joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47b5e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x4f00d0]
push edi
test eax, eax
je 0x47b659
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax + 0xc]
jge 0x47b659
mov eax, dword [eax + 0x10]
mov edi, dword [eax + ecx*4]
test edi, edi
je 0x47b659
push esi
mov esi, dword [ebp + 0xc]
push 5
push dword [ebp + 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x47b641
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x47b641
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x47b641
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push eax
push esi
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamA]
pop esi
pop edi
pop ebp
ret 0x18
push dword [ebp + 0x1c]
mov eax, dword [edi + 0x54]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push esi
call eax
pop esi
pop edi
pop ebp
ret 0x18
xor eax, eax
pop edi
pop ebp
ret 0x18

Function at 0x47b660
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x4f00d0]
push edi
test eax, eax
je 0x47b6d9
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax + 0xc]
jge 0x47b6d9
mov eax, dword [eax + 0x10]
mov edi, dword [eax + ecx*4]
test edi, edi
je 0x47b6d9
push esi
mov esi, dword [ebp + 0xc]
push 5
push dword [ebp + 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x47b6c1
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x47b6c1
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x47b6c1
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push eax
push esi
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamW]
pop esi
pop edi
pop ebp
ret 0x18
push dword [ebp + 0x1c]
mov eax, dword [edi + 0x58]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push esi
call eax
pop esi
pop edi
pop ebp
ret 0x18
xor eax, eax
pop edi
pop ebp
ret 0x18

Function at 0x47b6e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x4f00d0]
push edi
test eax, eax
je 0x47b759
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax + 0xc]
jge 0x47b759
mov eax, dword [eax + 0x10]
mov edi, dword [eax + ecx*4]
test edi, edi
je 0x47b759
push esi
mov esi, dword [ebp + 0xc]
push 5
push dword [ebp + 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x47b741
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x47b741
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x47b741
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push eax
push esi
call dword [sym.imp.USER32.dll_DialogBoxIndirectParamA]
pop esi
pop edi
pop ebp
ret 0x18
push dword [ebp + 0x1c]
mov eax, dword [edi + 0x4c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push esi
call eax
pop esi
pop edi
pop ebp
ret 0x18
xor eax, eax
pop edi
pop ebp
ret 0x18
Function at 0x47b760
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x4f00d0]
push edi
test eax, eax
je 0x47b7d9
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax + 0xc]
jge 0x47b7d9
mov eax, dword [eax + 0x10]
mov edi, dword [eax + ecx*4]
test edi, edi
je 0x47b7d9
push esi
mov esi, dword [ebp + 0xc]
push 5
push dword [ebp + 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x47b7c1
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x47b7c1
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x47b7c1
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push eax
push esi
call dword [sym.imp.USER32.dll_DialogBoxIndirectParamW]
pop esi
pop edi
pop ebp
ret 0x18
push dword [ebp + 0x1c]
mov eax, dword [edi + 0x50]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push esi
call eax
pop esi
pop edi
pop ebp
ret 0x18
xor eax, eax
pop edi
pop ebp
ret 0x18

Function at 0x47ba60
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x4f00d0]
push edi
test eax, eax
je 0x47bac4
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax + 0xc]
jge 0x47bac4
mov eax, dword [eax + 0x10]
mov edi, dword [eax + ecx*4]
test edi, edi
je 0x47bac4
push esi
mov esi, dword [ebp + 0xc]
push 4
push dword [ebp + 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x47bab5
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x47bab5
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x47bab5
push eax
call dword [sym.imp.USER32.dll_LoadMenuIndirectW]
test eax, eax
jne 0x47babe
push dword [ebp + 0x10]
mov eax, dword [edi + 0x3c]
push esi
call eax
pop esi
pop edi
pop ebp
ret 0xc
xor eax, eax
pop edi
pop ebp
ret 0xc

Function at 0x47bad0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x4f00d0]
push edi
test eax, eax
je 0x47bb34
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax + 0xc]
jge 0x47bb34
mov eax, dword [eax + 0x10]
mov edi, dword [eax + ecx*4]
test edi, edi
je 0x47bb34
push esi
mov esi, dword [ebp + 0xc]
push 4
push dword [ebp + 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x47bb25
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x47bb25
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x47bb25
push eax
call dword [sym.imp.USER32.dll_LoadMenuIndirectW]
test eax, eax
jne 0x47bb2e
push dword [ebp + 0x10]
mov eax, dword [edi + 0x40]
push esi
call eax
pop esi
pop edi
pop ebp
ret 0xc
xor eax, eax
pop edi
pop ebp
ret 0xc
Function at 0x481ae0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x608
mov eax, dword [0x4edca4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x14]
lea eax, [ebp - 0x604]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push 0x600
push 0
push eax
call fcn.00487650
lea eax, [ebp - 0x608]
mov dword [ebp - 0x608], 0x5fe
push eax
lea eax, [ebp - 0x604]
push eax
push dword [ebp + 0x10]
push esi
call fcn.00481c90
add esp, 0x1c
mov dword [ebp - 0x608], eax
test eax, eax
jne 0x481bd8
test edi, edi
mov edx, 0x4d4005
cmovne edx, edi
mov esi, edx
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x481b53
sub esi, ecx
lea ecx, [ebp - 0x604]
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x481b65
sub ecx, edi
mov word [ebp + ecx - 0x604], 0xa0d
lea edi, [ecx + 2]
test ebx, ebx
je 0x481bbd
push ebx
push esi
push 1
push edx
call fcn.004afbb1
add esp, 0x10
cmp eax, esi
jne 0x481ba7
push ebx
push edi
lea eax, [ebp - 0x604]
push 1
push eax
call fcn.004afbb1
add esp, 0x10
cmp eax, edi
je 0x481bd2
pop edi
pop esi
mov eax, 2
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00485a4c
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x604]
push eax
push edx
push str._s_s
call fcn.00481df0
add esp, 0xc
mov eax, dword [ebp - 0x608]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00485a4c
mov esp, ebp
pop ebp
ret

Function at 0x482e00
Capabilities:
Authenticate hmac

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x40
push 0x36
lea ebx, [esi + 0x5c]
push ebx
call fcn.00487650
push 0x40
lea edi, [esi + 0x9c]
push 0x5c
push edi
call fcn.00487650
mov edx, dword [ebp + 0x10]
add esp, 0x18
xor eax, eax
test edx, edx
jle 0x482e51
mov ebx, dword [ebp + 0xc]
cmp eax, 0x40
jge 0x482e4e
movzx ecx, byte [eax + ebx]
xor byte [edi + eax - 0x40], cl
movzx ecx, byte [eax + ebx]
xor byte [edi + eax], cl
inc eax
cmp eax, edx
jl 0x482e35
lea ebx, [esi + 0x5c]
push esi
call fcn.00483fb0
push 0x40
push ebx
push esi
call fcn.00483ff0
add esp, 0x10
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x483fb0
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
mov dword [eax + 0x18], 0xc3d2e1f0
pop ebp
ret

Function at 0x4840b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push edi
xor edi, edi
mov ecx, dword [eax + 0x404]
mov ebx, dword [eax + 0x400]
mov dword [ebp - 4], ecx
cmp dword [ebp + 0x10], edi
jle 0x484109
push esi
inc bl
movzx ebx, bl
mov edx, dword [eax + ebx*4]
mov cl, dl
add cl, byte [ebp - 4]
mov eax, dword [ebp + 8]
movzx ecx, cl
mov dword [ebp - 4], ecx
mov esi, dword [ebp - 4]
mov ecx, dword [eax + ecx*4]
mov dword [eax + ebx*4], ecx
mov dword [eax + esi*4], edx
add dl, cl
movzx ecx, dl
mov edx, dword [ebp + 0xc]
mov cl, byte [eax + ecx*4]
xor byte [edi + edx], cl
inc edi
cmp edi, dword [ebp + 0x10]
jl 0x4840d0
mov ecx, esi
pop esi
pop edi
mov dword [eax + 0x400], ebx
mov dword [eax + 0x404], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4ac5b5
Capabilities:
Get common file path
Set current directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004ac34d

Function at 0x4c00cf
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004bfcd4

Function at 0x4c00da
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004bfe55

Function at 0x4c1abc
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004c12a1

Function at 0x4c1ac7
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004c14dc

Function at 0x4c265e
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004c23e5
Function at 0x433000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x40a063
sub eax, 0x40a009
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x433030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43301e
nop
nop
nop
popal
nop
nop
nop
nop
jmp fcn.00431219
Function at 0x409888
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40995b
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x409974
push ebx
push 0x409980
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.004033b4
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.0040277c
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x409908
mov al, 0x62
call fcn.00409460
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.0040985c
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x409911
call fcn.0040985c
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409962
lea eax, [ebp - 4]
call fcn.00403198
ret

Function at 0x409a14
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409ac8
jmp 0x409abd
cmp dword [esi + 0x10], 0x1000
jne 0x409aa9
test byte [esi + 0x15], 1
jne 0x409aa9
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409a68
cmp eax, 2
je 0x409a68
cmp eax, 0x10
je 0x409a68
cmp eax, 0x20
jne 0x409a7d
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409a7d
mov bl, 1
xor ebp, ebp
jmp 0x409a8e
mov eax, dword [esi]
add eax, ebp
call fcn.00409a0c
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x409a81
test bl, bl
je 0x409aa9
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409ac8
mov eax, dword [esi + 4]
cmp eax, edi
je 0x409a40
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x411014
Capabilities:
Terminate process

Disassembly:
jmp 0x413140
jmp fcn.00413890
cmp ecx, dword [0x417018]
jne 0x41314a
repz ret
jmp 0x411087
Function at 0x401000
Capabilities:
Execute syscall

Disassembly:
pop eax
call fcn.00401471
add esp, 4
mov ecx, dword fs:[0xc0]
test ecx, ecx
jne 0x40101b
lea edx, [esp + 4]
int 0x2e
ret
xor ecx, ecx
lea edx, [esp + 4]
call dword fs:[0xc0]
ret

Function at 0x40132b
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
cmp dword [0x402020], 0
jne 0x40146b
push ebp
mov ebp, esp
push edi
xor edi, edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov ecx, dword [eax + 0xc]
xor eax, eax
mov edx, dword [ecx + 0x18]
test edx, edx
je 0x401392
mov ebx, dword [edx + 0x3c]
mov ebx, dword [edx + ebx + 0x78]
test ebx, ebx
je 0x40138c
lea eax, [edx + ebx]
mov esi, dword [eax + 0xc]
add esi, edx
mov ebx, dword [esi]
or ebx, 0x20202020
cmp ebx, 0x6c64746e
jne 0x40138c
mov ebx, dword [esi + 4]
or ebx, 0x20202020
cmp ebx, 0x6c642e6c
je 0x40139b
mov ecx, dword [ecx]
mov edi, edx
jmp 0x401351
test eax, eax
jne 0x40139d
jmp 0x401461
mov edi, edx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x1c]
xor ebx, ebx
mov esi, dword [eax + 0x18]
add ecx, edi
add edx, edi
mov dword [ebp - 0x1c], ecx
mov ecx, dword [eax + 0x24]
dec esi
add ecx, edi
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ecx + esi*4]
add eax, edi
cmp word [eax], 0x775a
jne 0x4013ff
lea ecx, [ebx*8 + 0x402024]
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], ecx
mov dword [esp], eax
call fcn.00401308
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x24]
mov dword [ebx*8 + 0x402024], eax
mov eax, dword [ebp - 0x20]
inc ebx
movzx eax, word [eax + esi*2]
mov eax, dword [edx + eax*4]
mov dword [ecx + 4], eax
cmp ebx, 0x1f4
je 0x40140a
lea eax, [esi - 1]
test esi, esi
je 0x40140a
mov esi, eax
jmp 0x4013b8
mov dword [0x402020], ebx
dec ebx
test ebx, ebx
jne 0x40141c
mov edx, 1
jmp 0x401461
xor eax, eax
mov edx, dword [eax*8 + 0x402028]
inc eax
mov ecx, dword [eax*8 + 0x402028]
cmp ecx, edx
jae 0x40145b
mov esi, dword [eax*8 + 0x40201c]
mov edi, dword [eax*8 + 0x402024]
mov dword [eax*8 + 0x402020], ecx
mov dword [eax*8 + 0x402028], edx
mov dword [eax*8 + 0x40201c], edi
mov dword [eax*8 + 0x402024], esi
cmp eax, ebx
jb 0x40141e
jmp 0x401410
add esp, 0x2c
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, 1
ret
Function at 0x408e96
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x423d60]
jne 0x408ea0
repz ret
jmp fcn.0040e02b

Function at 0x416e4e
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x423d60]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040e131
and dword [ebp - 0x14], 0
cmp dword [0x5379fc], 0
mov dword [ebp - 0x18], eax
jne 0x416f01
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x416fa9
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x416fa9
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x5379fc], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x537a00], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x537a04], eax
call edi
push eax
call esi
mov dword [0x537a0c], eax
test eax, eax
je 0x416f01
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x537a08], eax
mov eax, dword [0x537a08]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x416f5a
cmp dword [0x537a0c], ecx
je 0x416f5a
push eax
call esi
push dword [0x537a0c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x416f5a
test ebx, ebx
je 0x416f5a
call edi
test eax, eax
je 0x416f51
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x416f51
test byte [ebp - 8], 1
jne 0x416f5a
or dword [ebp + 0x10], 0x200000
jmp 0x416f8d
mov eax, dword [0x537a00]
cmp eax, dword [ebp - 0x18]
je 0x416f8d
push eax
call esi
test eax, eax
je 0x416f8d
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x416f8d
mov eax, dword [0x537a04]
cmp eax, dword [ebp - 0x18]
je 0x416f8d
push eax
call esi
test eax, eax
je 0x416f8d
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x5379fc]
call esi
test eax, eax
je 0x416fa9
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x416fab
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00408e96
leave
ret
Function at 0x401400
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x944
mov eax, dword [0x492984]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x938], eax
push esi
mov esi, dword [ebp + 8]
test ebx, ebx
jne 0x401464
mov eax, dword [0x493ca0]
test eax, eax
je 0x401452
push eax
call fcn.00401be0
push dword [0x493ca4]
call dword [sym.imp.MSVCR120.dll_free]
add esp, 8
mov dword [0x493ca0], ebx
mov dword [0x493ca4], ebx
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004580b8
mov esp, ebp
pop ebp
ret
cmp dword [0x493ca0], 0
push edi
mov edi, dword [sym.imp.MSVCR120.dll_malloc]
jne 0x401551
test esi, esi
je 0x401483
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0xa
mov esi, eax
push str.GAMECONFIG
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
je 0x40153e
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push edi
push esi
mov dword [ebp - 0x934], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
cmp dword [ebp - 0x934], 0
mov esi, eax
je 0x40153e
test esi, esi
je 0x40153e
mov edi, dword [sym.imp.MSVCR120.dll_malloc]
push esi
call edi
push esi
push dword [ebp - 0x934]
mov dword [0x493ca4], eax
push eax
call sub.MSVCR120.dll_memcpy
add esp, 0x10
lea ecx, [ebp - 0x944]
call fcn.00401af0
push esi
push dword [0x493ca4]
lea ecx, [ebp - 0x944]
call fcn.00401b00
push 3
push esi
push dword [0x493ca4]
call fcn.00402320
add esp, 0xc
mov dword [0x493ca0], eax
test eax, eax
jne 0x401551
push dword [0x493ca4]
call dword [sym.imp.MSVCR120.dll_free]
add esp, 4
mov dword [0x493ca4], 0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004580b8
mov esp, ebp
pop ebp
ret
push 0x3ff
lea eax, [ebp - 0x804]
push eax
push 0xffffffffffffffff
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor eax, eax
mov word [ebp - 6], ax
lea eax, [ebp - 0x930]
push eax
lea eax, [ebp - 0x93c]
push eax
push 1
lea eax, [ebp - 0x804]
push eax
push dword [0x493ca0]
call fcn.00401df0
add esp, 0x14
test eax, eax
jne 0x40153e
mov esi, dword [ebp - 0x808]
lea eax, [esi + 1]
push eax
call edi
push 3
push esi
mov edi, eax
push edi
push dword [ebp - 0x93c]
push dword [0x493ca0]
call fcn.004027b0
mov eax, dword [ebp - 0x808]
add esp, 0x18
mov ecx, dword [ebp - 0x938]
mov byte [eax + edi], 0
test ecx, ecx
je 0x4015db
mov eax, dword [ebp - 0x808]
mov dword [ecx], eax
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004580b8
mov esp, ebp
pop ebp
ret
Function at 0x4015f0
Capabilities:
Create directory
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd20
mov eax, dword [0x492984]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0xd20], ebx
push edi
test esi, esi
je 0x40161d
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0xa
mov esi, eax
push str.GAMEDATA
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
je 0x401750
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push edi
push esi
mov dword [ebp - 0xd1c], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, dword [ebp - 0xd1c]
mov esi, eax
test edi, edi
je 0x401750
test esi, esi
je 0x401750
test ebx, ebx
je 0x40169a
lea eax, [ebp - 0x3ec]
push 0x1f4
push eax
call dword [sym.imp.MSVCR120.dll__wgetcwd]
push ebx
call dword [sym.imp.MSVCR120.dll__mkdir]
push ebx
call dword [sym.imp.MSVCR120.dll__chdir]
add esp, 0x10
push 3
push esi
push edi
call fcn.00402320
mov edi, eax
lea eax, [ebp - 0xd18]
push eax
push 0xffffffffffffffff
push edi
call fcn.00402220
mov eax, dword [ebp - 0xd18]
add esp, 0x18
xor esi, esi
test eax, eax
jle 0x40171d
mov ebx, eax
lea eax, [ebp - 0xd18]
push eax
push esi
push edi
call fcn.00402220
add esp, 0xc
lea eax, [ebp - 0xbec]
push 0x3ff
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0xd14]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor eax, eax
push 2
push eax
mov word [ebp - 0x3ee], ax
lea eax, [ebp - 0xbec]
push eax
push esi
push edi
call fcn.004027b0
inc esi
add esp, 0x14
cmp esi, ebx
jl 0x4016c5
mov ebx, dword [ebp - 0xd20]
push edi
call fcn.00401be0
add esp, 4
test ebx, ebx
je 0x40173a
lea eax, [ebp - 0x3ec]
push eax
call dword [sym.imp.MSVCR120.dll__wchdir]
add esp, 4
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004580b8
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004580b8
mov esp, ebp
pop ebp
ret