joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7eee00
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x8048f0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
mov ecx, dword [esp + 0x1c]
push esi
mov esi, dword [esp + 0x24]
lea eax, [esp + 4]
push edi
xor edi, edi
push eax
push 0x20019
push edi
push esi
push ecx
mov dword [esp + 0x1c], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
je 0x7eeed2
lea edx, [esp + 0x24]
push eax
push edx
call fcn.007eb7a0
add esp, 8
mov eax, dword [esp + 0x24]
mov dword [esp + 0x1c], edi
cmp eax, edi
je 0x7eee61
mov edx, dword [eax]
jmp 0x7eee63
xor edx, edx
xor ecx, ecx
push edi
xor eax, eax
push edx
push ecx
mov ecx, dword [esp + 0x38]
push eax
lea eax, [esp + 0x1c]
mov edx, dword [ecx + 4]
push eax
push esi
push 2
push edx
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], edi
call fcn.007ed050
mov eax, dword [esp + 0x44]
add esp, 0x20
cmp eax, edi
mov dword [esp + 0x1c], 0xffffffff
je 0x7eeebf
mov esi, eax
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x7eeebf
cmp esi, edi
je 0x7eeebf
mov ecx, esi
call fcn.007e6a00
push esi
call fcn.007f41c8
add esp, 4
pop edi
xor al, al
pop esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
push edi
lea eax, [esp + 0x2c]
push edi
push eax
call fcn.007eb990
add esp, 0xc
mov eax, dword [esp + 0x28]
mov dword [esp + 0x1c], 1
cmp eax, edi
je 0x7eeef5
mov eax, dword [eax]
jmp 0x7eeef7
xor eax, eax
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0x2c]
push ebx
push esi
push eax
push ecx
push edx
call fcn.007ea640
add esp, 0x10
mov bl, al
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x2c]
cmp eax, edi
je 0x7eef25
mov eax, dword [eax]
jmp 0x7eef27
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, dword [esp + 0x2c]
mov dword [esp + 0x20], 0xffffffff
cmp esi, edi
je 0x7eef76
lea ecx, [esi + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x7eef76
cmp esi, edi
je 0x7eef76
mov eax, dword [esi]
cmp eax, edi
je 0x7eef5d
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esi + 4]
cmp eax, edi
je 0x7eef6d
push eax
call fcn.007f41c8
add esp, 4
push esi
call fcn.007f41c8
add esp, 4
mov ecx, dword [esp + 0x18]
mov al, bl
pop ebx
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x7eef90
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x208
lea eax, [esp]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
push ebp
push esi
push edi
xor edi, edi
push 0x104
push eax
push edi
push SysStringLen
call ebx
mov esi, dword [esp + 0x21c]
mov ebp, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x7eeffb
mov ecx, dword [esi + 8]
push 0
push ecx
call ebp
test eax, eax
je 0x7ef035
lea edx, [esp + 0x10]
push esi
push edx
push SysStringLen
call fcn.007eee00
add esp, 0xc
lea eax, [esp + 0x10]
inc edi
push 0x104
push eax
push edi
push SysStringLen
call ebx
test eax, eax
je 0x7eefc5
mov edi, 0x8098b0
mov ecx, dword [esi + 8]
push 0
push ecx
call ebp
test eax, eax
je 0x7ef035
mov edx, dword [edi]
push esi
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.007eee00
add edi, 4
add esp, 0xc
cmp edi, 0x8098c0
jb 0x7ef000
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x208
ret
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x208
ret

Function at 0x7ef070
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x250
push esi
push edi
mov edi, dword [esp + 0x25c]
push 0x5c
push edi
call fcn.007f5082
mov esi, eax
add esp, 8
test esi, esi
je 0x7ef107
lea eax, [esp + 8]
mov word [esi], 0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x7ef102
push ebx
lea ebx, [esi + 2]
push ebp
lea ecx, [esp + 0x3c]
push ebx
push ecx
call fcn.007f4946
add esp, 8
test eax, eax
je 0x7ef0e3
mov ebp, dword [sym.imp.KERNEL32.dll_FindNextFileW]
lea edx, [esp + 0x10]
push edx
push edi
call ebp
test eax, eax
je 0x7ef0e8
lea eax, [esp + 0x3c]
push ebx
push eax
call fcn.007f4946
add esp, 8
test eax, eax
jne 0x7ef0c5
mov word [esi], 0x5c
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp word [esi], 0
pop ebp
pop ebx
je 0x7ef102
pop edi
mov al, 1
pop esi
add esp, 0x250
ret
mov word [esi], 0x5c
pop edi
xor al, al
pop esi
add esp, 0x250
ret
Function at 0x7eff10
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x8049fb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov esi, dword [esp + 0x2c]
xor ebp, ebp
mov dword [esp + 0x10], eax
xor ebx, ebx
mov eax, 1
mov ecx, ebx
shl eax, cl
mov ecx, dword [esp + 0x10]
test ecx, eax
je 0x7f0002
lea edx, [ebx + 0x41]
lea eax, [esp + 0x14]
push edx
push str._c:_
push eax
call fcn.007f3dff
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x7f0002
lea edx, [esp + 0x14]
push edx
push str.Mounting__s_n
call fcn.007eb6e0
lea eax, [esp + 0x1c]
lea edi, [esi + 0x1048]
push eax
push edi
mov word [esp + 0x28], bp
call fcn.007f420b
push 0x10
call fcn.007f41d3
add esp, 0x14
mov dword [esp + 0x2c], eax
cmp eax, ebp
mov dword [esp + 0x24], ebp
je 0x7effc5
mov cx, word [edi]
push ecx
mov ecx, eax
call fcn.007e01c0
jmp 0x7effc7
xor eax, eax
push esi
mov dword [esp + 0x28], 0xffffffff
mov dword [esi], eax
call fcn.007efb80
mov edi, dword [esi]
add esp, 4
cmp edi, ebp
je 0x7efff0
mov ecx, edi
call fcn.007e02c0
push edi
call fcn.007f41c8
add esp, 4
mov edx, dword [esi + 0x1024]
push ebp
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x7f0021
inc ebx
cmp ebx, 0x20
jb 0x7eff3e
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x7f1250
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x805808
push 0x7f5288
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], ebx
xor esi, esi
mov dword [ebp - 0x20], esi
mov byte [ebp - 0x24], bl
mov dword [ebp - 4], ebx
mov byte [ebp - 0x34], bl
mov byte [ebp - 0x33], bl
mov byte [ebp - 0x32], bl
mov byte [ebp - 0x31], bl
mov byte [ebp - 0x30], bl
mov byte [ebp - 0x2f], 5
lea eax, [ebp - 0x1c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x12
push 1
lea ecx, [ebp - 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x7f1329
lea edx, [ebp - 0x28]
push edx
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x7f1329
mov dword [ebp - 0x2c], ebx
lea eax, [ebp - 0x2c]
push eax
push ebx
push ebx
push 1
mov ecx, dword [ebp - 0x28]
push ecx
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
call edi
mov edx, dword [ebp - 0x2c]
push edx
call fcn.007f41d3
add esp, 4
mov esi, eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x20], esi
cmp esi, ebx
je 0x7f1329
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
push esi
push 1
mov edx, dword [ebp - 0x28]
push edx
call edi
test eax, eax
je 0x7f1329
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [esi]
push ecx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0x24], al
jmp 0x7f132c
mov al, byte [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
call fcn.007f1351
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x7f2000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x7f2131
push esi
call fcn.007f5145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.007e4080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0x7f2131
push 0
push ebp
call fcn.007e43a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.007e4260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0x7f208b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.007e42f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0x7f2121
push 0x80a918
push edi
call fcn.007f33f0
push eax
push ebx
push esi
call fcn.007f1f60
push 0x80a8f8
push edi
call fcn.007f33f0
push eax
push ebx
push esi
call fcn.007f1f60
push 0x80a8d8
push edi
call fcn.007f33f0
push eax
push ebx
push esi
call fcn.007f1f60
push 0x80a8c0
push edi
call fcn.007f33f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.007f1f60
push 0x80a8a0
push edi
call fcn.007f33f0
push eax
push ebx
push esi
call fcn.007f1f60
push 0x80a888
push edi
call fcn.007f33f0
push eax
push ebx
push esi
call fcn.007f1f60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x7f31b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.007f3140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.007f3140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.007f3140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.007f3140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x7f3bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x7f3c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x80587c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x7f3c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x7f3c52
xor eax, eax
pop esi
leave
ret 4
Function at 0x2d85513a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x2d855149
pop dword [ebp - 0x20]
mov eax, 0x6f288ec9
add eax, 0xbe5cc280
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0x3f94ee09
sub dword [ebp - 0x30], 0xf142a8be
mov dword [ebp - 0x2c], 0x65660c37
add dword [ebp - 0x2c], 0xcccd400e
mov dword [ebp - 0x28], 0x37e8075
sub dword [ebp - 0x28], 0xb7323c47
mov dword [ebp - 0x24], 0x887ade54
sub dword [ebp - 0x24], 0x887ade54
lea eax, [ebp - 0x30]
push eax
mov eax, 0x699c840a
sub eax, 0x3c0d7362
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0x5e8a9f77
add dword [ebp - 0x30], 0x15e7c9df
mov dword [ebp - 0x2c], 0x1c6600f2
sub dword [ebp - 0x2c], 0xdaf99f7d
mov dword [ebp - 0x28], 0xfb9acca1
add dword [ebp - 0x28], 0x67d49fcb
mov dword [ebp - 0x24], 0x33b4952f
add dword [ebp - 0x24], 0xcc4b6ad1
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x6bb39
push 0
call eax
mov ecx, 0x51e0
mov ebx, eax
mov edi, 0x2d9a2c00
add edi, dword [ebp - 0x20]
mov edx, 0x590da60
sub edx, 0x8ad128d7
mov dword [ebp - 0xc], 0x2d4f658a
mov esi, dword [edi]
add dword [ebp - 0xc], edi
xor esi, edx
sub dword [ebp - 0x10], ebx
mov dword [ebx], esi
add ebx, 0x4dd8d8b2
sub ebx, 0x4dd8d8ae
add edi, 4
loop 0x2d85525a
add eax, 0xaef01c00
add eax, 0x51111e53
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x2d800000
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x1004377d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x1004378c
pop dword [ebp - 0x30]
mov eax, 0xbabb6b8f
add eax, 0x5548cbfd
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0xe1db6fb0
sub dword [ebp - 0x40], 0x93892a65
mov dword [ebp - 0x3c], 0xc91f6378
sub dword [ebp - 0x3c], 0x96ec1733
mov dword [ebp - 0x38], 0x6b8abd94
sub dword [ebp - 0x38], 0x1f3e7966
mov dword [ebp - 0x34], 0x3cb4cf82
sub dword [ebp - 0x34], 0x3cb4cf82
lea eax, [ebp - 0x40]
push eax
mov eax, 0x5b0dfb
add eax, 0xfaaf215
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0xb24e22e1
sub dword [ebp - 0x40], 0x3ddbb98b
mov dword [ebp - 0x3c], 0x7238c2f0
sub dword [ebp - 0x3c], 0x30cc617b
mov dword [ebp - 0x38], 0x6587156a
sub dword [ebp - 0x38], 0x217a8fe
mov dword [ebp - 0x34], 0x8d154006
add dword [ebp - 0x34], 0x72eabffa
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x58768
push 0
call eax
mov ecx, 0x52b4
xor edx, edx
add edx, eax
mov ebx, 0x1008bc00
add ebx, dword [ebp - 0x30]
mov esi, 0x49d39c54
sub esi, 0xfab3a4cf
mov edi, dword [ebx]
sub dword [ebp - 0xc], ecx
xor edi, esi
mov dword [edx], edi
xor dword [ebp - 4], 0xb6e651e
add edx, 0x87d685f9
add edx, 0x78297a0b
add ebx, 0x1eab7496
sub ebx, 0x1eab7492
loop 0x1004389f
add eax, 0x59e6b059
sub eax, 0x59e572b6
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x30]
call ebx
leave
ret

Function at 0x404e19
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x404e28
pop dword [ebp - 0x40]
mov eax, 0x404e28
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0xdaf8f822
add dword [ebp - 0x50], 0x73594d29
mov dword [ebp - 0x4c], 0x54217050
add dword [ebp - 0x4c], 0xde11dbf5
mov dword [ebp - 0x48], 0xd42fac45
sub dword [ebp - 0x48], 0x87e36817
mov dword [ebp - 0x44], 0xd7ad3436
add dword [ebp - 0x44], 0x2852cbca
lea eax, [ebp - 0x50]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0x3c3b4268
sub dword [ebp - 0x50], 0xc7c8d912
mov dword [ebp - 0x4c], 0xb65dfb10
add dword [ebp - 0x4c], 0x8b0e6665
mov dword [ebp - 0x48], 0xdf7bd289
sub dword [ebp - 0x48], 0x7c0c661d
mov dword [ebp - 0x44], 0x13da1092
sub dword [ebp - 0x44], 0x13da1092
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x4b4d3
push 0
call eax
mov ecx, 0x3fb4
xor edi, edi
add edi, eax
mov edx, 0x476000
add edx, dword [ebp - 0x40]
mov esi, 0x4a7496ca
sub esi, 0x79e26089
mov ebx, dword [edx]
xor dword [ebp - 8], esi
add ebx, esi
add dword [ebp - 0x18], 0x93a618b5
mov dword [edi], ebx
add dword [ebp - 0x38], edi
add edi, 0xa39ed13c
sub edi, 0xa39ed138
add edx, 0x4db8aef4
add edx, 0xb2475110
loop 0x404f31
add eax, 0xe5faa50
sub eax, 0xe5eb8ad
xor ebx, ebx
add ebx, eax
add eax, 0xd3427fea
sub eax, 0xd3427fe5
mov ecx, 0xd8806fe6
add ecx, 0x27bf901a
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x401000
Capabilities:
Hash data using sha256

Disassembly:
mov eax, 0x74
call fcn.005d11a0
mov eax, dword [0x69f000]
xor eax, esp
mov dword [esp + 0x70], eax
mov eax, dword [esp + 0x80]
push esi
mov esi, dword [esp + 0x7c]
push edi
test eax, eax
mov edi, 0x6a4e6c
push 0x70
cmovne edi, eax
lea eax, [esp + 0xc]
push 0
push eax
call fcn.005d5480
push dword [esp + 0x90]
lea eax, [esp + 0x18]
push esi
push eax
mov dword [esp + 0x20], 0x6a09e667
mov dword [esp + 0x24], 0xbb67ae85
mov dword [esp + 0x28], 0x3c6ef372
mov dword [esp + 0x2c], 0xa54ff53a
mov dword [esp + 0x30], 0x510e527f
mov dword [esp + 0x34], 0x9b05688c
mov dword [esp + 0x38], 0x1f83d9ab
mov dword [esp + 0x3c], 0x5be0cd19
mov dword [esp + 0x8c], 0x20
call fcn.004013b0
lea eax, [esp + 0x20]
push eax
push edi
call fcn.004010d0
lea eax, [esp + 0x28]
push 0x70
push eax
call fcn.004017e0
mov ecx, dword [esp + 0xa0]
add esp, 0x28
mov eax, edi
pop edi
pop esi
xor ecx, esp
call fcn.005d077b
add esp, 0x74
ret
Function at 0x410420
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov eax, edi
shr eax, 4
inc eax
push 6
movzx eax, ax
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_FindResourceW]
mov dword [ebp + 0xc], eax
test eax, eax
jne 0x410449
pop edi
pop ebx
pop ebp
ret
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_LoadResource]
test eax, eax
jne 0x41045f
xor esi, esi
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov esi, eax
test esi, esi
je 0x410456
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
lea ecx, [esi + eax]
and edi, 0xf
jbe 0x410492
nop
cmp esi, ecx
jae 0x410456
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edi, 1
jne 0x410480
cmp esi, ecx
jae 0x410456
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4104f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
movzx eax, word [ebp + 8]
mov dword [ebp + 8], eax
pop ebp
jmp fcn.0048b340
Function at 0x412000
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
push edi
call fcn.00498c8c
mov esi, eax
mov dword [ebp - 4], esi
test esi, esi
je 0x4120f0
mov eax, edi
shr eax, 4
inc eax
push 6
movzx eax, ax
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_FindResourceW]
mov dword [ebp + 8], eax
test eax, eax
je 0x4120f0
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_LoadResource]
test eax, eax
je 0x4120f0
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov esi, eax
test esi, esi
je 0x4120f0
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
lea ecx, [esi + eax]
and edi, 0xf
jbe 0x412084
cmp esi, ecx
jae 0x4120f0
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edi, 1
jne 0x412072
cmp esi, ecx
jae 0x4120f0
cmp word [esi], 0
je 0x4120f0
mov eax, dword [ebx]
mov ecx, 1
movzx edi, word [esi]
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, edi
or ecx, eax
jge 0x4120ac
push edi
mov ecx, ebx
call fcn.004127d0
movzx ecx, word [esi]
lea eax, [esi + 2]
push ecx
push eax
push edi
push dword [ebx]
call fcn.005d880e
add esp, 0x10
cmp eax, 0x50
ja case.0x4120cb.1
movzx eax, byte [eax + 0x412120]
jmp dword [eax*4 + 0x412110]
mov eax, dword [ebx]
cmp edi, dword [eax - 8]
jg 0x412100
mov dword [eax - 0xc], edi
xor ecx, ecx
mov eax, dword [ebx]
mov word [eax + edi*2], cx
lea eax, [ecx + 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
call fcn.00487831
push 0x80070057
call fcn.00407ea0
call fcn.00487817
nop
shl byte [eax], cl
inc ecx
add bl, bh
and byte [ecx], al
or ah, byte [ecx]
inc ecx
add byte [edx], cl
and dword [ecx], eax
add byte [ebx], al
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add dword [ebx], eax
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add al, byte [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add al, byte [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add ah, cl
int3
Function at 0x412f00
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x603ed1
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x69f000]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
xorps xmm0, xmm0
xor eax, eax
movups xmmword [edi], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 7
mov word [edi], ax
mov dword [ebp - 4], eax
movups xmmword [edi + 0x18], xmm0
mov dword [edi + 0x28], eax
mov dword [edi + 0x2c], 7
mov word [edi + 0x18], ax
mov byte [ebp - 4], 1
movups xmmword [edi + 0x30], xmm0
mov dword [edi + 0x40], eax
mov dword [edi + 0x44], 7
mov word [edi + 0x30], ax
mov byte [ebp - 4], 2
lea esi, [edi + 0x48]
mov dword [ebp - 0x14], esi
push 0x40
mov dword [esi], eax
mov dword [esi + 4], eax
call fcn.00486cd6
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov byte [ebp - 4], 4
xorps xmm0, xmm0
movups xmmword [edi + 0x50], xmm0
xor eax, eax
mov dword [edi + 0x60], 0
mov dword [edi + 0x64], 7
mov word [edi + 0x50], ax
mov byte [ebp - 4], 5
mov dword [edi + 0x68], eax
mov dword [edi + 0x6c], eax
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret