joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4057a8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x5c0db0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
mov eax, dword [esi + 8]
mov dword [ebp - 0x11c], eax
and eax, 2
mov dword [ebp - 0x118], eax
je 0x4056a5
push 1
call fcn.004059d0
test al, al
je 0x4056ac
mov eax, dword [esi + 4]
test eax, eax
jne 0x4056bd
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005087f8
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x10c]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x4056ac
push edi
push 0x800
call fcn.0040a945
mov edx, dword [esi + 8]
and edx, 0xfffffffd
or edx, 8
mov dword [esi + 8], edx
mov edx, dword [esi + 0x18]
sub edx, dword [esi + 0x14]
lea ecx, [esi + 0x14]
mov edi, eax
mov eax, dword [ebp - 0x10c]
sar edx, 2
add esp, 4
cmp eax, edx
jbe 0x405721
push eax
call fcn.00404b40
mov eax, dword [ebp - 0x10c]
push ebx
xor ebx, ebx
test eax, eax
je 0x40580b
lea esp, [esp]
lea eax, [ebp - 0x110]
push eax
push edi
lea ecx, [ebp - 0x114]
push ecx
mov ecx, dword [esi + 4]
push 0
lea edx, [ebp - 0x120]
push edx
lea eax, [ebp - 0x108]
push eax
push ebx
push ecx
mov dword [ebp - 0x120], 0x104
mov dword [ebp - 0x110], 0x800
mov byte [ebp - 0x108], 0
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne case.0x405789.2
mov eax, dword [ebp - 0x114]
dec eax
cmp eax, 6
ja case.0x405789.2
jmp dword [eax*4 + 0x405840]
push edi
lea edx, [ebp - 0x108]
push edx
mov ecx, esi
call fcn.004050d0
mov ecx, eax
call fcn.00404a30
jmp case.0x405789.2
push edi
lea eax, [ebp - 0x108]
push eax
mov ecx, esi
call fcn.004050d0
mov ecx, eax
call fcn.00404980
jmp case.0x405789.2
mov ecx, dword [ebp - 0x110]
push 0
push ecx
push edi
lea edx, [ebp - 0x108]
push edx
mov ecx, esi
call fcn.004050d0
mov ecx, eax
call fcn.004054f0
jmp case.0x405789.2
mov eax, dword [ebp - 0x110]
push eax
push edi
lea ecx, [ebp - 0x108]
push ecx
mov ecx, esi
call fcn.004050d0
mov ecx, eax
call fcn.00404bf0
inc ebx
cmp ebx, dword [ebp - 0x10c]
jb 0x405730
cmp dword [ebp - 0x118], 0
mov edx, dword [ebp - 0x11c]
mov dword [esi + 8], edx
pop ebx
je 0x405825
mov ecx, esi
call fcn.00404840
push edi
call fcn.0040a93a
mov ecx, dword [ebp - 4]
add esp, 4
pop edi
xor ecx, ebp
mov al, 1
pop esi
call fcn.005087f8
mov esp, ebp
pop ebp
ret

Function at 0x405a00
Capabilities:
Delete registry value

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 4], 0
mov byte [esi + 0x11], 0
je 0x405a50
mov ecx, dword [esi + 0xc]
test byte [ecx + 8], 2
je 0x405a21
push 2
call fcn.004059d0
test al, al
jne 0x405a30
mov eax, dword [esi + 0xc]
test byte [eax + 8], 2
jne 0x405a50
cmp dword [eax + 4], 0
je 0x405a50
mov ecx, dword [esi + 0xc]
call fcn.00404840
mov eax, dword [esi + 4]
mov ecx, dword [esi + 0xc]
mov edx, dword [ecx + 4]
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
neg eax
sbb eax, eax
inc eax
pop esi
ret
xor al, al
pop esi
ret
Function at 0x4067d0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jne 0x4067de
xor eax, eax
pop ebp
ret
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
push esi
not eax
cmp edx, 8
jb 0x4068bd
mov esi, edx
shr esi, 3
push edi
jmp 0x406800
movzx edi, byte [ecx]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x56e248]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x56e248]
movzx edi, byte [ecx + 2]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x56e248]
movzx edi, byte [ecx + 3]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x56e248]
movzx edi, byte [ecx + 4]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x56e248]
movzx edi, byte [ecx + 5]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x56e248]
movzx edi, byte [ecx + 6]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x56e248]
movzx edi, byte [ecx + 7]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x56e248]
add ecx, 8
sub edx, 8
dec esi
jne 0x406800
pop edi
test edx, edx
je 0x4068da
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x56e248]
inc ecx
dec edx
jne 0x4068c1
not eax
pop esi
pop ebp
ret

Function at 0x4068e0
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
mov eax, dword [edx]
movsx ecx, byte [ebp + 0xc]
xor ecx, eax
shr eax, 8
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x56e248]
xor ecx, eax
movzx eax, cl
add eax, dword [edx + 4]
mov dword [edx], ecx
mov ecx, dword [edx + 8]
imul eax, eax, 0x8088405
inc eax
mov dword [edx + 4], eax
shr eax, 0x18
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x56e248]
mov dword [edx + 8], ecx
pop ebp
ret

Function at 0x406e40
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 0x14]
mov esi, ebx
imul esi, dword [ebp + 0x10]
cmp byte [edi], 0
je 0x406e80
mov ecx, dword [ebp + 8]
mov edx, dword [edi + 4]
push 0
lea eax, [ebp + 0xc]
push eax
push esi
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x406e74
mov byte [edi + 8], 1
mov eax, dword [ebp + 0xc]
pop edi
xor edx, edx
pop esi
div ebx
pop ebx
pop ebp
ret
mov ecx, dword [edi + 0x1c]
mov eax, dword [edi + 0x18]
lea edx, [ecx + esi]
cmp edx, eax
jbe 0x406e91
sub eax, ecx
mov esi, eax
mov eax, dword [edi + 0x14]
add eax, ecx
mov ecx, dword [ebp + 8]
push esi
push eax
push ecx
call fcn.00509060
add dword [edi + 0x1c], esi
add esp, 0xc
pop edi
mov eax, esi
xor edx, edx
pop esi
div ebx
pop ebx
pop ebp
ret
Function at 0x407f20
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x5c0db0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x407f54
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x407f54
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov al, byte [ebx]
test al, al
je 0x40800e
push esi
mov esi, ebx
mov ecx, ebx
cmp al, 0x2f
je 0x407f6b
cmp al, 0x5c
jne 0x407f6d
mov esi, ecx
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x407f63
cmp esi, ebx
je 0x407fa1
sub esi, ebx
push esi
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.00509060
lea ecx, [ebp - 0x20c]
push ecx
push edi
mov byte [ebp + esi - 0x20c], 0
call fcn.00407f20
add esp, 0x14
mov byte [ebp - 0x108], 0
test edi, edi
je 0x407fc0
lea edx, [ebp - 0x108]
mov eax, edi
sub edx, edi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x407fb6
mov eax, ebx
mov edx, ebx
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x407fc4
lea edi, [ebp - 0x108]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x407fd4
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea edx, [ebp - 0x108]
and ecx, 3
push edx
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
pop esi
cmp eax, 0xffffffff
jne 0x40800e
push 0
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.005087f8
mov esp, ebp
pop ebp
ret

Function at 0x409a50
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, ecx
cmp dword [ebx], 0
jne 0x409b1b
cmp dword [ebx + 4], 0xffffffff
jne 0x409b1b
push edi
lea edi, [ebx + 0x140]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x409a81
sub eax, edx
mov al, byte [eax + ebx + 0x13f]
cmp al, 0x5c
je 0x409ab1
cmp al, 0x2f
je 0x409ab1
dec edi
lea ebx, [ebx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x409aa0
mov ax, word [0x56e76c]
mov word [edi], ax
mov edi, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
cmp edi, 1
jne 0x409adb
push 1
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x409adb
pop esi
pop edi
mov eax, 0x2000000
pop ebx
pop ebp
ret 0xc
mov edx, dword [ebp + 0xc]
lea ecx, [ebp + 0x10]
push ecx
push edi
push edx
push esi
call fcn.00406c00
add esp, 0x10
test eax, eax
jne 0x409afb
mov eax, dword [ebp + 0x10]
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
push eax
call fcn.004094b0
add esp, 4
mov dword [ebx], eax
neg eax
sbb eax, eax
pop esi
and eax, 0xfffffe00
pop edi
add eax, 0x200
pop ebx
pop ebp
ret 0xc
mov eax, 0x1000000
pop ebx
pop ebp
ret 0xc
Function at 0x40a280
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
mov eax, dword [0x5c0db0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
push 0x56c4e8
push eax
mov dword [ebp - 0x134], eax
call fcn.0040a070
mov edi, eax
add esp, 8
test edi, edi
je 0x40a2cc
push esi
push edi
call fcn.00408070
add esp, 8
test eax, eax
je 0x40a2de
push edi
call fcn.0040a100
add esp, 4
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005087f8
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x130]
push eax
push 0xffffffffffffffff
push edi
call fcn.00408020
add esp, 0xc
test eax, eax
jne 0x40a2c3
push ebx
mov ebx, dword [ebp - 0x130]
xor esi, esi
test ebx, ebx
jle 0x40a325
lea ecx, [ebp - 0x130]
push ecx
push esi
push edi
call fcn.00408020
lea edx, [ebp - 0x12c]
push edx
push esi
push edi
call fcn.0040a0e0
inc esi
add esp, 0x18
cmp esi, ebx
jl 0x40a301
push edi
call fcn.0040a100
mov eax, dword [ebp - 0x134]
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [ebp - 4]
pop ebx
pop edi
xor ecx, ebp
mov eax, 1
pop esi
call fcn.005087f8
mov esp, ebp
pop ebp
ret

Function at 0x40a380
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push edi
xor esi, esi
call fcn.0040a360
mov eax, dword [ebp + 0x10]
add esp, 4
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40a3a0
sub eax, edx
push 0x56e9c4
push edi
mov dword [ebp - 8], eax
call fcn.00509aeb
mov edi, eax
mov eax, dword [ebp + 0xc]
push 0x56c30c
push eax
call fcn.00509aeb
push edi
mov ebx, eax
call fcn.0050a9b1
add esp, 0x14
test eax, eax
jne 0x40a41f
push edi
push 1
lea ecx, [ebp - 1]
push 1
push ecx
call fcn.0050a994
push edi
call fcn.0050a9b1
add esp, 0x14
test eax, eax
jne 0x40a412
mov eax, esi
cdq
idiv dword [ebp - 8]
mov eax, dword [ebp + 0x10]
push ebx
push 1
push 1
mov cl, byte [edx + eax]
xor byte [ebp - 1], cl
lea edx, [ebp - 1]
push edx
call fcn.00509888
add esp, 0x10
inc esi
push edi
call fcn.0050a9b1
add esp, 4
test eax, eax
je 0x40a3d6
push edi
call fcn.0050996f
push ebx
call fcn.0050996f
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40a510
Capabilities:
Get common file path

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTempPathA]
push esi
push 0
push 0
call ebx
mov esi, eax
test esi, esi
jne 0x40a53d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GetCurrentDirectory_failed___d__n
call fcn.0050aa01
add esp, 8
pop esi
xor eax, eax
pop ebx
ret
push edi
push esi
call fcn.0050a5f2
push esi
mov edi, eax
push 0
push edi
call fcn.0050a6d0
add esp, 0x10
push edi
push esi
call ebx
push edi
call fcn.0040a4d0
add esp, 4
pop edi
pop esi
pop ebx
ret
Function at 0x411883
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x4118ca
call fcn.0041a8ad
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x4118ca
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x4118e6
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.00411388
mov esi, eax
test edi, edi
je 0x4118e4
test ebx, ebx
je 0x4118e4
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x4120c9
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x55e3e0
call fcn.0050ad98
mov esi, ecx
cmp dword [esi + 0x6c], 0
jne 0x4120ee
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x412140
call fcn.00414a52
push eax
lea ecx, [ebp - 0x10]
call fcn.004017e0
mov ecx, dword [esi + 0x6c]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0050c7a9
push eax
call fcn.004118ed
add esp, 0x14
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00401240
mov eax, esi
call fcn.0050ae70
ret 8

Function at 0x417027
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor ebx, ebx
call fcn.0041a8ad
mov esi, dword [eax + 0xc]
push 5
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x417060
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov ecx, dword [ebp - 4]
push esi
push dword [ebp + 0xc]
push ebx
call fcn.00416c69
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8

Function at 0x4170be
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x78], ebx
test ebx, 0xffff0000
jne 0x4170e2
cmp dword [edi + 0x74], 0
jne 0x4170e2
movzx eax, bx
mov dword [edi + 0x74], eax
call fcn.0041a8ad
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.0041707f
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x417473
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push dword [ebp + 0xc]
mov ecx, esi
call fcn.00417132
cmp dword [esi], 0
mov edi, eax
mov dword [esi + 0xc], 1
je 0x4174bd
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.0040ad36
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.0040ad07
jmp 0x4174c8
mov eax, dword [ebp + 0x10]
push dword [eax]
push edi
call fcn.0041b828
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x4174ce
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 4]
lea eax, [ebp + 8]
push eax
push dword [ebp + 0xc]
call fcn.004119bb
push 0xfffffffffffffff0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowLongA]
push dword [ebp + 0xc]
and eax, 3
mov ecx, esi
cmp al, 3
je 0x41750b
call fcn.00417132
mov dword [esi + 0xc], 1
jmp 0x417510
call fcn.00417132
cmp dword [esi], 0
je 0x417559
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
test eax, eax
jle 0x417531
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.0040ad36
jmp 0x417543
mov ecx, dword [ebp + 0x10]
push 0xff
call fcn.00401920
push 0x100
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.0040ad07
jmp 0x41757d
mov esi, dword [ebp + 0x10]
push dword [esi]
push 0xffffffffffffffff
push 0x14d
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 0xffffffff
jne 0x41757d
push dword [esi]
push dword [ebp + 8]
call fcn.0041b828
pop esi
pop ebp
ret 0xc

Function at 0x41ad39
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
cmp dword [ebp + 0xc], ebx
je 0x41ad81
call fcn.0041a8ad
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x41ad81
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
test eax, eax
je 0x41adc4
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
test ebx, ebx
je 0x41adad
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x41adad
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x68], 0
je 0x41adc1
mov ecx, dword [esi + 0x68]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x42f63a
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push esi
mov esi, ecx
call fcn.0046b718
call fcn.0041a2de
cmp dword [eax + 0x14], 0
jne 0x42f657
mov ecx, esi
pop esi
jmp fcn.0042f121
pop esi
ret

Function at 0x432de5
Capabilities:
Get common file path
Get file system object information

Disassembly:
mov edi, edi
push esi
mov esi, ecx
call fcn.004944c5
call fcn.0041a2de
cmp dword [eax + 0x14], 0
jne 0x432e02
mov ecx, esi
pop esi
jmp fcn.004327b8
pop esi
ret

Function at 0x4701c1
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov dword [ebp - 4], ecx
test esi, esi
jne 0x4701db
call fcn.0041a8ad
mov esi, dword [eax + 0xc]
push dword [0x5c5f98]
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x4701f9
xor eax, eax
pop edi
pop esi
leave
ret 8
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp + 0xc], eax
test eax, eax
je 0x4701f1
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
jne 0x470226
xor esi, esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop ebx
jmp 0x4701f3
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 4]
push eax
push ebx
call fcn.004700ef
mov esi, eax
jmp 0x470218

Function at 0x4eee5d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
test byte [esi + 4], 1
push edi
mov ebx, ecx
je 0x4eee75
mov edi, dword [esi + 0xc]
jmp 0x4eeeb5
push 5
push dword [esi + 0xc]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x4eee8e
call fcn.00413777
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x4eeea3
call fcn.00413777
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x4eeeb5
call fcn.00413777
call fcn.0041a8ad
cmp dword [eax + 0x3c], 0
je 0x4eeeca
push edi
mov ecx, ebx
call fcn.004edc91
mov edi, eax
push dword [ebp + 0xc]
push edi
call fcn.004eed77
mov dword [ebp + 8], eax
mov eax, dword [ebx + 0x7c]
test eax, eax
je 0x4eeee8
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
and dword [ebx + 0x7c], 0
mov eax, dword [ebp + 8]
test eax, eax
je 0x4eeef4
mov edi, eax
mov dword [ebx + 0x7c], eax
or dword [esi + 4], 1
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x5087f8
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x5c0db0]
jne 0x508802
repz ret
jmp fcn.00510808
Function at 0x51f40d
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5c0db0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0051310c
and dword [ebp - 0x14], 0
cmp dword [0x5c8a5c], 0
mov dword [ebp - 0x18], eax
jne 0x51f4c0
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x51f568
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x51f568
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x5957f0
push ebx
mov dword [0x5c8a5c], eax
call edi
push eax
call esi
push 0x5957dc
push ebx
mov dword [0x5c8a60], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x5c8a64], eax
call edi
push eax
call esi
mov dword [0x5c8a6c], eax
test eax, eax
je 0x51f4c0
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x5c8a68], eax
mov eax, dword [0x5c8a68]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x51f519
cmp dword [0x5c8a6c], ecx
je 0x51f519
push eax
call esi
push dword [0x5c8a6c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x51f519
test ebx, ebx
je 0x51f519
call edi
test eax, eax
je 0x51f510
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x51f510
test byte [ebp - 8], 1
jne 0x51f519
or dword [ebp + 0x10], 0x200000
jmp 0x51f54c
mov eax, dword [0x5c8a60]
cmp eax, dword [ebp - 0x18]
je 0x51f54c
push eax
call esi
test eax, eax
je 0x51f54c
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x51f54c
mov eax, dword [0x5c8a64]
cmp eax, dword [ebp - 0x18]
je 0x51f54c
push eax
call esi
test eax, eax
je 0x51f54c
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x5c8a5c]
call esi
test eax, eax
je 0x51f568
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x51f56a
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005087f8
leave
ret

Function at 0x522fd0
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x194
mov eax, dword [0x5c0db0]
xor eax, esp
mov dword [esp + 0x190], eax
lea eax, [esp]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x523025
mov eax, dword [esp]
cmp al, 2
jne 0x52301f
shr eax, 8
cmp al, 2
jne 0x52301f
call fcn.005233e0
mov ecx, dword [esp + 0x190]
xor ecx, esp
call fcn.005087f8
add esp, 0x194
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [esp + 0x190]
xor ecx, esp
mov eax, 2
call fcn.005087f8
add esp, 0x194
ret