joyce8/EMBER2024-capa huggingface dataset:
Function at 0x479390
Capabilities:
Read file on windows

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
test esi, esi
push edi
jne 0x4793b6
push 1
push esi
push str.Missing_REQUEST_object
push str.PPDGetKeyVal
call fcn.00479b50
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
ret
mov eax, dword [esi + 0xc]
test eax, eax
je 0x4793ca
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
mov dword [ecx], eax
xor eax, eax
pop ebx
ret
mov edi, dword [esp + 0x18]
mov dword [edi], 0
mov eax, dword [esi]
test eax, eax
je 0x4794dc
mov eax, dword [esi + 0x24]
test eax, eax
je 0x4794dc
push eax
call dword [sym.imp.MSVCRT.dll_ftell]
mov edx, dword [esi + 0x18]
mov ebp, dword [sym.imp.MSVCRT.dll_fseek]
mov ebx, eax
mov eax, dword [esi + 0x24]
push 0
push edx
push eax
call ebp
add esp, 0x10
cmp eax, 0xffffffff
push 1
jne 0x479427
push 0
push str.fseek_failed_
push str.PPDGetKeyVal
call fcn.00479b50
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
ret
mov ecx, dword [esi + 0x1c]
inc ecx
push ecx
call sub.MSVCRT.dll_calloc
add esp, 8
mov dword [0x65d9e4], eax
test eax, eax
jne 0x479447
call fcn.0047c750
mov eax, dword [0x65d9e4]
mov dword [edi], eax
mov edx, dword [esi + 0x1c]
mov eax, dword [0x65d9e0]
lea ecx, [eax + edx + 1]
mov dword [0x65d9e0], ecx
mov edx, dword [esi + 0x1c]
mov eax, dword [edi]
mov byte [edx + eax], 0
mov eax, dword [edi]
test eax, eax
je 0x4794dc
mov ecx, dword [esi + 0x1c]
test ecx, ecx
jne 0x479478
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
mov edx, dword [esi + 0x24]
push edx
push 1
push ecx
push eax
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
test eax, eax
jne 0x4794a7
push 1
push eax
push str.fread_failed_
push str.PPDGetKeyVal
call fcn.00479b50
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
ret
mov eax, dword [esi + 0x1c]
mov ecx, dword [edi]
push 0
push ebx
mov byte [eax + ecx], 0
mov edx, dword [esi + 0x24]
push edx
call ebp
add esp, 0xc
cmp eax, 0xffffffff
jne 0x479471
push 1
push 0
push str.fseek_failed_
push str.PPDGetKeyVal
call fcn.00479b50
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
ret
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret
Function at 0x4796e0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
push ebx
push ebp
push esi
test eax, eax
push edi
jne 0x479706
push 1
push eax
push str.Missing_REQUEST_object
push str.PPDGetMainKey
call fcn.00479b50
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
ret
mov edi, dword [eax + 8]
mov eax, dword [edi]
test eax, eax
jne 0x47971a
mov ecx, dword [edi + 0x24]
test ecx, ecx
je 0x479898
mov ebp, dword [esp + 0x18]
mov esi, ebp
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x479748
test cl, cl
je 0x479744
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x479748
add eax, 2
add esi, 2
test cl, cl
jne 0x479720
xor eax, eax
jmp 0x47974d
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x479799
mov edi, dword [edi + 0x28]
test edi, edi
je 0x479898
mov eax, dword [edi]
test eax, eax
je 0x479898
mov esi, ebp
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x479790
test cl, cl
je 0x47978c
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x479790
add eax, 2
add esi, 2
test cl, cl
jne 0x479768
xor eax, eax
jmp 0x479795
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x479751
mov eax, dword [edi + 0xc]
test eax, eax
je 0x4797ad
mov ecx, dword [esp + 0x1c]
mov dword [ecx], eax
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
mov edx, dword [edi + 0x24]
push edx
call dword [sym.imp.MSVCRT.dll_ftell]
mov ecx, dword [edi + 0x24]
mov ebp, dword [sym.imp.MSVCRT.dll_fseek]
mov ebx, eax
mov eax, dword [edi + 0x18]
push 0
push eax
push ecx
call ebp
add esp, 0x10
cmp eax, 0xffffffff
push 1
jne 0x4797ee
push 0
push str.fseek_failed_
push str.PPDGetMainKey
call fcn.00479b50
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
ret
mov edx, dword [edi + 0x1c]
inc edx
push edx
call sub.MSVCRT.dll_calloc
add esp, 8
mov dword [0x65d9e4], eax
test eax, eax
jne 0x47980e
call fcn.0047c750
mov eax, dword [0x65d9e4]
mov esi, dword [esp + 0x1c]
mov dword [esi], eax
mov eax, dword [edi + 0x1c]
mov ecx, dword [0x65d9e0]
lea edx, [ecx + eax + 1]
mov dword [0x65d9e0], edx
mov eax, dword [esi]
test eax, eax
je 0x479898
mov ecx, dword [edi + 0x24]
mov edx, dword [edi + 0x1c]
push ecx
push 1
push edx
push eax
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
test eax, eax
jne 0x47985f
push 1
push eax
push str.fread_failed_
push str.PPDGetMainKey
call fcn.00479b50
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
ret
mov eax, dword [edi + 0x1c]
mov ecx, dword [esi]
push 0
push ebx
mov byte [eax + ecx], 0
mov edx, dword [edi + 0x24]
push edx
call ebp
add esp, 0xc
cmp eax, 0xffffffff
jne 0x4797a6
push 1
push 0
push str.fseek_failed_
push str.PPDGetMainKey
call fcn.00479b50
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
ret
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret
Function at 0x4798a0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
push ebx
push ebp
push esi
test eax, eax
push edi
jne 0x4798c6
push 1
push eax
push str.Missing_REQUEST_object
push str.PPDGetSpecialKey
call fcn.00479b50
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
ret
cmp dword [esp + 0x20], 1
jne 0x4798d2
mov edi, dword [eax + 0xc]
jmp 0x4798d5
mov edi, dword [eax + 0x10]
mov eax, dword [edi]
test eax, eax
jne 0x4798e6
mov ecx, dword [edi + 0x14]
test ecx, ecx
je 0x479a64
mov ebp, dword [esp + 0x18]
mov esi, ebp
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x479914
test cl, cl
je 0x479910
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x479914
add eax, 2
add esi, 2
test cl, cl
jne 0x4798ec
xor eax, eax
jmp 0x479919
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x479965
mov edi, dword [edi + 0x18]
test edi, edi
je 0x479a64
mov eax, dword [edi]
test eax, eax
je 0x479a64
mov esi, ebp
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x47995c
test cl, cl
je 0x479958
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x47995c
add eax, 2
add esi, 2
test cl, cl
jne 0x479934
xor eax, eax
jmp 0x479961
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x47991d
mov eax, dword [edi + 4]
test eax, eax
je 0x479979
mov ecx, dword [esp + 0x1c]
mov dword [ecx], eax
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
mov edx, dword [edi + 0x14]
push edx
call dword [sym.imp.MSVCRT.dll_ftell]
mov ecx, dword [edi + 0x14]
mov ebp, dword [sym.imp.MSVCRT.dll_fseek]
mov ebx, eax
mov eax, dword [edi + 8]
push 0
push eax
push ecx
call ebp
add esp, 0x10
cmp eax, 0xffffffff
push 1
jne 0x4799ba
push 0
push str.fseek_failed_
push str.GetQueryKey
call fcn.00479b50
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
ret
mov edx, dword [edi + 0x10]
inc edx
push edx
call sub.MSVCRT.dll_calloc
add esp, 8
mov dword [0x65d9e4], eax
test eax, eax
jne 0x4799da
call fcn.0047c750
mov eax, dword [0x65d9e4]
mov esi, dword [esp + 0x1c]
mov dword [esi], eax
mov eax, dword [edi + 0x10]
mov ecx, dword [0x65d9e0]
lea edx, [ecx + eax + 1]
mov dword [0x65d9e0], edx
mov eax, dword [esi]
test eax, eax
je 0x479a64
mov ecx, dword [edi + 0x14]
mov edx, dword [edi + 0x10]
push ecx
push 1
push edx
push eax
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
test eax, eax
jne 0x479a2b
push 1
push eax
push str.fread_failed_
push str.GetQueryKey
call fcn.00479b50
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
ret
mov eax, dword [edi + 0x10]
mov ecx, dword [esi]
push 0
push ebx
mov byte [eax + ecx], 0
mov edx, dword [edi + 0x14]
push edx
call ebp
add esp, 0xc
cmp eax, 0xffffffff
jne 0x479972
push 1
push 0
push str.fseek_failed_
push str.GetQueryKey
call fcn.00479b50
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
ret
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret
Function at 0x4820d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 0x38
push ebp
push esi
push edi
mov edi, dword [esp + 0x48]
test edi, edi
je 0x4820eb
mov eax, dword [edi + 0x24]
mov ecx, dword [eax + edi + 0xc]
mov dword [esp + 0x10], ecx
jmp 0x4820f5
mov edx, dword [0x65a8c4]
mov dword [esp + 0x10], edx
mov edx, dword [0x655ff8]
mov cx, word [0x506320]
push 5
lea eax, [esp + 0x14]
push 0x14d3
push edx
mov dword [esp + 0x20], edi
mov word [esp + 0x2c], 2
mov dword [esp + 0x28], edi
mov dword [esp + 0x24], eax
mov dword [esp + 0x44], 0x483f20
mov dword [esp + 0x48], 0x481f90
mov dword [esp + 0x38], 0x659f68
mov word [esp + 0x3e], cx
mov dword [esp + 0x40], 0x4e55
mov dword [esp + 0x30], 1
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
mov eax, dword [0x655ff8]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edx, dword [0x655afc]
lea ecx, [esp + 0x18]
push ecx
mov esi, eax
mov eax, dword [0x655ff8]
push 0x481600
push edx
push esi
push eax
mov word [esp + 0x36], 0xb
mov word [esp + 0x44], 0xffff
call dword [sym.imp.USER32.dll_DialogBoxIndirectParamA]
push esi
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
test ebp, ebp
je 0x482251
test edi, edi
je 0x482251
mov esi, dword [edi + 0x24]
push ebx
add esi, edi
push edi
mov ecx, esi
mov edx, dword [esi]
call dword [edx + 0x40]
mov ecx, dword [esi + 8]
mov eax, dword [esi + 4]
mov dword [esp + 0x4c], ecx
push edi
mov ecx, esi
mov dword [esp + 0x14], eax
call fcn.00493f00
push 0
mov ecx, esi
mov dword [esi + 0x408], 0xffffffff
call fcn.004a1020
mov ecx, esi
call fcn.00482290
mov ebx, eax
test ebx, ebx
je 0x48222b
push 1
mov ecx, esi
call fcn.004822a0
push eax
push ebx
mov ecx, esi
call fcn.004b21a0
mov ecx, esi
call fcn.00482270
push eax
mov ecx, esi
call fcn.00482260
push eax
mov ecx, esi
call fcn.0048f720
push 2
push 1
mov ecx, esi
call fcn.004822b0
push eax
push 0
push edi
mov ecx, esi
call fcn.004a1f70
cmp word [esi + 0x96], 0xffff
pop ebx
je 0x482251
mov edx, dword [esp + 0x48]
mov eax, dword [esp + 0xc]
push 1
push edx
push eax
push edi
mov ecx, esi
call fcn.00494a50
mov dword [esi + 0x90], eax
pop edi
mov eax, ebp
pop esi
pop ebp
add esp, 0x38
ret
Function at 0x483fa0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 0x228
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov ecx, 0x20
xor eax, eax
lea edi, [esp + 0x1b8]
rep stosd dword es:[edi], eax
mov edi, dword [esp + 0x23c]
mov ebx, 0xffff
cmp word [esi + 0x96], bx
lea ecx, [esp + 0x1b8]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], edi
mov dword [esp + 0x12c], edi
mov dword [esp + 0x128], eax
mov word [esp + 0xe8], 0x80
jne 0x484003
mov word [esp + 0x24], ax
jmp 0x48403b
lea edx, [esp + 0xe8]
lea eax, [esp + 0x128]
push edx
push eax
call fcn.004898f0
add esp, 8
test eax, eax
je 0x484036
mov ecx, dword [esp + 0xea]
push ecx
call fcn.00480100
add esp, 4
mov word [esp + 0x24], ax
jmp 0x48403b
mov word [esp + 0x24], bx
mov eax, dword [0x655ff8]
mov edx, dword [esp + 0x24]
push 5
push 0x14dd
push eax
mov dword [esp + 0x1c], edx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov ecx, dword [0x655ff8]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ecx, dword [0x655ff8]
lea edx, [esp + 0x18]
mov ebx, eax
mov eax, dword [edi + 0x3c]
push edx
push 0x4831f0
push eax
push ebx
push ecx
call dword [sym.imp.USER32.dll_DialogBoxIndirectParamA]
push ebx
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov edx, dword [esi + 8]
mov ebx, dword [esi + 4]
push edi
mov ecx, esi
mov dword [esp + 0x18], edx
call fcn.00493f00
lea eax, [esp + 0x1b8]
mov ecx, esi
push eax
push edi
call fcn.00484370
push 1
push edi
mov ecx, esi
call fcn.0049aa40
cmp word [esi + 0x96], 0xffff
je 0x484130
mov ecx, dword [esp + 0x14]
push 1
push ecx
push ebx
push edi
mov ecx, esi
call fcn.00494a50
test ebp, ebp
mov dword [esi + 0x90], eax
je 0x484130
mov dx, word [esp + 0x10]
cmp dx, word [esp + 0x24]
je 0x484130
mov eax, dword [esp + 0x24]
lea edx, [esp + 0xa8]
and eax, 0xffff
push edx
mov ecx, dword [esi + eax*4 + 0xc]
lea eax, [esp + 0x12c]
push eax
mov dword [esp + 0xb2], ecx
push edi
push 0
mov ecx, esi
mov word [esp + 0xb8], 0x80
call fcn.004918c0
lea ecx, [esp + 0x128]
push ecx
call fcn.00489a10
add esp, 4
mov dx, word [0x506324]
mov esi, dword [0x65a2a4]
mov di, word [0x65a2aa]
mov eax, 1
mov word [0x65a2a8], ax
mov word [0x65a29a], ax
mov eax, dword [0x65af58]
push 0
push 0
push 0x110
push eax
mov dword [0x65a2a4], 0x65a0b8
mov word [0x65a2aa], dx
call fcn.00481a70
mov word [0x65a2aa], di
mov dword [0x65a2a4], esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x228
ret 4

Function at 0x485010
Capabilities:
Resume thread

Disassembly:
mov eax, dword [ecx + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
ret
Function at 0x48c8b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov ecx, dword [esp + 8]
sub esp, 8
mov eax, ecx
and eax, 0xffff
sub eax, 0x4e55
je 0x48c994
sub eax, 0x4f
je 0x48c8ea
mov eax, dword [esp + 0xc]
test eax, eax
je 0x48c9b5
push ecx
mov ecx, dword [eax + 0x24]
push eax
add ecx, eax
call fcn.004ad3e0
add esp, 8
ret
mov eax, dword [0x655ff8]
push ebx
push edi
push 5
push 0x14db
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov ecx, dword [0x655ff8]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
lea edx, [esp + 8]
push 0
push edx
push 0
push 0x48c7a0
push 3
push 0x658ff8
mov ebx, eax
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [0x65a270], 1
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov edi, dword [esp + 0x2c]
push eax
push 0x4ea4
push ebx
push edi
call fcn.0041ac10
add esp, 0x28
test eax, eax
je 0x48c97d
push esi
mov esi, 0x658ff8
push str.Spelling_Preferences
push esi
push edi
call fcn.00454210
add esi, 0x6e
add esp, 0xc
cmp esi, 0x659142
jl 0x48c962
pop esi
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov dword [0x65a270], 0
pop ebx
add esp, 8
ret
mov eax, dword [esp + 0xc]
mov dword [0x65a270], 1
push eax
call fcn.004820d0
add esp, 4
mov dword [0x65a270], 0
add esp, 8
ret

Function at 0x4952d0
Capabilities:
Suspend thread

Disassembly:
mov eax, dword [ecx + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
ret
Function at 0x49b6f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [0x65af58]
sub esp, 0x2c
test eax, eax
je 0x49b703
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [0x655ff8]
push ebx
push ebp
push esi
push edi
push 5
mov ebx, 0xa
push 0x14d7
push eax
mov word [0x65a29a], bx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov ecx, dword [0x655ff8]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edx, dword [0x655ab0]
push 0x65a290
mov esi, eax
push fcn.00481a70
push edx
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
mov eax, dword [0x655ff8]
push eax
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamA]
push esi
mov dword [0x65af58], eax
call fcn.0041a8d0
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov ecx, dword [0x65af58]
push 0x1bdb
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
mov edi, eax
push 0
push 0x14b
push edi
call ebp
mov word [esp + 0x28], bx
mov word [esp + 0x24], 7
mov word [esp + 0x26], 9
mov word [esp + 0x2a], 0xc
mov word [esp + 0x2c], 0xe
mov word [esp + 0x2e], 0x12
mov word [esp + 0x30], 0x18
mov word [esp + 0x32], 0x24
mov word [esp + 0x34], 0x30
mov word [esp + 0x36], 0x3c
mov word [esp + 0x38], 0x48
lea esi, [esp + 0x24]
mov ebx, 0xb
xor eax, eax
lea edx, [esp + 0x10]
mov ax, word [esi]
push 2
push edx
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 4
push eax
call fcn.004c8c70
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
push 0
push 0x143
push edi
call ebp
add esi, 2
dec ebx
jne 0x49b7e7
mov eax, dword [0x65af5c]
test eax, eax
je 0x49b82d
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov edx, dword [0x655ff8]
push 5
push 0x14d8
push edx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
mov eax, dword [0x655ff8]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edx, dword [0x655ab0]
mov cx, word [0x506714]
push 0x65a290
mov esi, eax
push 0x48cfe0
push edx
push esi
mov dword [0x65a2a4], 0x65af88
mov word [0x65a2aa], cx
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
mov eax, dword [0x655ff8]
push eax
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamA]
push esi
mov dword [0x65af5c], eax
mov word [0x65a29a], 0
call fcn.0041a8d0
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov edx, dword [0x6559e0]
mov eax, dword [0x65af5c]
mov cx, word [0x506324]
push 0
push 0x1bed
push eax
mov dword [0x65a2a4], 0x65a0b8
mov word [0x65a2aa], cx
lea esi, [edx + 0x1f2]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
push 0x11
push 0
call dword [esi]
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret
Function at 0x4a2e20
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [0x655ff8]
push esi
push edi
push 5
push 0x14df
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov ecx, dword [0x655ff8]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edx, dword [esp + 0xc]
mov ecx, dword [0x655ff8]
mov esi, eax
mov eax, dword [0x655afc]
push edx
push 0x4a2140
push eax
push esi
push ecx
call dword [sym.imp.USER32.dll_DialogBoxIndirectParamA]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, edi
pop edi
pop esi
ret 4
Function at 0x4d5310
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov eax, dword [ebp + 8]
mov dword [eax + 8], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], 0xefcdab89
mov eax, dword [ebp + 8]
mov dword [eax + 0x10], 0x98badcfe
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0x10325476
jmp 0x4d5355
pop edi
pop esi
pop ebx
leave
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x40a063
sub eax, 0x40a009
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219

Function at 0x41e0de
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x429940
cmp edx, dword [eax]
je 0x41e100
add eax, 8
inc ecx
cmp eax, 0x4299d0
jl 0x41e0f1
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x429940]
jne 0x41e22e
mov eax, dword [0x42a324]
cmp eax, 1
je 0x41e208
test eax, eax
jne 0x41e131
cmp dword [0x4270b0], 1
je 0x41e208
cmp edx, 0xfc
je 0x41e22e
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
test eax, eax
jne 0x41e168
lea eax, [ebp - 0x1a4]
push 0x42416c
push eax
call fcn.0041eae0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0041c730
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x41e1ab
lea eax, [ebp - 0x1a4]
push eax
call fcn.0041c730
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x424168
push edi
call fcn.00418350
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x42414c
push eax
call fcn.0041eae0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0041eaf0
lea eax, [ebp - 0xa0]
push 0x424148
push eax
call fcn.0041eaf0
push dword [esi + 0x429944]
lea eax, [ebp - 0xa0]
push eax
call fcn.0041eaf0
push 0x12010
lea eax, [ebp - 0xa0]
push 0x424120
push eax
call fcn.0042138f
add esp, 0x2c
pop edi
jmp 0x41e22e
lea eax, [ebp + 8]
lea esi, [esi + 0x429944]
push 0
push eax
push dword [esi]
call fcn.0041c730
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.DLL_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.DLL_WriteFile]
pop esi
leave
ret

Function at 0x4222a4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4222c4
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
call fcn.00419e74
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x4222e7
test byte [esp + 8], 2
je 0x4222e7
call fcn.00419ee7
mov dword [eax], 0xd
call fcn.00419ef0
mov dword [eax], 5
jmp 0x4222c0
xor eax, eax
ret
Function at 0x401b20
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x407044
call sub.KERNEL32.dll_EnterCriticalSection
mov ebx, dword [0x40703c]
sub esp, 4
test ebx, ebx
je 0x401b6b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sub.KERNEL32.dll_TlsGetValue
sub esp, 4
mov esi, eax
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x401b64
test esi, esi
je 0x401b64
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x401b40
mov dword [esp], 0x407044
call sub.KERNEL32.dll_LeaveCriticalSection
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x401d50
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
lea esi, [esp + 0x24]
lea ebx, [eax + 0x40]
mov dword [esp + 4], 1
mov dword [esp + 0xc], ebx
mov dword [esp], str.Mingw_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x401da0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, edx
push esi
mov esi, ecx
push ebx
mov ebx, eax
sub esp, 0x3c
lea eax, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.KERNEL32.dll_VirtualQuery
sub esp, 0xc
test eax, eax
je 0x401e74
mov eax, dword [esp + 0x28]
cmp eax, 0x40
je 0x401dde
cmp eax, 4
jne 0x401e00
test esi, esi
je 0x401df2
xor eax, eax
movzx ecx, byte [edi + eax]
mov byte [ebx + eax], cl
add eax, 1
cmp eax, esi
jb 0x401de4
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x20]
lea ebp, [esp + 0x10]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
mov ecx, dword [esp + 0x28]
test esi, esi
je 0x401e3f
xor edx, edx
movzx eax, byte [edi + edx]
mov byte [ebx + edx], al
add edx, 1
cmp edx, esi
jb 0x401e31
cmp ecx, 0x40
je 0x401df2
cmp ecx, 4
je 0x401df2
mov eax, dword [esp + 0x10]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00401d50
lea esi, [esi]