lea ebp, [esi + 0x50]
mov byte [esi + 0x48], bl
xor eax, eax
mov dword [ebp + 0x18], edi
mov dword [ebp + 0x14], ebx
mov word [ebp + 4], ax
lea edi, [esi + 0x6c]
mov byte [esp + 0x234], 2
xor ecx, ecx
mov dword [edi + 0x18], 7
mov dword [edi + 0x14], ebx
push ebx
mov word [edi + 4], cx
push 0x589988
mov ecx, edi
call fcn.0040c5e0
push 0x206
lea eax, [esp + 0x22]
xor edx, edx
push ebx
mov byte [esp + 0x23c], 3
push eax
mov word [esp + 0x28], dx
call fcn.00523d50
add esp, 0xc
lea ecx, [esp + 0x1c]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [esp + 0x1c]
lea ecx, [eax + 2]
mov dx, word [eax]
add eax, 2
cmp dx, bx
jne 0x411ac4
sub eax, ecx
sar eax, 1
push eax
lea edx, [esp + 0x20]
push edx
mov ecx, edi
call fcn.0040c5e0
mov edi, dword [esp + 0x14]
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esi + 0x4c], eax
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x411af3
sub eax, edx
sar eax, 1
push eax
push edi
mov ecx, ebp
call fcn.0040c5e0
call fcn.00411b70
mov ecx, esi
call fcn.00411cb0
test al, al
je 0x411b23
cmp dword [0x5b8574], ebx
jne 0x411b44
push 1
push str.ERROR
push 0x589cb8
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, esi
mov ecx, dword [esp + 0x22c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.00523c2c
add esp, 0x224
ret 4
Function at 0x413bd0
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, dword [esp + 0xc]
push edi
mov edi, ecx
test eax, eax
je 0x413c96
test ebp, ebp
je 0x413c96
mov ecx, dword [edi + 0x4c]
push ebx
push esi
push eax
movzx eax, word [esp + 0x18]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x413c8d
mov edx, dword [edi + 0x4c]
push esi
push edx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x413c8d
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [esp + 0x18], eax
test eax, eax
je 0x413c8d
mov eax, dword [edi + 0x4c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push 0x589ce0
push ebp
mov ebx, eax
call fcn.005296f3
mov ebp, eax
add esp, 8
test ebp, ebp
je 0x413c8d
xor esi, esi
test ebx, ebx
jbe 0x413c7b
lea ebx, [ebx]
mov edi, ebx
sub edi, esi
cmp edi, 0x800
jbe 0x413c61
mov edi, 0x800
mov ecx, dword [esp + 0x18]
push ebp
push edi
lea edx, [esi + ecx]
push 1
push edx
call fcn.0052a334
add esi, edi
add esp, 0x10
cmp esi, ebx
jb 0x413c50
push ebp
call fcn.00529a3e
add esp, 4
pop esi
pop ebx
pop edi
mov al, 1
pop ebp
ret 8
pop esi
pop ebx
pop edi
xor al, al
pop ebp
ret 8
pop edi
xor al, al
pop ebp
ret 8
Function at 0x414100
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x54cf52
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x5b0630]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov edi, dword [esp + 0x28]
xor ebx, ebx
mov dword [esp + 0x14], ebx
mov dword [edi], 0x589d78
mov dword [edi + 0x58], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
lea esi, [edi + 8]
push esi
mov dword [esp + 0x24], ebx
push edi
mov dword [esp + 0x1c], 1
call fcn.00414fe0
mov dword [esp + 0x20], 1
mov eax, dword [edi]
mov ecx, dword [eax + 4]
push esi
mov dword [edi + ecx], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
call fcn.00415b20
lea edx, [esi + 8]
mov dword [esi + 0x10], edx
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov byte [esi + 0x48], bl
mov byte [esi + 0x41], bl
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], ebx
mov eax, dword [esi + 0x24]
mov dword [eax], ebx
mov ecx, dword [esi + 0x34]
mov dword [ecx], ebx
mov edx, dword [esi + 0x10]
mov dword [edx], ebx
mov eax, dword [esi + 0x20]
mov edx, dword [0x5b8de8]
mov dword [eax], ebx
mov ecx, dword [esi + 0x30]
mov dword [ecx], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x44], edx
mov dword [esi + 0x3c], ebx
mov eax, dword [esp + 0x2c]
push eax
mov byte [esp + 0x24], 2
call fcn.00415410
test eax, eax
jne 0x4141f7
mov ecx, dword [edi]
mov ecx, dword [ecx + 4]
mov eax, dword [ecx + edi + 8]
add ecx, edi
or eax, 2
cmp dword [ecx + 0x28], ebx
jne 0x4141f0
or eax, 4
push ebx
push eax
call fcn.00401db0
mov eax, edi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret 8
Function at 0x415b20
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x5499cb
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5b0630]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, dword [esp + 0x24]
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.00523197
push 4
mov dword [esp + 0x20], 0
call fcn.00450beb
mov edi, eax
add esp, 4
test edi, edi
je 0x415b9e
call fcn.005229bd
mov dword [edi], eax
call fcn.005227eb
push 0
lea ecx, [esp + 0x14]
mov ebx, eax
call fcn.0052270f
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x415b93
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0x10]
call fcn.00522737
jmp 0x415ba0
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4