joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10211020
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x54
mov eax, dword [ebp + 8]
mov dword [0x1021fb34], 0x1626
mov ecx, dword [0x1021fb30]
add ecx, 0x31
mov dword [0x1021fb30], ecx
mov dword [ebp - 0x10], eax
call fcn.10210a50
xor ecx, ecx
mov edx, eax
mov esi, dword [eax + 0x3c]
mov dword [0x1021fb30], 0xd6b
mov esi, dword [eax + esi + 0x78]
mov dword [0x1021fb30], 0x12
mov edi, edx
add edi, dword [eax + esi + 0x20]
mov ebx, dword [eax + esi + 0x24]
mov dword [0x1021fb34], 0x40a
mov eax, dword [eax + esi + 0x18]
cmp eax, 0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x28], ecx
je 0x102111af
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x14]
add eax, ecx
mov dword [ebp - 0x2c], eax
xor eax, eax
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x30]
xor edx, edx
mov esi, dword [ebp - 0x24]
mov edi, dword [esi + eax*4]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x44], edx
mov eax, dword [ebp - 0x44]
mov ecx, eax
mov edx, dword [ebp - 0x40]
add ecx, edx
mov esi, dword [ebp - 0x1c]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov bl, cl
mov dword [ebp - 0x48], eax
mov byte [ebp - 0x49], bh
mov byte [ebp - 0x4a], cl
mov byte [ebp - 0x4b], bl
je 0x1021113c
mov eax, dword [ebp - 0x48]
add eax, 1
mov cl, byte [ebp - 0x49]
cmp cl, 0
setne dl
mov dword [ebp - 0x50], eax
mov byte [ebp - 0x51], dl
mov al, byte [ebp - 0x4a]
mov cl, byte [ebp - 0x51]
and al, cl
mov edx, dword [ebp - 0x50]
cmp edx, 0x20
setb ah
and al, ah
test al, 1
mov al, byte [ebp - 0x4a]
mov dword [ebp - 0x44], edx
mov byte [ebp - 0x4b], al
jne 0x102110d4
mov al, byte [ebp - 0x4b]
test al, 1
mov ecx, dword [ebp - 0x3c]
mov dword [ebp - 0x58], ecx
jne 0x10211179
mov eax, dword [ebp - 0x3c]
add eax, 2
mov ecx, dword [ebp - 0x38]
add ecx, 1
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x60], ecx
mov eax, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x18]
cmp eax, ecx
mov edx, dword [ebp - 0x5c]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], edx
jb 0x102110ba
jmp 0x102111a8
mov eax, dword [ebp - 0x58]
movzx eax, word [eax]
mov dword [0x1021fb34], 0x182a
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
add ecx, dword [ecx + edx + 0x1c]
mov esi, dword [ebp - 0x1c]
add esi, dword [ecx + eax*4]
mov dword [0x1021fb30], 0x274
mov dword [ebp - 0x28], esi
jmp 0x102111af
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x102111af
mov eax, dword [ebp - 0x28]
add esp, 0x54
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x102111c0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov dword [ebp - 4], 0
mov eax, dword [0x1021fb34]
add eax, 0x1c78
mov dword [0x1021fb34], eax
mov eax, dword fs:[0x30]
mov dword [ebp - 4], eax
xor ecx, ecx
mov dword [0x1021fb34], 0x19
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], ecx
jmp 0x10211227
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff7
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2], 0x64
je 0x102112da
jmp 0x1021132d
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], edx
je 0x1021125b
mov eax, dword [ebp - 0x1c]
add eax, 1
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
cmp eax, 0x104
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x20], ecx
jl 0x10211227
mov eax, dword [ebp - 0x20]
mov dword [0x1021fb34], 0x56e
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x14], eax
jne 0x1021132d
mov dword [0x1021fb30], 0x582
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff4
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x28]
cmp word [eax + ecx*2], 0x6f
jne 0x1021132d
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
mov dx, word [eax + ecx*2 - 0x16]
mov word [ebp - 0x2a], dx
mov ax, word [ebp - 0x2a]
cmp ax, 0x61
jne 0x1021132d
mov dword [0x1021fb30], 0x7df
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x14], 0x64
je 0x10211205
jmp 0x1021132d
mov dword [0x1021fb30], 0x91c
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x10], 0x6c
sete dl
mov byte [ebp - 0x2b], dl
mov al, byte [ebp - 0x2b]
test al, 1
jne 0x10211300
jmp 0x1021132d
mov dword [0x1021fb34], 0x153e
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0xe], 0x6c
jne 0x1021132d
mov dword [0x1021fb34], 0x190e
mov eax, 1
mov dword [ebp - 0x30], eax
jmp 0x1021133c
xor eax, eax
mov dword [0x1021fb30], 0x10e3
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
add esp, 0x30
pop ebp
ret
Function at 0x10211c60
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x90
mov dword [0x1021fb30], 0x1594
call fcn.10001090
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x24], ecx
jne 0x10211de2
lea eax, [esp + 0x38]
mov dword [0x1021fb34], 0x1aa1
mov dword [0x1021fb30], 0x17ad
mov dword [esp + 0x20], eax
call fcn.102111c0
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x1c], ecx
jne 0x10211dda
lea eax, [esp + 0x28]
mov dword [esp], eax
call fcn.10211430
lea ecx, [0x10210150]
mov edx, dword [esp + 0x28]
mov dword [esp + 0x80], edx
mov dword [0x1021fb34], 0x1364
mov dword [esp + 0x48], 0x12da00
mov edx, dword [0x1021fb1c]
mov dword [esp + 0x5c], edx
mov edx, dword [0x1021fb20]
mov dword [esp + 0x40], edx
mov edx, dword [0x1021fb24]
mov dword [esp + 0x4c], edx
mov edx, dword [0x1021fb28]
mov dword [esp + 0x6c], edx
mov edx, dword [0x1021fb2c]
mov dword [esp + 0x50], edx
mov dword [0x1021fb30], 0x423
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ecx
mov eax, dword [esp + 0x14]
cmp word [eax], 0x5a4d
mov dword [esp + 0x10], eax
jne 0x10211d58
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 0xc], eax
mov dword [esp + 8], ecx
je 0x10211d6c
mov eax, dword [esp + 0x10]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esp + 0x14], eax
jmp 0x10211d31
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x38]
mov dword [esp + 0x3c], ecx
mov dword [0x1021fb34], 0x2099
mov eax, dword [ecx + eax + 0x50]
mov dword [esp + 0x74], eax
mov dword [0x1021fb30], 0xa15
mov eax, dword [esp + 0x30]
mov dword [esp], edx
mov dword [esp + 4], eax
call fcn.10210d60
mov ecx, dword [0x1021fb30]
add ecx, 0xbd7
mov dword [0x1021fb30], ecx
mov ecx, esp
lea edx, [esp + 0x38]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 1
mov dword [0x1021fb30], 0x1824
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
mov esp, ebp
pop ebp
ret
Function at 0x403206
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
test ebx, 0xffff0000
push esi
push edi
mov edi, ecx
mov dword [edi + 0x58], ebx
jne 0x403226
cmp dword [edi + 0x54], 0
jne 0x403226
movzx eax, bx
mov dword [edi + 0x54], eax
call fcn.0040511d
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [esp + 0x18]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.004031cd
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
ret 8

Function at 0x40a1f7
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push esi
push edi
xor edi, edi
xor ebx, ebx
cmp dword [esp + 0x14], edi
mov ebp, ecx
je 0x40a23a
call fcn.0040511d
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x40a23a
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x40a255
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
push ebx
mov ecx, ebp
call fcn.00409dae
test ebx, ebx
mov esi, eax
je 0x40a253
test edi, edi
je 0x40a253
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x418407
Capabilities:
Encode data using xor

Disassembly:
dec ebp
or dword [0x483609], 0xff32251d
call [0xffff3491]
sbb eax, 0xffff3491
jno 0x418439
xor al, 0x9c
fmul qword [eax]
mov al, 0xe8
push cs
mov fs, word [ebx + 0x8def70]
mov fs, edx
jno 0x41841a
or eax, 0x1aedeb0
dec ebp
add al, 0x1d
cmovle edi, edi
jmp [ebx]
jno 0x418413
sbb eax, 0xffff3228
js 0x41848f
mov eax, dword [0xff586f1d]
jmp [ebx]
dec eax
add al, bh
test al, 0x9f
invalid
Function at 0x4fe7c0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xa3000]
push edi
jmp 0x4fe7da
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4fe7e1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4fe7d0
mov eax, 1
add ebx, ebx
jne 0x4fe7f3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4fe804
jne 0x4fe823
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4fe823
dec eax
add ebx, ebx
jne 0x4fe810
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4fe7e8
add ebx, ebx
jne 0x4fe81f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4fe875
xor ecx, ecx
sub eax, 3
jb 0x4fe83b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4fe8aa
sar eax, 1
mov ebp, eax
jmp 0x4fe846
add ebx, ebx
jne 0x4fe846
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4fe814
inc ecx
add ebx, ebx
jne 0x4fe854
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4fe814
add ebx, ebx
jne 0x4fe861
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4fe856
jne 0x4fe872
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4fe856
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4fe894
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4fe886
jmp 0x4fe7d6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4fe894
add edi, ecx
jmp 0x4fe7d6
pop esi
mov edi, esi
mov ecx, 0x3b6c
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4fe8b2
cmp byte [edi], 0x17
jne 0x4fe8b2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4fe8b7
lea edi, [esi + 0xf8000]
mov eax, dword [edi]
or eax, eax
je 0x4fe926
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x11aa18]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x11aaac]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4fe8e4
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x11aab4]
or eax, eax
je 0x4fe920
mov dword [ebx], eax
add ebx, 4
jmp 0x4fe901
call dword [esi + 0x11aab0]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x4fe957
cmp al, 0xef
ja 0x4fe94a
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x4fe92c
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x4fe939
mov ebp, dword [esi + 0x11aab8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x227]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4fe98b
sub esp, 0xffffff80
jmp 0x435126
Function at 0x401490
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push 0x403170
push 0x403170
push str.i32.d
push 0x4031e8
push 0x4031f0
push 5
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x34], eax
call fcn.004010f0
add esp, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x401698
push ebx
push esi
push edi
push str.textW
push str.ireCon
push str.ptAcqu
push 0x403210
push 0x40316f
push 5
call fcn.004011a0
push str.teHash
push 0x40321c
push str.yptC
push 0x403228
push 0x40316f
push 5
mov esi, eax
call fcn.004011a0
push 0x40322c
push str.ashD
push str.yptH
push 0x403228
push 0x40316f
push 5
mov dword [ebp - 0x1c], eax
call fcn.004011a0
add esp, 0x48
mov dword [ebp - 0x18], eax
push str.aram
push 0x403248
push str.GetHa
push str.rypt
push 0x40325c
push 0x40316f
push 6
call fcn.004011a0
push str.Hash
push 0x403268
push 0x40326c
push str.yptD
push 0x403228
push 0x40316f
push 6
mov dword [ebp - 0x20], eax
call fcn.004011a0
push str.ntext
push str.seCo
push str.elea
push str.yptR
push 0x403228
push 0x40316f
push 6
mov ebx, eax
call fcn.004011a0
add esp, 0x54
mov edi, eax
push esi
push dword [ebp - 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call esi
push dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
push dword [ebp - 0x14]
call esi
push dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
push dword [ebp - 0x14]
call esi
push dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
push dword [ebp - 0x14]
call esi
push ebx
mov ebx, dword [ebp - 0x14]
push ebx
mov dword [ebp - 0x1c], eax
call esi
push edi
push ebx
mov dword [ebp - 0x20], eax
call esi
mov esi, eax
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x40168e
cmp dword [ebp - 0x24], 0
je 0x40168e
cmp dword [ebp - 0x18], 0
je 0x40168e
cmp dword [ebp - 0x1c], 0
je 0x40168e
mov edi, dword [ebp - 0x20]
test edi, edi
je 0x40168e
test esi, esi
je 0x40168e
push 0xf0000000
push 1
push 0
push 0
lea ecx, [ebp - 0xc]
push ecx
call eax
test eax, eax
je 0x40168e
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x8003
push dword [ebp - 0xc]
call dword [ebp - 0x24]
push 0
test eax, eax
je 0x401689
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
push dword [ebp - 8]
call dword [ebp - 0x18]
test eax, eax
je 0x401682
push 0
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x10
push eax
push dword [ebp - 0x34]
push 2
push dword [ebp - 8]
call dword [ebp - 0x1c]
push dword [ebp - 8]
call edi
push 0
push dword [ebp - 0xc]
call esi
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401fec
mov esp, ebp
pop ebp
ret
Function at 0x4027ec
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40282b
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40282b
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40282b
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40282b
cmp dword [ecx + 0x74], 0xe
jbe 0x40282b
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x4019e0
Capabilities:
Check os version

Disassembly:
sub esp, 0x98
mov eax, dword [0x41b188]
xor eax, esp
mov dword [esp + 0x94], eax
lea eax, [esp]
push eax
mov dword [esp + 4], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esp + 0x94]
xor eax, eax
cmp dword [esp + 4], 6
sete al
xor ecx, esp
call fcn.00407b7c
add esp, 0x98
ret
Function at 0x4037c0
Capabilities:
Clear file content
Write file on windows

Disassembly:
push ecx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_SetLastError]
push 0
call edi
mov eax, dword [esp + 0x10]
push 0
push 0x80
push 4
push 0
push 0
push 0x40000000
push eax
call dword [0x41c244]
mov esi, eax
cmp esi, 0xffffffff
je 0x403818
push 0
call edi
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
push 0
lea ecx, [esp + 0xc]
push ecx
push edx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x403818
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, 0xffffffff
mov edi, eax
je 0x40382c
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ecx
ret

Function at 0x403c70
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 0x414
mov eax, dword [0x41b188]
xor eax, esp
mov dword [esp + 0x410], eax
movzx eax, word [esp + 0x41c]
push ebx
push ebp
mov ebp, dword [esp + 0x428]
push esi
mov esi, dword [esp + 0x424]
push edi
push 0x4162a8
push eax
push esi
call dword [0x41c258]
mov edi, eax
test edi, edi
je 0x403cca
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x403cca
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
jne 0x403cd7
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
jmp 0x403d64
lea ecx, [esp + 0x10]
push ecx
push 0x104
mov word [esp + 0x18], 0
call dword [0x41c290]
test eax, eax
je 0x403d42
lea eax, [esp + 0x10]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x403d00
sub eax, edx
sar eax, 1
push str.OEIE7.reg
lea edx, [esp + eax*2 + 0x14]
push 0x4169b4
push edx
call dword [0x41c2e8]
add esp, 0xc
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
lea eax, [esp + 0x14]
push ebx
push eax
call fcn.004037c0
add esp, 0xc
test eax, eax
je 0x403d46
xor eax, eax
jmp 0x403d64
lea eax, [esp + 0x10]
mov edx, ebp
mov ecx, eax
sub edx, ecx
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x403d50
mov eax, 1
mov ecx, dword [esp + 0x420]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00407b7c
add esp, 0x414
ret
Function at 0x405270
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push edi
push 0x4162a8
push 0x3ec
push ebp
call dword [0x41c258]
mov edi, eax
test edi, edi
je 0x4052a7
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4052a7
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
jne 0x4052b3
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop ebp
xor eax, eax
pop ebx
ret
push esi
mov esi, dword [esp + 0x1c]
push esi
push 0x104
mov word [esi], 0
call dword [0x41c290]
mov eax, esi
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4052d0
sub eax, edx
sar eax, 1
push str.outlook.prf
lea eax, [esi + eax*2]
push 0x4169b4
push eax
call dword [0x41c2e8]
add esp, 0xc
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
push ebx
push esi
call fcn.004037c0
add esp, 0xc
test eax, eax
pop esi
je 0x40533d
cmp byte [0x41d2d8], 0
jne 0x405337
push 0
push 0x41d6e0
push 0x2f4a
call fcn.004039a0
mov ecx, dword [esp + 0x1c]
add esp, 4
push eax
push ecx
call dword [0x41c2d0]
pop edi
pop ebp
xor eax, eax
pop ebx
ret
pop edi
pop ebp
mov eax, 1
pop ebx
ret
Function at 0x4055c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 0xa88
mov eax, dword [0x41b188]
xor eax, esp
mov dword [esp + 0xa84], eax
mov eax, dword [esp + 0xa8c]
push ebx
push ebp
mov ebp, dword [esp + 0xaa0]
push esi
mov esi, dword [esp + 0xaa0]
push edi
mov edi, dword [esp + 0xaa0]
xor ebx, ebx
push 0x40
lea ecx, [esp + 0x30]
push ebx
push ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x34], ebx
call fcn.00407b90
add esp, 0xc
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebx
je 0x405629
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp eax, ebx
mov dword [esp + 0x14], eax
jne 0x405636
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
jmp 0x405808
lea edx, [esp + 0x6c]
push edx
push 0x104
mov word [esp + 0x74], bx
call dword [0x41c290]
test eax, eax
je 0x40579f
cmp esi, ebx
mov ebx, dword [0x41c2e8]
je 0x4056a6
lea eax, [esp + 0x6c]
mov edx, esi
mov ecx, eax
sub edx, ecx
jmp 0x405670
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x405670
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x405684
sub eax, edx
sar eax, 1
push str.OESetup.ins
lea edx, [esi + eax*2]
push 0x4169b4
push edx
call ebx
add esp, 0xc
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
mov eax, dword [esp + 0x18]
push eax
push esi
call fcn.004037c0
add esp, 0xc
test eax, eax
je 0x4056f5
cmp byte [0x41d2d8], 0
jne 0x40579f
push 0
push 0x41d6e0
push 0x2f80
call fcn.004039a0
mov ecx, dword [esp + 0x1c]
add esp, 4
push eax
push ecx
call dword [0x41c2d0]
xor eax, eax
jmp 0x405808
cmp byte [esp + 0xaac], 0
je 0x405803
lea eax, [esp + 0x6c]
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x405710
sub eax, edx
sar eax, 1
lea edx, [esp + eax*2 + 0x6c]
push 0x4161c0
push edx
call ebx
push 0x104
lea eax, [esp + 0x488]
push 0
push eax
call fcn.00407b90
lea ecx, [esp + 0x490]
push ecx
call fcn.004039d0
add esp, 0x18
test eax, eax
je 0x40579f
push str.OESetup.ins
lea edx, [esp + 0x480]
push edx
lea eax, [esp + 0x68c]
push str.__s___s__s
push eax
call ebx
add esp, 0x10
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0x74]
push eax
push 0
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x6a4]
push ecx
push 0
call dword [0x41c248]
test eax, eax
jne 0x4057a3
xor eax, eax
jmp 0x405808
mov edx, dword [esp + 0x18]
mov ebp, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x3e8
push edx
call ebp
test eax, eax
je 0x4057ef
mov esi, dword [sym.imp.USER32.dll_WaitForInputIdle]
mov edi, dword [sym.imp.USER32.dll_EnumThreadWindows]
mov eax, dword [esp + 0x18]
push 0x2710
push eax
call esi
mov ecx, dword [esp + 0x24]
push 0
push 0x403ba0
push ecx
call edi
mov edx, dword [esp + 0x18]
push 0x3e8
push edx
call ebp
test eax, eax
jne 0x4057c5
mov eax, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov ecx, dword [esp + 0x1c]
push ecx
call esi
mov eax, 1
mov ecx, dword [esp + 0xa94]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00407b7c
add esp, 0xa88
ret