joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4126b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x49d1c2
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x4bc7dc]
xor eax, esp
mov dword [esp + 0x58], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4bc7dc]
xor eax, esp
push eax
lea eax, [esp + 0x70]
mov dword fs:[0], eax
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x24]
push ecx
xor ebx, ebx
push 1
push ebx
mov dword [esp + 0x28], ebx
push ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
call dword [sym.imp.WTSAPI32.dll_WTSEnumerateSessionsW]
test eax, eax
jne 0x412713
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x41285e
mov dword [esp + 0x18], ebx
cmp dword [esp + 0x1c], ebx
jbe 0x412853
xor ebp, ebp
jmp 0x412730
mov eax, dword [esp + 0x20]
cmp dword [eax + ebp + 8], ebx
jne 0x41283d
mov edi, dword [eax + ebp]
xor edx, edx
push 0x22
mov eax, str.Globalgoogle_ime_ipc_console_quit
lea esi, [esp + 0x54]
mov dword [esp + 0x68], 7
mov dword [esp + 0x64], ebx
mov word [esp + 0x54], dx
call fcn.0040ca50
mov dword [esp + 0x78], 2
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov byte [esp + 0x78], 4
xor eax, eax
mov word [esp + 0x2c], ax
mov esi, 7
push ebx
or eax, 0xffffffff
lea ecx, [esp + 0x54]
lea edx, [esp + 0x30]
mov dword [esp + 0x44], esi
mov dword [esp + 0x40], ebx
call fcn.0040c720
mov dword [esp + 0x48], edi
mov byte [esp + 0x4c], bl
mov edi, 8
mov byte [esp + 0x78], 6
cmp dword [esp + 0x64], edi
jb 0x4127c3
mov ecx, dword [esp + 0x50]
push ecx
call fcn.0047fe1e
add esp, 4
xor edx, edx
lea ecx, [esp + 0x24]
mov dword [esp + 0x64], esi
mov dword [esp + 0x60], ebx
mov word [esp + 0x50], dx
call fcn.004774f0
test al, al
je 0x4127ed
lea esi, [esp + 0x24]
call fcn.004775f0
mov esi, 7
mov dword [esp + 0x78], edi
cmp dword [esp + 0x40], edi
jb 0x412804
mov eax, dword [esp + 0x2c]
push eax
call fcn.0047fe1e
add esp, 4
mov eax, dword [esp + 0x28]
xor ecx, ecx
mov dword [esp + 0x40], esi
mov dword [esp + 0x3c], ebx
mov word [esp + 0x2c], cx
cmp eax, ebx
je 0x412826
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x78], 0xffffffff
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x41283d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x18]
inc eax
add ebp, 0xc
mov dword [esp + 0x18], eax
cmp eax, dword [esp + 0x1c]
jb 0x412730
mov edx, dword [esp + 0x20]
push edx
call dword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x58]
xor ecx, esp
call fcn.0047fe29
add esp, 0x68
ret
Function at 0x4141f0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x497cac
mov eax, dword fs:[0]
push eax
push ebx
push esi
mov eax, dword [0x4bc7dc]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
xor ebx, ebx
lea eax, [esi + 0x10]
push eax
mov ecx, str.GGPY
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov word [esi + 0xc], bx
call fcn.00402450
mov dword [esp + 0x14], ebx
mov edx, dword [0x4bc2cc]
mov eax, dword [edx + 0xc]
mov ecx, 0x4bc2cc
call eax
add eax, 0x10
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x4c], 0xf
mov dword [esi + 0x48], ebx
mov byte [esi + 0x38], bl
mov dword [esi + 0x54], ebx
mov word [esi + 0x58], 1
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0xc
ret 4
Function at 0x415e00
Capabilities:
Check if file exists
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x49a7e8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4bc7dc]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
lea eax, [esp + 0x14]
push eax
mov ecx, 0x4a8968
call fcn.00402450
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x24], 0
mov ecx, dword [ecx]
test ecx, ecx
je 0x415e56
mov edx, dword [ecx]
mov edx, dword [edx + 4]
lea eax, [esp + 0x14]
push eax
push 0
call edx
mov dword [esp + 0x24], 0xffffffff
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x415e7e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 1
lea esi, [esp + 0x18]
call fcn.0040cb40
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov esi, eax
mov eax, dword [esi]
add esp, 4
push eax
call edi
mov ebp, dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
test eax, eax
jne 0x415eb4
mov esi, dword [esi]
push 0
push esi
push 0
call ebp
test eax, eax
je 0x415eb4
xor al, al
jmp 0x415eb6
mov al, 1
test al, al
mov eax, dword [esp + 0x14]
sete bl
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x415edb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
je 0x415ee6
mov eax, 3
jmp 0x415f61
push 0
lea esi, [esp + 0x1c]
call fcn.0040cb40
mov esi, eax
mov eax, dword [esi]
add esp, 4
push eax
call edi
test eax, eax
jne 0x415f0e
mov esi, dword [esi]
push eax
push esi
push eax
call ebp
test eax, eax
je 0x415f0e
xor al, al
jmp 0x415f10
mov al, 1
test al, al
mov eax, dword [esp + 0x18]
sete bl
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x415f35
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
je 0x415f40
mov eax, 4
jmp 0x415f61
mov esi, dword [esp + 0x2c]
mov ecx, dword [esi]
test ecx, ecx
je 0x415f5f
inc dword [esi + 8]
mov eax, dword [esi + 8]
imul eax, eax, 0x64
cdq
idiv dword [esi + 4]
mov edi, dword [ecx]
mov edx, dword [edi + 8]
push eax
call edx
xor eax, eax
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 4
Function at 0x415f90
Capabilities:
Resolve function by parsing pe exports
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x49dcd8
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x4bc7dc]
xor eax, esp
mov dword [esp + 0x60], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4bc7dc]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
mov eax, dword [esp + 0x88]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x8c]
mov ebp, dword [eax]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ecx
cmp ebp, dword [eax + 4]
je 0x41615e
xor ebx, ebx
mov edx, dword [esp + 0x14]
mov ecx, dword [edx]
cmp ecx, ebx
je 0x416000
mov eax, dword [ecx]
mov eax, dword [eax + 4]
lea edx, [ebp + 0xc]
push edx
push 2
call eax
mov eax, dword [ebp + 4]
lea edi, [ebp + 4]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, dword [edi]
xor ecx, ecx
mov word [esp + 0x3c], cx
mov ecx, eax
mov dword [esp + 0x50], 7
mov dword [esp + 0x4c], ebx
lea edx, [ecx + 2]
lea esp, [esp]
mov si, word [ecx]
add ecx, 2
cmp si, bx
jne 0x416030
sub ecx, edx
sar ecx, 1
push ecx
lea esi, [esp + 0x40]
call fcn.0040ca50
mov dword [esp + 0x80], ebx
xor edx, edx
mov word [esp + 0x20], dx
mov esi, 7
push ebx
or eax, 0xffffffff
lea ecx, [esp + 0x40]
lea edx, [esp + 0x24]
mov dword [esp + 0x38], esi
mov dword [esp + 0x34], ebx
call fcn.0040c720
lea eax, [esp + 0x58]
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x84], 1
call fcn.00474fa0
push eax
mov byte [esp + 0x84], 2
call fcn.00474630
add esp, 4
mov byte [esp + 0x80], 1
cmp dword [esp + 0x6c], 8
jb 0x4160b8
mov ecx, dword [esp + 0x58]
push ecx
call fcn.0047fe1e
add esp, 4
xor edx, edx
mov byte [esp + 0x80], bl
cmp dword [esp + 0x34], 8
mov dword [esp + 0x6c], esi
mov dword [esp + 0x68], ebx
mov word [esp + 0x58], dx
jb 0x4160e2
mov eax, dword [esp + 0x20]
push eax
call fcn.0047fe1e
add esp, 4
xor ecx, ecx
mov dword [esp + 0x80], 0xffffffff
cmp dword [esp + 0x50], 8
mov dword [esp + 0x34], esi
mov dword [esp + 0x30], ebx
mov word [esp + 0x20], cx
jb 0x416110
mov edx, dword [esp + 0x3c]
push edx
call fcn.0047fe1e
add esp, 4
mov ecx, dword [esp + 0x1c]
push edi
push ebp
xor eax, eax
push ecx
mov dword [esp + 0x5c], esi
mov dword [esp + 0x58], ebx
mov word [esp + 0x48], ax
call fcn.0041ed80
test al, al
je 0x416181
mov esi, dword [esp + 0x14]
mov ecx, dword [esi]
cmp ecx, ebx
je 0x41614e
inc dword [esi + 8]
mov eax, dword [esi + 8]
imul eax, eax, 0x64
cdq
idiv dword [esi + 4]
mov edi, dword [ecx]
mov edx, dword [edi + 8]
push eax
call edx
mov eax, dword [esp + 0x18]
add ebp, 0x10
cmp ebp, dword [eax + 4]
jne 0x415fe9
xor eax, eax
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x60]
xor ecx, esp
call fcn.0047fe29
add esp, 0x70
ret 8
mov eax, 2
jmp 0x416160
Function at 0x416ad0
Capabilities:
Check if file exists

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
mov esi, dword [ebp]
push edi
cmp esi, dword [ebp + 4]
je 0x416b3c
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileW]
lea esp, [esp]
mov eax, dword [esi + 0xc]
push eax
call ebx
test eax, eax
je 0x416b34
mov eax, dword [esi + 0xc]
push 0
push 0x80
push 3
push 0
push 2
push 0x40000000
push eax
call edi
cmp eax, 0xffffffff
jne 0x416b29
call fcn.00413750
test eax, eax
jns 0x416b34
xor al, al
pop edi
pop esi
pop ebp
pop ebx
ret 4
test eax, eax
je 0x416b34
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add esi, 0x10
cmp esi, dword [ebp + 4]
jne 0x416af0
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
ret 4
Function at 0x4182a0
Capabilities:
Access peb ldr_data
Query or enumerate registry value
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x498f68
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x4bc7dc]
xor eax, esp
mov dword [esp + 0x28], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4bc7dc]
xor eax, esp
push eax
lea eax, [esp + 0x44]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x54]
lea eax, [esp + 0x20]
push eax
mov ecx, str.GUID
call fcn.00402450
mov eax, dword [esp + 0x20]
xor ebx, ebx
lea ecx, [esp + 0x24]
push ecx
mov ecx, dword [ebp]
push ebx
lea edx, [esp + 0x30]
push edx
push ebx
push eax
push ecx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x3c], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
mov eax, dword [esp + 0x20]
sete byte [esp + 0x1b]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x418331
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp byte [esp + 0x1b], bl
jne 0x41841f
xor eax, eax
lea ecx, [esp + 0x2c]
push ecx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
call dword [sym.imp.ole32.dll_CoCreateGuid]
test eax, eax
js 0x41841f
mov edx, dword [0x4bc2cc]
mov eax, dword [edx + 0xc]
mov ecx, 0x4bc2cc
call eax
add eax, 0x10
mov dword [esp + 0x1c], eax
mov dword [esp + 0x4c], ebx
movzx ecx, byte [esp + 0x3b]
movzx edx, byte [esp + 0x3a]
mov eax, dword [esp + 0x38]
push ecx
push edx
movzx ecx, ah
push ecx
movzx ecx, byte [esp + 0x42]
movzx edx, al
movzx eax, byte [esp + 0x43]
push edx
push eax
mov eax, dword [esp + 0x48]
push ecx
movzx ecx, word [esp + 0x4a]
movzx edx, ah
push edx
movzx edx, word [esp + 0x4c]
movzx eax, al
push eax
mov eax, dword [esp + 0x4c]
push ecx
push edx
push eax
push str._08X_04X_04X_02X_02X_02X_02X_02X_02X_02X_02X
lea edi, [esp + 0x4c]
call fcn.00419740
mov esi, dword [esp + 0x4c]
xor eax, eax
add esp, 0x30
cmp esi, ebx
setne al
cmp eax, ebx
je 0x4183fb
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edx, dword [ebp]
lea ecx, [eax + eax + 2]
push ecx
push esi
push 1
push ebx
push str.GUID
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add esi, 0xfffffff0
mov dword [esp + 0x4c], 0xffffffff
lea eax, [esi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x41841f
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
mov ecx, dword [esp + 0x44]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.0047fe29
add esp, 0x3c
ret 4
Function at 0x418c10
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x49a7b3
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x4bc7dc]
xor eax, esp
mov dword [esp + 0x34], eax
push ebx
push ebp
push esi
mov eax, dword [0x4bc7dc]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
push str.Notifier
push str.SoftwareGoogleGoogle_Input_Tools
lea eax, [esp + 0x30]
push str._s_s
push eax
call fcn.00474110
xor ebx, ebx
push 0x28
mov dword [esp + 0x64], ebx
call fcn.0048068d
add esp, 0x14
cmp eax, ebx
je 0x418c8a
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
xor ecx, ecx
mov dword [eax + 0x20], 7
mov dword [eax + 0x1c], ebx
mov word [eax + 0xc], cx
mov esi, eax
jmp 0x418c8c
xor esi, esi
mov byte [esp + 0x50], bl
mov eax, dword [esp + 0x28]
mov ebp, 8
cmp dword [esp + 0x3c], ebp
jae 0x418ca3
lea eax, [esp + 0x28]
push esi
mov edx, 0x2011f
mov ecx, 0x80000002
call fcn.0040e500
test eax, eax
je 0x418ce5
mov eax, dword [esp + 0x28]
cmp dword [esp + 0x3c], ebp
jae 0x418cc5
lea eax, [esp + 0x28]
push 0x2011f
push esi
mov ecx, 0x80000002
call fcn.0040f930
test eax, eax
je 0x418ce5
cmp esi, ebx
je 0x418ce3
push esi
call fcn.00410800
xor esi, esi
cmp esi, ebx
jne 0x418d0e
mov dword [esp + 0x50], 0xffffffff
cmp dword [esp + 0x3c], ebp
jb 0x418d04
mov edx, dword [esp + 0x28]
push edx
call fcn.0047fe1e
add esp, 4
mov eax, 6
jmp 0x418db9
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x28]
push edx
push ebx
mov dword [esp + 0x2c], ebx
mov eax, dword [esi]
push str.Counter
push eax
mov dword [esp + 0x3c], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x418d47
cmp dword [esp + 0x20], 4
jne 0x418d47
inc dword [esp + 0x1c]
mov eax, dword [esi]
mov ecx, dword [esp + 0x1c]
push 4
lea edx, [esp + 0x24]
push edx
push 4
push ebx
push str.Counter
push eax
mov dword [esp + 0x38], ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov byte [esp + 0x50], bl
push esi
test eax, eax
je 0x418d97
call fcn.00410800
mov dword [esp + 0x50], 0xffffffff
cmp dword [esp + 0x3c], ebp
jb 0x418d04
mov ecx, dword [esp + 0x28]
push ecx
call fcn.0047fe1e
add esp, 4
mov eax, 6
jmp 0x418db9
call fcn.00410800
mov dword [esp + 0x50], 0xffffffff
cmp dword [esp + 0x3c], ebp
jb 0x418db7
mov edx, dword [esp + 0x28]
push edx
call fcn.0047fe1e
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.0047fe29
add esp, 0x44
ret
Function at 0x41dcd0
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x49cb88
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x4bc7dc]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push ebp
push esi
mov eax, dword [0x4bc7dc]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
cmp dword [edi + 0x44], 0
je 0x41de33
cmp byte [edi + 0x49], 0
je 0x41de33
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
push 0xffffffffffffffff
mov ecx, edi
call edx
cmp eax, 0xffffffff
je 0x41de1e
mov ecx, 0xf
xor eax, eax
mov byte [esp + 0x14], 0
mov dword [esp + 0x28], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x24], 8
cmp ecx, 0x10
jae 0x41dd52
lea eax, [esp + 0x14]
mov byte [eax + 8], 0
mov dword [esp + 0x3c], 0
lea ebx, [edi + 0x4c]
mov eax, dword [esp + 0x14]
mov ebp, dword [esp + 0x28]
mov edx, eax
cmp ebp, 0x10
jae 0x41dd76
lea edx, [esp + 0x14]
mov eax, edx
add edx, dword [esp + 0x24]
mov ecx, dword [edi + 0x44]
mov esi, dword [ecx]
lea ebp, [esp + 0x10]
push ebp
push edx
push eax
mov eax, dword [esi + 0x18]
push ebx
call eax
sub eax, 0
je 0x41ddaa
dec eax
je 0x41ddae
sub eax, 2
mov dword [esp + 0x3c], 0xffffffff
lea ecx, [esp + 0x14]
jne 0x41de19
jmp 0x41de2e
mov byte [edi + 0x49], 0
mov ebp, dword [esp + 0x28]
mov eax, dword [esp + 0x14]
mov ecx, eax
cmp ebp, 0x10
jae 0x41ddc1
lea ecx, [esp + 0x14]
mov esi, dword [esp + 0x10]
sub esi, ecx
je 0x41ddee
cmp ebp, 0x10
jae 0x41ddd2
lea eax, [esp + 0x14]
mov ecx, dword [edi + 0x54]
push ecx
push esi
push 1
push eax
call fcn.00482f12
add esp, 0x10
cmp esi, eax
jne 0x41de0d
mov ebp, dword [esp + 0x28]
mov eax, dword [esp + 0x14]
cmp byte [edi + 0x49], 0
je 0x41de22
test esi, esi
jne 0x41dd69
push esi
push 8
lea esi, [esp + 0x1c]
call fcn.0040b690
jmp 0x41dd61
mov dword [esp + 0x3c], 0xffffffff
lea ecx, [esp + 0x14]
call fcn.0047d500
xor al, al
jmp 0x41de35
mov dword [esp + 0x3c], 0xffffffff
lea ecx, [esp + 0x14]
call fcn.0047d500
mov al, 1
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.0047fe29
add esp, 0x30
ret
Function at 0x41e050
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x4973e6
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x4bc7dc]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, dword [esp + 0x28]
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.0047f431
push 4
mov dword [esp + 0x24], 0
call fcn.0048068d
mov edi, eax
add esp, 4
mov dword [esp + 0x14], edi
mov byte [esp + 0x20], 1
test edi, edi
je 0x41e0d9
call fcn.0047f260
mov dword [edi], eax
call fcn.0047f01f
push 0
lea ecx, [esp + 0x14]
mov ebx, eax
call fcn.0047f349
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x41e0ce
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0x10]
call fcn.0047f371
jmp 0x41e0db
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret 4
Function at 0x41e820
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x497779
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
mov eax, dword [0x4bc7dc]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, dword [esp + 0x24]
xor ebx, ebx
push 0x14
mov byte [esi], bl
call fcn.0048068d
mov dword [esi + 4], eax
push 0x38
mov dword [esp + 0x24], ebx
call fcn.0048068d
mov dword [esi + 8], eax
mov dword [esi + 0xc], 0xffffffff
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov byte [esp + 0x24], 2
push 0x18
mov dword [esi + 0x24], ebx
call fcn.0048068d
add esp, 0xc
cmp eax, ebx
je 0x41e913
mov dword [esi + 0x20], eax
mov dword [eax], eax
mov eax, dword [esi + 0x20]
mov dword [eax + 4], eax
mov eax, dword [esi + 0x20]
mov dword [eax + 8], eax
mov ecx, dword [esi + 0x20]
mov al, 1
mov byte [ecx + 0x14], al
mov edx, dword [esi + 0x20]
mov byte [edx + 0x15], al
call fcn.00422530
mov eax, dword [esi + 8]
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov dword [eax + 0x10], ebx
mov dword [eax + 0x14], ebx
mov dword [eax + 0x18], ebx
mov dword [eax + 0x1c], ebx
mov dword [eax + 0x28], ebx
mov dword [eax + 0x2c], ebx
mov dword [eax + 0x30], ebx
mov dword [eax + 0x34], ebx
mov eax, dword [esi + 4]
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov dword [eax + 0x10], ebx
mov eax, dword [esi + 4]
mov dword [eax], 0x41e7b0
mov ecx, dword [esi + 4]
mov dword [ecx + 4], 0x41e800
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x14
ret 4
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], vtable.stdext::bad_alloc.0
lea esi, [esp + 0xc]
mov byte [esp + 0x1c], 3
call fcn.00401010
int3

Function at 0x41ead0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0xffffffffffffffff
push 0x49cc80
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x4bc7dc]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 8], 0
mov eax, dword [eax]
push eax
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x41eb25
xor al, al
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 4
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x41eb10
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x41eb10
push eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
push edi
call fcn.0041ee20
test al, al
je 0x41eb10
mov byte [edi], 1
mov al, 1
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 4