joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404f88
Capabilities:
Delete file
Set current directory
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [0x409220]
push edi
jmp 0x404fe0
cmp dword [0x408944], 0
jne 0x404fce
cmp dword [0x409a70], 0
jne 0x404fce
push 0x80
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push dword [edi]
mov esi, dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov edi, esi
test esi, esi
jne 0x404fa7
mov eax, dword [0x408940]
pop edi
pop esi
test eax, eax
je 0x405049
cmp dword [0x408944], 0
jne 0x405049
cmp dword [0x409a70], 0
jne 0x405049
push ecx
push 0x409224
push ecx
mov edx, 0x104
lea ecx, [ebp - 0x108]
call fcn.0040150c
test byte [0x409a74], 0x20
je 0x40502e
lea ecx, [ebp - 0x108]
call fcn.00406362
push 0x40114c
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea ecx, [ebp - 0x108]
call fcn.00402146
mov eax, dword [0x408940]
cmp word [0x409a80], 1
je 0x40505c
test eax, eax
je 0x40505c
call fcn.00401d74
mov ecx, dword [ebp - 4]
and dword [0x408940], 0
xor ecx, ebp
call fcn.004069ed
mov esp, ebp
pop ebp
ret

Function at 0x405076
Capabilities:
Check if file exists
Create directory
Delete directory
Delete file
Get common file path
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10c], ecx
mov edi, edx
xor esi, esi
jmp 0x4050a2
mov ebx, dword [ebp - 0x110]
push ebx
push 0x4012c8
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.004014a4
add esp, 0x10
mov ecx, edi
inc ebx
mov dword [ebp - 0x110], ebx
mov ebx, 0x104
mov edx, ebx
push dword [ebp - 0x10c]
call fcn.00401405
lea eax, [ebp - 0x108]
mov edx, ebx
push eax
mov ecx, edi
call fcn.004062ff
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
cmp eax, 0xffffffff
je 0x405148
cmp dword [ebp - 0x110], 0x190
jl 0x40509c
push edi
push 0
push 0x4012d4
push dword [ebp - 0x10c]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
je 0x405133
xor esi, esi
push edi
inc esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push edi
call ebx
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004069ed
mov esp, ebp
pop ebp
ret 4
push 0
push edi
call ebx
xor esi, esi
test eax, eax
je 0x40510c
inc esi
mov dword [0x408940], esi
jmp 0x405133
Function at 0x4055c4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov edx, edi
lea ecx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x4055d4
sub edx, ecx
lea esi, [edx + 0x14]
push esi
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
test ebx, ebx
jne 0x405615
xor esi, esi
mov edx, 0x4b5
push esi
push 0x10
push esi
push esi
xor ecx, ecx
call fcn.004041b0
call fcn.00405f71
mov dword [0x409a88], eax
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push edi
mov edx, esi
mov ecx, ebx
call fcn.00401405
push 0x401308
mov edx, esi
mov ecx, ebx
call fcn.004062ff
xor esi, esi
push esi
push 0x4000080
push 1
push esi
push esi
push 0x40000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push ebx
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 4]
cmp eax, 0xffffffff
je 0x405602
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x405602
test al, 0x10
je 0x405602
xor eax, eax
mov dword [0x409a88], esi
inc eax
jmp 0x40560e
Function at 0x405f05
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x104
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x405f4f
push eax
push 0x10
push eax
push eax
mov edx, 0x4f0
xor ecx, ecx
call fcn.004041b0
call fcn.00405f71
mov dword [0x409a88], eax
xor eax, eax
jmp 0x405f5e
push 2
pop edx
push edx
lea ecx, [ebp - 0x108]
call fcn.0040567e
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004069ed
mov esp, ebp
pop ebp
ret

Function at 0x405f89
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor edi, edi
mov dword [ebp - 0x24], ecx
push edi
push 0x401324
lea eax, [ebp - 0x18]
mov dword [ebp - 0x1c], edi
xor esi, esi
push 0x14
push eax
inc esi
call fcn.004014a4
jmp 0x406019
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x406039
lea edx, [edi + 8]
mov ecx, edx
lea eax, [ecx + 1]
mov dword [ebp - 0x20], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x405fdb
sub ecx, dword [ebp - 0x20]
lea eax, [edx + 1]
add eax, ecx
push eax
push edx
push dword [edi + 4]
push dword [edi]
call dword [ebp - 0x24]
push edi
test eax, eax
je 0x40602f
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp - 0x1c]
inc eax
push eax
push 0x401324
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x18]
push 0x14
push eax
call fcn.004014a4
xor edi, edi
add esp, 0x10
lea eax, [ebp - 0x18]
push 0xa
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
jne 0x405fbb
jmp 0x406045
xor esi, esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
jmp 0x406045
mov dword [0x409a88], 0x80070714
xor esi, esi
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.004069ed
mov esp, ebp
pop ebp
ret

Function at 0x406172
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
push ecx
push 0x409224
push ecx
mov edx, 0x104
lea ecx, [ebp - 0x108]
call fcn.0040150c
mov edi, 0x401128
lea ecx, [ebp - 0x108]
push edi
mov edx, 0x104
call fcn.004062ff
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4061de
test al, 0x10
jne 0x4061de
push 8
push 0
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
jmp 0x4061e5
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.004069ed
mov esp, ebp
pop ebp
ret

Function at 0x4062e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4062f1
xor eax, eax
ret
shr eax, 4
not eax
and eax, 1
ret
Function at 0x406534
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xb4
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [0x408200]
xor esi, esi
mov dword [ebp - 0xb0], 0xc
mov dword [ebp - 0xa8], esi
cmp edi, 0xfffffffe
jne 0x40665c
lea eax, [ebp - 0xa4]
mov dword [0x408200], esi
push eax
mov dword [ebp - 0xa4], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x406656
xor edi, edi
inc edi
cmp dword [ebp - 0x94], edi
jne 0x406656
cmp dword [ebp - 0xa0], 4
jne 0x406656
cmp dword [ebp - 0x9c], 0xa
jae 0x406656
push 0x4a
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x406656
lea eax, [ebp - 0xac]
push eax
push 0x20019
push esi
push 0x401330
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x406656
lea eax, [ebp - 0xb0]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xb4]
push eax
push esi
push 0x401091
push dword [ebp - 0xac]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0xac]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x406628
mov eax, dword [0x408200]
jmp 0x40665e
lea edx, [ebp - 0xa8]
lea ecx, [ebp - 0x10]
call fcn.00406402
test eax, eax
je 0x406656
mov eax, dword [ebp - 0xa8]
and eax, 0x3ff
cmp eax, edi
je 0x40664e
cmp eax, 0xd
jne 0x406656
mov dword [0x408200], edi
jmp 0x40665c
mov edi, dword [0x408200]
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004069ed
mov esp, ebp
pop ebp
ret

Function at 0x406673
Capabilities:
Get disk size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push esi
xor esi, esi
cmp byte [ecx], 0
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
je 0x4066c2
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
je 0x4066c2
mov eax, dword [ebp - 4]
imul eax, dword [ebp - 8]
push 0x400
push dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov esi, eax
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4067cc
Capabilities:
Terminate process

Disassembly:
call fcn.004072d8
jmp 0x4067db
push 0x58
push 0x407568
call fcn.004073a4
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov edi, dword [eax + 4]
mov esi, ebx
mov edx, 0x4088ec
mov ecx, edi
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
je 0x40682a
cmp eax, edi
jne 0x40683d
xor esi, esi
inc esi
cmp dword [0x4088f0], 1
jne 0x40684a
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x406880
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x406812
cmp dword [0x4088f0], ebx
jne 0x406876
mov dword [0x4088f0], 1
push 0x40101c
push 0x401010
call fcn.004069c4
pop ecx
pop ecx
test eax, eax
je 0x406880
jmp 0x4069ad
mov dword [0x408224], 1
cmp dword [0x4088f0], 1
jne 0x4068a4
push 0x40100c
push 0x401004
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x4088f0], 2
test esi, esi
jne 0x4068b1
xor eax, eax
mov ecx, 0x4088ec
xchg dword [ecx], eax
cmp dword [0x4088f8], 0
je 0x4068d3
push 0x4088f8
call fcn.004071d0
pop ecx
test eax, eax
je 0x4068d3
push ebx
push 2
push ebx
call dword [0x4088f8]
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x1c], esi
mov edi, dword [ebp - 0x20]
mov cl, byte [esi]
cmp cl, 0x20
ja 0x406930
test cl, cl
je 0x4068ef
test edi, edi
jne 0x406930
mov al, byte [esi]
test al, al
je 0x4068ff
cmp al, 0x20
ja 0x4068ff
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x4068ef
test byte [ebp - 0x3c], 1
je 0x40690b
movzx eax, word [ebp - 0x38]
jmp 0x40690e
push 0xa
pop eax
push eax
push esi
push ebx
push 0x400000
call main
mov dword [0x408220], eax
cmp dword [0x408238], 0
jne 0x406989
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp cl, 0x22
jne 0x406941
xor eax, eax
test edi, edi
sete al
mov edi, eax
mov dword [ebp - 0x20], edi
movzx eax, cl
push eax
call dword [sym.imp.msvcrt.dll__ismbblead]
pop ecx
test eax, eax
je 0x406954
inc esi
mov dword [ebp - 0x1c], esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x4068e0
cmp dword [0x408224], 0
jne 0x40699d
call dword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x408220]
mov dword [ebp - 4], 0xfffffffe
jmp 0x4069b9
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.004073e9
ret

Function at 0x4070bf
Capabilities:
Parse pe header

Disassembly:
push 0xc
push 0x407590
call fcn.004073a4
xor ecx, ecx
mov eax, dword [ebp + 8]
test eax, eax
je 0x40711f
cmp eax, 0xffffffff
je 0x40711f
mov dword [ebp - 4], ecx
mov edx, 0x5a4d
cmp word [eax], dx
jne 0x407118
mov edx, dword [eax + 0x3c]
test edx, edx
js 0x407118
cmp edx, 0x10000000
jae 0x407118
add eax, edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [eax]
sub ecx, 0x4550
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
jmp 0x407115
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, ecx
call fcn.004073e9
ret 4
Function at 0x42e002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x42e00c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x403ac5
sub eax, 0x403a6b
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x42e030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
jne 0x42e01e
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp fcn.00401219
Function at 0x41c500
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x427850], 0
jne 0x41c581
cmp dword [0x427870], 0
jne 0x41c530
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x427870], eax
test eax, eax
jne 0x41c530
push str.GetEnvironmentStrings_failed
call fcn.0041bd1c
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x427870]
jmp 0x41c544
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.004168a4
pop ecx
mov edi, eax
test eax, eax
jne 0x41c53c
lea edi, [ebp + 1]
push edi
call fcn.004161a8
pop ecx
mov ebx, eax
mov dword [0x427854], ebx
test ebx, ebx
jne 0x41c56e
xor eax, eax
jmp 0x41c644
push edi
mov edx, dword [0x427870]
push edx
push ebx
call fcn.00416754
add esp, 0xc
jmp 0x41c5a1
xor esi, esi
mov ebx, dword [0x427850]
jmp 0x41c59b
push eax
call fcn.004168a4
pop ecx
test eax, eax
jne 0x41c597
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x41c58b
lea ebx, [esi + 4]
push 4
mov dword [0x427858], ebx
inc ebx
push ebx
call fcn.00415c80
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x41c5c4
xor eax, eax
jmp 0x41c644
cmp dword [0x427850], 0
jne 0x41c5f5
xor esi, esi
mov ebx, dword [0x427854]
mov eax, dword [esp]
mov ebp, eax
jmp 0x41c5e6
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.004168a4
pop ecx
mov edi, eax
test eax, eax
jne 0x41c5dc
jmp 0x41c626
xor esi, esi
mov ebx, dword [0x427850]
mov eax, dword [esp]
mov edi, eax
jmp 0x41c620
push eax
call fcn.004168a4
pop ecx
test eax, eax
je 0x41c615
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x41c619
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x41c604
mov eax, dword [0x427850]
test eax, eax
je 0x41c636
push eax
call fcn.004161b8
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x427850], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4046fa
Capabilities:
Encode data using xor

Disassembly:
xchg dword [ebx], ebp
popal
cmp esi, 0x138
mov ch, byte [ebx]
push eax
or ch, byte [edx]
call 0x15ac92b
lea ebp, [ebx]
add dword [eax + 0x456b5006], ebp
or byte [eax], bl
add eax, 0x50500046
call dword [0x7acc06c]
add byte [ecx + 0x3f351008], bl
add byte [esi], al
cmpsb byte [esi], byte es:[edi]
sub eax, dword [eax]
imul ebx, dword [ecx], 0x2ba605
sbb eax, dword [eax]
or dword [esi + 0x480d2b], esp
adc esi, dword [eax + 0x48]
add byte [edx], al
push 0x31660231
bound ebx, qword [eax]
xor byte [ecx], al
mov eax, dword [ebx]
loop 0x40476b
add byte [ebp + 0x3d31620f], al
das
sub al, al
bound esi, qword [ecx]
sbb dword [esp + ebx*4], eax
add byte [edx - 0x7ac372a9], ch
enter 0x412f, 0
mov ecx, dword [edi]
pop ebx
xor dword [edi + 0x57], edi
push ebx
mov ebx, dword [eax*4 + 0x315ccd50]
cmp eax, 0x2075b11
add byte [ebx + 0x4c7060d], ah
adc byte [esi + 0x68], 0xf8
rol dword [eax], 1
push 0x10005f0
arpl word [eax], si
xor byte [ebx], al
call 0x1056d558
invalid
Function at 0x401260
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, ecx
mov edi, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
cmp edx, eax
je 0x401288
push edi
push eax
push edx
call sub.msvcrt.dll_memcpy
mov edx, dword [esp + 0x2c]
add esp, 0xc
cmp edi, 8
jb 0x401332
shr edi, 3
xor eax, eax
mov dword [esp + 4], edi
nop word [eax + eax]
lea ecx, [eax + eax]
lea edi, [eax*2 + 1]
mov dword [esp], edi
mov dword [esp + 8], eax
mov eax, dword [edx + eax*8]
mov ebx, dword [edx + ecx*4 + 4]
mov edi, 0x11
nop dword [eax]
mov ebp, ebx
mov ebx, eax
xor ebx, dword [esi + edi*4]
mov dword [edx + ecx*4], ebx
mov edx, ebx
shr edx, 0x18
mov eax, ebx
shr eax, 0xe
and eax, 0x3fc
mov eax, dword [esi + eax + 0x448]
add eax, dword [esi + edx*4 + 0x48]
movzx edx, bh
xor eax, dword [esi + edx*4 + 0x848]
movzx edx, bl
add eax, dword [esi + edx*4 + 0xc48]
mov edx, dword [esp + 0x20]
xor eax, ebp
mov dword [edx + ecx*4], eax
mov ebp, dword [esp]
mov dword [edx + ebp*4], ebx
dec edi
cmp edi, 1
jne 0x4012c0
mov dword [edx + ecx*4], ebx
mov edi, dword [esp]
mov dword [edx + edi*4], eax
xor eax, dword [esi + 4]
mov dword [edx + edi*4], eax
xor ebx, dword [esi]
mov dword [edx + ecx*4], ebx
mov eax, dword [esp + 8]
inc eax
mov edi, dword [esp + 4]
cmp eax, edi
jne 0x4012a0
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 0xc

Function at 0x4014d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 0x18
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
movzx eax, ax
xor ecx, ecx
mov ecx, 0xa
mov dword [esp], 0
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
sub esp, 0xc
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
xor ecx, ecx
mov dword [esp], 0
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
sub esp, 8
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0xc]
xor ecx, ecx
mov dword [esp], 0
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
sub esp, 8
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x10]
mov dword [esp], eax
call fcn.00401580
sub esp, 4
mov ecx, dword [esp + 0x20]
call fcn.004015f0
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
call sub.msvcrt.dll_memcpy
add esp, 0x18
ret

Function at 0x402140
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov eax, ecx
mov dword [ecx + 0x1384], 0xffffffff
mov dword [ecx + 4], 0x1571
mov edx, 0x1571
mov ecx, 3
nop
mov esi, edx
shr esi, 0x1e
xor esi, edx
imul edx, esi, 0x6c078965
add edx, ecx
add edx, 0xfffffffe
mov dword [eax + ecx*4 - 4], edx
cmp ecx, 0x271
je 0x402196
mov esi, edx
shr esi, 0x1e
xor esi, edx
imul edx, esi, 0x6c078965
add edx, ecx
dec edx
mov dword [eax + ecx*4], edx
add ecx, 2
jmp 0x402160
mov dword [eax], 0x270
pop esi
ret
Function at 0x4021b0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov eax, ecx
mov edx, dword [esp + 8]
mov dword [ecx + 0x1384], 0xffffffff
mov dword [ecx + 4], edx
mov ecx, 3
nop dword [eax]
mov esi, edx
shr esi, 0x1e
xor esi, edx
imul edx, esi, 0x6c078965
add edx, ecx
add edx, 0xfffffffe
mov dword [eax + ecx*4 - 4], edx
cmp ecx, 0x271
je 0x402206
mov esi, edx
shr esi, 0x1e
xor esi, edx
imul edx, esi, 0x6c078965
add edx, ecx
dec edx
mov dword [eax + ecx*4], edx
add ecx, 2
jmp 0x4021d0
mov dword [eax], 0x270
pop esi
ret 4
Function at 0x403e38
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x403e77
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x403e77
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x403e77
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x403e77
cmp dword [ecx + 0x74], 0xe
jbe 0x403e77
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x405ab0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x405b0c
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x405b0c
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x405b0c
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x405b0c
cmp dword [ecx + 0x74], 0xe
jbe 0x405b0c
cmp dword [ecx + 0xe8], 0
je 0x405b0c
push dword [ebp + 8]
call fcn.00405cd0
add esp, 4
lea eax, [ebp - 0xc]
mov byte [ebp - 1], 0
mov dword [ebp - 0x18], eax
lea eax, [ebp - 8]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 1]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x18]
push eax
push 0x40e560
call fcn.00405ed0
add esp, 8
cmp dword [ebp - 8], 0
jne 0x405b41
push dword [ebp + 8]
call fcn.00405d60
mov esp, ebp
pop ebp
ret

Function at 0x405b50
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 2
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x405bac
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x405bac
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x405bac
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x405bac
cmp dword [ecx + 0x74], 0xe
jbe 0x405bac
cmp dword [ecx + 0xe8], 0
je 0x405bac
push dword [ebp + 8]
call fcn.00405cd0
add esp, 4
lea eax, [ebp - 0xc]
mov byte [ebp - 1], 0
mov dword [ebp - 0x18], eax
lea eax, [ebp - 8]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 1]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x18]
push eax
push 0x40e560
call fcn.00405ed0
add esp, 8
cmp dword [ebp - 8], 0
jne 0x405be1
push dword [ebp + 8]
call fcn.00405d60
mov esp, ebp
pop ebp
ret

Function at 0x405d60
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
call fcn.00405d50
mov esi, dword [ebp + 8]
test al, al
je 0x405d7e
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call fcn.00405cd0
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]